Windows Desktop: setting [windows] sandbox = elevated blocks app startup with Couldn't update Agent sandbox

Title:
Windows Desktop: setting [windows] sandbox = "elevated" blocks app startup with "Couldn't update Agent sandbox"

What version of the Codex App are you using (From "About Codex" dialog)?

About dialog: 26.616.71553
Windows app package observed locally: OpenAI.Codex_26.616.9593.0_x64__2p2nqsd0c76g0

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Windows x64

What issue are you seeing?

Codex Desktop becomes unusable on startup when the Windows sandbox mode is changed from unelevated to elevated in config.toml.

With this config:

sandbox_mode = "danger-full-access"

[windows]
sandbox = "elevated"

After fully closing and reopening Codex Desktop, the app opens to the start screen but shows:

Couldn't update Agent sandbox
Retry the update to continue

Clicking Retry update does not recover the app. Codex remains blocked until the config is changed back to:

[windows]
sandbox = "unelevated"

Once changed back to unelevated, Codex Desktop starts normally again. The UI still shows Full access / danger-full-access.

What steps can reproduce the bug?

1. On Windows, open config.toml.
2. Set:

sandbox_mode = "danger-full-access"

[windows]
sandbox = "elevated"

1. Fully quit Codex Desktop.
2. Reopen Codex Desktop.
3. Observe the startup error:

Couldn't update Agent sandbox
Retry the update to continue

1. Click Retry update.
2. The update does not complete and Codex cannot be used.
3. Change config back to:

[windows]
sandbox = "unelevated"

1. Reopen Codex Desktop.
2. Codex starts normally again.

What is the expected behavior?

Either:

• elevated Windows sandbox setup should complete successfully and Codex Desktop should start normally, or
• Codex should show a clear actionable error explaining why the elevated Agent sandbox update failed and how to recover without manually editing config.toml.

At minimum, the app should not become unusable at startup with only a retry button that never succeeds.

Actual behavior

Codex Desktop blocks startup with:

Couldn't update Agent sandbox
Retry the update to continue

The only reliable workaround found so far is reverting:

[windows]
sandbox = "unelevated"

Additional information

This may be related to the Windows Desktop/MSIX elevated sandbox setup path rather than a missing helper binary.

On this installation, the sandbox helper files already exist next to codex.exe in the Codex Desktop runtime folder:

%LOCALAPPDATA%\OpenAI\Codex\bin\<hash>\codex.exe
%LOCALAPPDATA%\OpenAI\Codex\bin\<hash>\codex-command-runner.exe
%LOCALAPPDATA%\OpenAI\Codex\bin\<hash>\codex-windows-sandbox-setup.exe

So the workaround from some standalone CLI reports, where users copy codex-command-runner.exe and codex-windows-sandbox-setup.exe from codex-resources into bin, does not appear to apply here because those files are already present beside codex.exe.

Older sandbox logs on the same machine show failures like:

grant read ACE failed on C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__2p2nqsd0c76g0\app for sandbox_group: SetNamedSecurityInfoW failed: 5
read ACL run completed with errors
setup error: read ACL run had errors

I also checked the proxy-related workaround from another issue:

• There is no .codex\.env file on this machine.
• No HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables are set.

So this does not look like the proxy/sandbox marker mismatch case.

Related issues that appear similar:

• https://github.com/openai/codex/issues/27125
• https://github.com/openai/codex/issues/27889
• https://github.com/openai/codex/issues/29089