codex-windows-sandbox-setup.exe keeps giving full read/execute permissions to CodexSandboxUsers recursively on entire user directory

Running Process Monitor filtered on Operation is SetSecurityFile reveals that codex-windows-sandbox-setup.exe keeps giving most files/directories inside the user directory read/execute permission to CodexSandboxUsers (recursively), no matter the context or location of the project directory.

This includes:

• the entirety of the AppData folder
• Specific private ssh keys causing ssh to complain about unsafe file permissions (.pub gets ignored)
• .bash_history
• Tons of other sensitive files

This seems like an extreme breach of security and I can't find this documented and only mentioned in some dead tickets.

Seems to get triggered in the background randomly when using codex, after which it takes a few minutes to change the permissions of files and folders under the user folder