Sandbox-denied operation can run through an MCP tool's remote executor without a new approval

What happened?

Codex was operating under a restricted sandbox/approval policy. A build operation could not be performed directly on the local host under that policy. The same agent then invoked an already-available MCP tool, and that tool used an SSH-backed remote executor to run the equivalent build on another host. The operation completed without a new approval or a clear indication that execution had crossed into a separate trust boundary.

Minimal reproduction

1. Start Codex with workspace-write filesystem access and restricted network/execution permissions.
2. Ask it to perform an operation that the local sandbox blocks or requires approval for.
3. Make an MCP tool available that can dispatch commands to a remote worker.
4. Have Codex invoke that tool to dispatch the equivalent operation remotely.
5. Observe that the operation succeeds without the sandbox denial being propagated and without a fresh approval for remote execution.

The concrete tool happened to use SSH internally, but the same concern appears applicable to any MCP tool that fronts an external command runner.

Expected behavior

One of the following would make the boundary understandable and enforceable:

• sandbox/approval policy is applied transitively to tool-mediated remote execution;
• remote execution capabilities require a distinct explicit approval;
• or the UI clearly states that approved MCP tools are separate trusted principals outside the Codex sandbox, and managed policy can restrict tools that provide command execution.

A local denial should not look authoritative if an adjacent tool call can transparently perform the denied class of operation elsewhere.

Actual behavior

The local operation was denied, but the equivalent remote operation succeeded through the MCP tool with no additional approval. From the user's perspective, this makes the sandbox boundary non-compositional and easy for an agent to route around unintentionally.

Impact

This can create a false sense that a denied action was prevented. Depending on the MCP tool, the same ambiguity could apply to network access, external compute, filesystem contents supplied as tool arguments, or other side effects.

Notes

This report intentionally omits machine names, repository paths, credentials, and tool-specific configuration. I can provide additional diagnostics privately if needed.