Approved `decision = "prompt"` command remains inside Linux sandbox on remote SSH host

What version of the Codex App are you using (From “About Codex” dialog)?

26.715.31925

What subscription do you have?

Pro (5x)

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

A command matching an exec-policy rule with decision = "prompt" generates an approval prompt. After approval, the command remains inside the Bubblewrap sandbox with NoNewPrivs=1.
This prevents sudo from elevating privileges:

sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.

The documented behavior says an approved decision = "prompt" command should run outside the sandbox:
https://learn.chatgpt.com/docs/agent-configuration/rules#create-a-rules-file

What steps can reproduce the bug?

1. Connect ChatGPT Desktop to Ubuntu host over SSH.

1. Open a remote Codex task using the permission profile above.

1. Request execution of:

sudo /usr/bin/id

1. Approve the command in the displayed approval modal.

1. Observe that sudo fails because no_new_privileges remains enabled.

What is the expected behavior?

After approval, Codex should execute the matching command outside the sandbox without inheriting Bubblewrap’s no_new_privileges setting. sudo should then evaluate the host’s normal sudoers policy.

Actual behavior

The approval modal appears and the command is approved, but execution retains NoNewPrivs=1. Consequently, sudo cannot elevate privileges even though the same operation succeeds directly over SSH.
The issue reproduced multiple times, including after fully restarting ChatGPT Desktop.

Additional information

Versions

• ChatGPT Desktop: 26.715.31925
• Remote Codex CLI: 0.144.1
• Model: gpt-5.6-sol
• MacOS: 26.5.2 (25F84)

Remote Environment

• ChatGPT Desktop connected to the remote host over SSH
• Platform: Linux 7.0.0-27-generic x86_64 unknown
• Remote OS: Ubuntu 26.04
• Bubblewrap: 0.11.1
• Remote user: codex

Relevant configuration

From /home/codex/.codex/config.toml:

approval_policy = "on-request"
approvals_reviewer = "user"

default_permissions = "server-admin"

[permissions.server-admin.filesystem]
":root" = "read"
":slash_tmp" = "write"
":tmpdir" = "write"

"/home/codex" = "write"

Additional filesystem and network permissions are configured but omitted because they are unrelated to this reproduction.

From /home/codex/.codex/rules/default.rules:

prefix_rule(
    pattern = ["sudo"],
    decision = "prompt",
    justification = "Every root command requires human review.",
    match = ["sudo /usr/bin/id", "sudo systemctl restart docker"],
)

ChatGPT Desktop was fully restarted after creating the rule and configuration.

Rule verification

The rule was independently validated from an administrative SSH session:

sudo -iu codex /home/codex/.local/bin/codex execpolicy check --pretty \
  --rules /home/codex/.codex/rules/default.rules \
  -- sudo /usr/bin/id

Output:

{
  "matchedRules": [
    {
      "prefixRuleMatch": {
        "matchedPrefix": [
          "sudo"
        ],
        "decision": "prompt",
        "justification": "Every root command requires human review."
      }
    }
  ],
  "decision": "prompt"
}

Sandbox state

Inside the Codex command environment:

sed -n 's/^NoNewPrivs:[[:space:]]*//p' /proc/self/status

Output:

1

Direct SSH control

Running the same operation directly over SSH, outside Codex:

ssh [host] 'sudo -n /usr/bin/id'

Output:

uid=0(root) gid=0(root) groups=0(root)

This confirms that the remote codex user has working passwordless sudo and that the host sudoers configuration is valid.

Additional control checks

• Normal sandboxed shell commands execute successfully.
• Direct Docker commands such as docker ps execute successfully.
• The exec-policy rule parses and matches correctly.
• The failure is specific to privilege elevation from the approved Codex command environment.