💔Sandbox allowed unauthorized out-of-workspace operations despite restrictions

I'm not able to replicate this behavior on 0.45 or 0.46 or the main branch. It's not clear from your screenshot that it actually created a folder, nor that it's actually running in a sandbox. Actual folder creation should show something like:

**Running** mkdir -p /Users/....

If you see that in a sandbox and it didn't prompt for approval, that's what a bug should look like. It's possible that the agent was hallucinating, so it's good that you didn't trust it to run outside of a sandbox, but also don't trust that what it tells you in the sandbox is truthful either. 🙂

@RadixIsatidis I think we'll need:

1. /status output in the session to confirm that the settings are correct
2. clearer file paths to understand exactly the behavior that is happening. A session id would also help debug this case, in lieu of sharing full file paths publicly.

@RadixIsatidis I think we'll need: 1. /status output in the session to confirm that the settings are correct 2. clearer file paths to understand exactly the behavior that is happening. A session id would also help debug this case, in lieu of sharing full file paths publicly.

FYI

I've added a screenshot of the /status output and reduced the area covered by mosaic in the original image. The redacted text includes my username and project name, which I prefer not to expose publicly.

To briefly describe the screenshot: I'm running Codex in sandbox mode with the working directory explicitly set to ~/IdeaProjects/my-project-name. The sandbox configuration is set to workspace-write. However, Codex was able to create folders and read/write files directly under my HOME directory without my explicit approval, which seems to violate the expected sandbox constraints.

<img width="2644" height="2160" alt="Image" src="https://github.com/user-attachments/assets/b1476fe7-127d-4a16-ba99-e01534b32e56" />

<img width="1460" height="628" alt="Image" src="https://github.com/user-attachments/assets/84f4d264-535a-48d1-91f5-95709d589b7c" />

<img width="3516" height="2022" alt="Image" src="https://github.com/user-attachments/assets/aeb97bc3-eaa1-44b3-b900-19c5d6af0de8" />

I checked the Codex process details in macOS Activity Monitor, and it appears that the process is not running inside a sandbox, even though I explicitly launched it with the sandbox option enabled.

I'm not able to replicate this behavior on 0.45 or 0.46 or the main branch. It's not clear from your screenshot that it actually created a folder, nor that it's actually running in a sandbox. Actual folder creation should show something like: **Running** mkdir -p /Users/.... If you see that in a sandbox and it didn't prompt for approval, that's what a bug should look like. It's possible that the agent was hallucinating, so it's good that you didn't trust it to run outside of a sandbox, but also don't trust that what it tells you in the sandbox is truthful either. 🙂

In fact, the folder was really created successfully — that’s precisely why I came here to report this bug. The situation is actually worse than it first appeared: Codex executed an rm -rf command that deleted my entire project directory. This is what led me to start questioning whether the sandbox mode is functioning as intended.

Hello team,

As far as i can tell the agent can leak the codex credentials.
As of version 0.53.0 i can instruct to read $CODEX_HOME/auth.json, which is in a location outside of the project directory.
The authentication credentials of codex need to be available to codex-cli, but not to the agent itself.

I was trying to dockerise the codex cli as it could do the following in the normal linux sandbox

1. read any file that the user can read, outside of the project directory
2. run env and read all credentials that are available as environment variables

You can reproduce the behavior by doing commands such as these

codex --sandbox read-only --ask-for-approval never sandbox linux env
codex --sandbox read-only --ask-for-approval never sandbox linux cat ~/.codex/auth.json

I am attaching the example setup within docker where the agent itself is reading the auth.json file.

<img width="1901" height="1077" alt="Image" src="https://github.com/user-attachments/assets/4b960a9e-9e3f-4c54-9191-68368878c94a" />

Closing old bug.