[Windows Sandbox] Codex running Read-Only even when Sandbox set to danger-full-access
What version of Codex is running?
0.56.0
What subscription do you have?
azure endpoint
Which model were you using?
gpt-5-codex high on azure endpoint
What platform is your computer?
Microsoft Windows NT 10.0.26100.0 x64
What issue are you seeing?
Even when setting approvals to Full Access and Sandbox to danger-full-access, Codex on Windows still thinks it is running on Read-only mode.
Model: gpt-5-codex (reasoning high, summaries auto)
Approval: never
Sandbox: danger-full-access
› Can you access the network or write files?
• I’m running in a read-only sandbox with restricted network access, so I can’t modify files and can only run local read commands without reaching out to the network.
This looks like a regression, since it was fine before the 0.5x versions. Before 0.56.0, it had this behavior, but I was able to convince it that it actually had full access. Now this is not working anymore.
What steps can reproduce the bug?
On Windows, without running WSL, give full access to codex and ask it to do a task that requires network access or writing files. It will tell that it is running in read-only mode.
What is the expected behavior?
Expect behavior is to honor the configuration passed to it. If sandbox is set to full access, it should not think it is in Read-only mode.
Additional information
_No response_
2 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
Thanks for posting. This is a known limitation. We're actively working on addressing this, but it's challenging because Windows (unlikely MacOS or Linux) doesn't have an off-the-shelf sandboxing mechanism that meets our needs. We need to create one from scratch. We have an early version working, and it's going through testing and review now, so we will hopefully have something to announce soon.
In the meantime, we recommend that codex users on Windows use WSL. In that environment, we can offer proper sandboxing.
Incidentally, we don't recommend using "danger-full-access" unless you're running in a separate isolated environment such as a dedicated VM or docker container.
I'm going to close this issue as a duplicate. We're using this issue to track this.