›_ Codex Issues
Codex Issues / #6487

Agent doesn’t request escalation after network-denied command in on-request mode

Resolved 💬 3 comments Opened Nov 11, 2025 by ritoaur Closed Nov 11, 2025
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex is running?

MacBook-Air ~ % codex --version codex-cli 0.57.0

What subscription do you have?

ChatGPT Business

Which model were you using?

gpt-5-codex

What platform is your computer?

raurioles@Ritos-MacBook-Air ~ % uname -mprs Darwin 25.0.0 arm64 arm

What issue are you seeing?

Environment:

  • Codex CLI (Homebrew/NPM install)
  • approval_policy = on-request
  • sandbox_mode = workspace-write
  • network_access = restricted

Impact: network-dependent tasks in restricted mode stall unless the user notices and reconfigures the environment. ChatGPT will adamantly deny that it can make network calls and when proven wrong via history log it shuts down completely and does not offer to do anything else. It will literally say that the conversation is no longer productive and "shutting it down"

What steps can reproduce the bug?

  1. Ask the agent to run aws sts get-caller-identity. or any network call
  2. Command fails with “Could not connect to the endpoint URL…”.
  3. Agent reports the failure but doesn’t rerun with with_escalated_permissions=true.

What is the expected behavior?

ChatGPT recognizes the need for elevated permissions and prompts the user appropriately by immediately requesting escalation (with justification) and reruns the command.

Actual: agent stops after the failure, leaving the user to manually change permissions.

Additional information

_No response_

View original on GitHub ↗

3 Comments

github-actions[bot] contributor · 9 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #5092
  • #6251
  • #5533

Powered by Codex Action

etraut-openai contributor · 9 months ago

Thanks for the bug report. We've shared the feedback with the team members who are responsible for training our codex models. We're tracking this feedback and similar reports so we can make the model more robust in future iterations.

If you see other model behavior that you'd like to report, please use the recently-added /feedback command in the CLI. That will provide us with additional details including logs and conversation text.

leynos · 9 months ago

@etraut-openai Why not just give the model clear feedback that the command failed because it did something not permitted by the sandbox and that it MUST request user permission to re-execute the command?

I would also point the user to the writable_roots config option. I only learned of this today.