Codex does not seem to know when a tool call fails due to sandboxing

Open 💬 7 comments Opened Dec 22, 2025 by igor-makarov

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex is running?

codex-cli 0.77.0

What subscription do you have?

API key

Which model were you using?

gpt-5.1-codex-max

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

When Codex tries to run some commands, they fail in odd ways:

git writes (like in #6797)
xcodebuild (Apple's CLI for building with Xcode)
swiftformat (Swift auto-formatter, has shared cache outside the sandbox)

In these cases (and I'm sure I've had others), Codex is completely unaware that these are sandboxing issues, and therefore tries to resolve the issues in ways that don't make sense - deleting git index, trying to find an Xcode workspace file, etc.

I am running with these security settings:

Approval: on-request Sandbox: workspace-write

I believe some indication to the model that "the command attempted to cross a sandbox boundary" might be helpful.

What steps can reproduce the bug?

Run codex with xcodebuild.

What is the expected behavior?

Sandbox permission prompt

Additional information

_No response_

View original on GitHub ↗

7 Comments

github-actions[bot] contributor · 7 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#8217
#8218
#7071
#6428

Powered by Codex Action

igor-makarov · 7 months ago

These issues seem to be related, but I think this is a more broad high-level design issue: the tool calls fail with opaque and different errors and Codex does not understand that this is a sandbox issue.

igor-makarov · 7 months ago

More information: running log stream shows the offending process being denied by the sandbox:

log stream --predicate 'eventMessage CONTAINS "deny"'
2025-12-22 18:50:12.151270+0200 0x6f1d61c  Error       0x0                  0      0    kernel: (Sandbox) Sandbox: git(77020) deny(1) file-write-create /Users/xxxx/redacted/.git/index.lock

dylan-hurd-oai contributor · 7 months ago

@igor-makarov could you use /feedback for some of these sessions and provide thread ids?

And just to be explicit, the desired behavior is that the model should run these commands with escalated permissions?

igor-makarov · 6 months ago

Hi, I have not used the feedback tool, though I do still believe this to be a harness design issue. If I understand correctly, it expects the model to "guess" that the sandbox was the cause of the failure, but in many cases the external tools run do not make this clear at all.

igor-makarov · 6 months ago

I've realized that the Claude Code sandbox is open source, and apparently it does log monitoring pretty much in the same way I described:

https://github.com/anthropic-experimental/sandbox-runtime/blob/a266a31cd6d34f627b5a8cc40cdab192913f6369/src/sandbox/macos-sandbox-utils.ts#L735

leynos · 6 months ago

Why isn't the sandbox just instrumented to report attempts to write outside of it? Asking the model to guess when it could be done deterministically seems like a strange design choice.