Requires permissions escalation for every network request even when `network_access = true`

Open 💬 9 comments Opened Jan 15, 2026 by dhentschel-truepic

💡 Likely answer: A maintainer (etraut-openai, contributor) responded on this thread — see the highlighted reply below.

What version of Codex is running?

codex-cli 0.84.0

What subscription do you have?

It's an organization subscription. I don't know the details.

Which model were you using?

gpt-5.2-codex medium

What platform is your computer?

Darwin 25.2.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

Terminal

What issue are you seeing?

All of a sudden, this morning, codex is asking me for permission every time I want it to do something that requires network access:

› Why do you keep asking for network access? You should already have network access.


• I’m in a sandboxed mode by default, and any command that makes a network request requires explicit escalation. That’s why you see me request network access when calling Jira
  APIs. If you want, I can proceed without prompting each time by continuing to run those commands with the required network permission.


› Yes, but `$CODEX_HOME/config.toml` has:

  [sandbox_workspace_write]
  network_access = true

  I've been using this for weeks and you've never asked for network access. The config file hasn't changed. Why is it all-of-a-sudden not working?


• The tool runs inside a sandbox requiring explicit permissions for network access despite approval_policy on-request. Should I proceed with escalated network requests silently?

─ Worked for 5s ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• In this session, the tool is configured with approval_policy=on-request, so I must explicitly request escalation for any command that might use the network—even if your global
  config allows it. That’s why it feels different from prior sessions.

  If you want me to proceed, I’ll keep running Jira API calls with the required network permission.


› Nothing has changed in the config. Where did that approval policy change come from?


• It’s coming from the session/tool configuration I’m given at runtime, not from your config.toml. I don’t control or see how that policy is set—only that it’s enforced for this
  session, so I have to request escalation for networked commands.

What steps can reproduce the bug?

› Please show me the results of a curl call to get `https://www.google.com/`.


• Running curl -L https://www.google.com/

 
  Would you like to run the following command?
 
  Reason: Need network access to run curl against an external URL.
 
  $ curl -L https://www.google.com/
 
› 1. Yes, proceed (y)
  2. Yes, and don't ask again for commands that start with `curl -L https://www.google.com/` (p)
  3. No, and tell Codex what to do differently (esc)
 
  Press enter to confirm or esc to cancel

What is the expected behavior?

It should run the curl command without prompting since I have this in my config.toml:

[sandbox_workspace_write]
network_access = true

This has been working well for many weeks, and as of this morning, it is prompting me for every command.

Additional information

_No response_

View original on GitHub ↗

9 Comments

etraut-openai contributor · 6 months ago

Thanks for the bug report. Does the problem go away if you downgrade to an earlier version? Do you happen to know which version was the last one that didn't exhibit this behavior for you?

jbielawski-dev · 6 months ago

I'm running into the same issue after upgrading from v0.80.0 to v0.84.0

dhentschel-truepic · 6 months ago

Confirmed. I downgraded to 0.80.0 and it will happily make the request:

› Please show me the results of a curl call to get `https://www.google.com/`.


• I'm enabling network access to run the curl command via shell and plan to summarize its output next.

• Ran curl -i https://www.google.com/
  └   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                     Dload  Upload   Total   Spent    Left  Speed
    … +71 lines
    history\\\x22\\u003EWeb History\\u003C/a\\u003E\x22,\x22psrl\x22:\x22Remove\x22,\x22sbit\x22:\x22Search by image\x22,\x22srch\x22:\x22Google Search\x22},\x22ovr\x22:{},
    \x22pq\x22:\x22\x22,\x22rfs\x22:[],\x22stok\x22:\x22bxqK27_xckeAqjN9GvZLD3ZOLJw\x22}}';google.pmc=JSON.parse(pmc);})();</script></body></html>

─ Worked for 5s ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• Got it. The curl -i https://www.google.com/ response was HTTP/2 200 and returned Google’s homepage HTML along with headers like content-type: text/html; charset=ISO-8859-1,
  server: gws, and several set-cookie values. If you want the full raw output saved to a file or truncated to headers only, say the word.

However, 0.81.0 (and 0.84.0 as well) requires escalation:

› Please show me the results of a curl call to get `https://www.google.com/`.


• I'm preparing to run a curl command that requires network access with escalated privileges, so I'll use shell_command with a require_escalated flag.

• Running curl -i https://www.google.com/

 
  Would you like to run the following command?
 
  Reason: Network access is required to fetch https://www.google.com/ via curl.
 
  $ curl -i https://www.google.com/
 
› 1. Yes, proceed (y)
  2. Yes, and don't ask again for commands that start with `curl -i https://www.google.com/` (p)
  3. No, and tell Codex what to do differently (esc)

etraut-openai contributor · 6 months ago

Thanks, that's very helpful!

aibrahim-oai contributor · 6 months ago

Can you do /feedback?

jbielawski-dev · 6 months ago

This is my current config.toml which has no issues on 0.80.0 but in 0.84.0 it requires escalation on file writes in the project directory and anything for network access.

sandbox_mode = "workspace-write"
model_reasoning_effort = "high"

[projects."/var/www/test"]
trust_level = "trusted"
sandbox_mode = "workspace-write"

[sandbox_workspace_write]
network_access = true

dhentschel-truepic · 6 months ago

/feedback sent. Thread ID: 019bc89d-bccb-72d3-b257-eaf64f4fff1c

dddraxxx · 6 months ago

same. is it fixed?

simonbs · 5 months ago

Sent feedback with /feedback. Thread ID: 019be51d-543a-76c3-b9a6-3e22cfd0d394