--- title: "How OpenAI Built a Secure Windows Sandbox for Codex Agents" url: https://daily.dev/posts/how-openai-built-a-secure-windows-sandbox-for-codex-agents-d09yzesng source_url: https://www.infoq.com/news/2026/06/codex-windows-sandbox-design type: article source: "InfoQ" published: 2026-06-05T14:47:59.607Z updated: 2026-06-18T21:23:00.914Z tags: ["security", "ai-agents", "codex"] reading_time: 3 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How OpenAI Built a Secure Windows Sandbox for Codex Agents **[InfoQ](https://daily.dev/sources/infoq)** · 3 min read · 1 upvotes · 0 comments ## Summary OpenAI has published details of the Windows sandbox architecture powering its Codex coding agent. After finding existing Windows isolation mechanisms insufficient for autonomous coding agents, OpenAI built a custom approach using security identifiers (SIDs), access control lists (ACLs), and restricted tokens. An initial 'unelevated sandbox' used a synthetic sandbox-write SID to restrict writes to designated directories. A later 'elevated sandbox' redesign introduced dedicated local Windows accounts (CodexSandboxOffline and CodexSandboxOnline) with firewall-controlled network access. The design aims to let Codex operate on real developer environments without requiring constant approval or granting unrestricted system access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#codex](https://daily.dev/tags/codex) [View this post on daily.dev](https://daily.dev/posts/how-openai-built-a-secure-windows-sandbox-for-codex-agents-d09yzesng)