Codex on Windows used to ship without a sandbox. OpenAI just closed that gap — natively, not through a WSL wrapper.
What’s actually new:
- File access boundary enforced at the OS level via Windows job objects
- Network restrictions filtered through native primitives, not a Linux compatibility shim
- Auto-approval becomes defensible for routine work — refactors, test runs, dependency installs
Until now the honest answer to “is it safe to let Codex auto-approve commands on my work laptop?” was no. A misfired rm or a prompt-injected curl | sh had nothing standing between it and your filesystem.
NOTE
The engineer who led the work, David Wiesen, called it the deepest technical project of his career.
This also removes the main reason Windows shops were quietly steering developers toward Mac for AI coding. Cursor, Claude Code, and Copilot Workspace already run natively on Windows; Codex being the odd one out on sandboxing was a real procurement objection. Gone.
Available now in Codex for Windows. OpenAI’s writeup covers the architecture choices in detail — worth reading for the design tradeoffs around Windows job objects and network filtering, not just the announcement.