How OpenAI runs Codex securely
OpenAI operates Codex with a security architecture built around sandboxing, approvals, network policies, and agent-native telemetry to support safe and compliant coding agent adoption.
Sandboxing
Every Codex execution runs inside an isolated sandbox environment. This sandbox restricts filesystem access, process creation, and system calls to a minimal, allowlisted set of operations. The sandbox is ephemeral by default, meaning each task starts from a clean state and is destroyed after completion, preventing cross-task contamination and limiting the blast radius of any malicious or erroneous code.
Approvals
Codex is designed with a human-in-the-loop approval model for privileged actions. Before executing commands that modify the host system, access external network resources, or interact with production credentials, Codex pauses and requests explicit user approval. This approval gate is enforced at the policy level, not just as a UI convenience, and can be configured to require multi-party sign-off for high-risk operations.
Network policies
Network access from Codex sandboxes is governed by strict egress and ingress policies. By default, sandboxes have no network access. When network access is required, it is scoped to specific allowlisted domains, IP ranges, or service endpoints via a proxy layer. All traffic is logged and inspected for anomalies, and connections to internal or sensitive infrastructure are blocked unless explicitly permitted by organizational policy.
Agent-native telemetry
Codex emits structured, agent-native telemetry for every action it takes. This includes a full audit trail of commands executed, files read or written, network requests made, and approval decisions. Telemetry is correlated with the originating prompt and session ID, enabling security teams to replay, investigate, and attribute any incident to a specific agent run. This telemetry is retained in a tamper-evident log store and is integrated with SIEM systems for real-time alerting.
Key takeaway: OpenAI’s security model for Codex treats the coding agent as an untrusted, potentially hostile actor. By combining sandboxing, explicit approvals, network segmentation, and comprehensive telemetry, the system ensures that even if the agent misbehaves, the impact is contained, observable, and reversible.
Compliance and adoption
For organizations adopting Codex, these security controls map directly to common compliance frameworks:
- SOX / SOC 2: Approval workflows and audit telemetry satisfy change management and access control requirements.
- GDPR / CCPA: Sandboxing prevents unauthorized data processing, and telemetry provides data flow visibility.
- ISO 27001: Network policies and sandbox isolation align with asset management and access control clauses.
- PCI DSS: Ephemeral sandboxes and network restrictions reduce the scope of cardholder data exposure.
By default, Codex runs with the least privilege necessary, and every security control is configurable via policy as code, allowing security teams to enforce their own standards without modifying the agent itself.
Operational example
A typical secure Codex session follows this sequence:
1. User submits a task with a clear scope.
2. Codex spawns an ephemeral sandbox with no network access.
3. Agent analyzes the repository and proposes a plan.
4. User reviews and approves the plan.
5. Agent executes read-only commands; writes are buffered.
6. For any write or network call, Codex requests approval again.
7. All actions are streamed to telemetry in real time.
8. Sandbox is destroyed; logs are retained for audit.This workflow ensures that the agent never operates outside the boundaries set by the organization, and every step is verifiable after the fact.