Codex CLI Closes Three Sandbox Isolation Gaps

CodexSep 22, 2026View original changelog

Codex CLI 0.156.0 closed three separate gaps in its execution sandbox: inbound non-loopback connections on Windows, privileged sockets on Linux and macOS, and writes through read-only file handles on macOS. Each was a route by which sandboxed code could reach further than the sandbox was meant to allow, whether by accepting an outside network connection, binding a privileged socket, or writing through a handle that had been opened read-only. The fixes land alongside related hardening work on Guardian approval caching, login redirect restrictions, and managed network proxy policy.

Key Takeaways

Codex CLI closed three distinct sandbox isolation gaps, each on a different platform surface, in release 0.156.0.
On Windows, the offline sandbox no longer allows non-loopback inbound connections to reach sandboxed code.
On Linux and macOS, sandboxed code can no longer reach privileged sockets it should not have had access to.
On macOS, a write can no longer go through a file handle that was opened read-only, closing a path to modifying protected files.
Related hardening invalidates cached Guardian approvals when a permission is widened without being re-scored.
Additional changes restrict login redirects to known platform origins and check folder trust after the startup destination resolves, not before.

Three Different Escapes, One Boundary

Codex runs model-directed commands inside a sandbox whose job is to bound what that code can touch. Release 0.156.0 fixed three distinct ways that boundary could be crossed, each on a different platform surface.

The first concerned inbound network traffic on Windows: the offline sandbox did not block non-loopback inbound connections, meaning sandboxed code could accept a connection originating outside the machine. The second involved privileged sockets on Linux and macOS, where the sandbox did not prevent code from reaching socket types it should not have had access to. The third was a macOS file-handle case, in which a write could go through a handle that had been opened read-only, so a file the sandbox considered protected could still be modified.

Related Hardening in the Same Release

Several adjacent changes shipped alongside. Cached Guardian approvals are now invalidated when a permission is widened without being re-scored, closing a case where an approval granted for a narrower action could still cover a broader one. Login setup redirects are restricted to known platform origins, and the Windows sandbox gained managed network policy support along with validation of sandbox token groups before copying security identifiers. Folder trust is now checked after the startup destination is resolved, rather than before, so consent is evaluated against the directory Codex actually opens.

Why It Matters

None of these are features a developer will notice working. They matter because the sandbox is the thing standing between model-directed code and the rest of a developer's machine, and the value of that boundary is entirely determined by whether it holds at the edges. Three separate platform-specific gaps closed in one release suggests sustained attention to those edges rather than a single incident response.