Codex in a Minute: Sandboxing

In one sentence

Sandboxing restricts Codex’s execution environment so tool use stays inside an accepted blast radius.

Why it matters

An agent that can run commands is powerful. Without isolation, a bad instruction—or a poisoned file—can reach secrets, production systems, or unrelated directories.

How it works

Think in layers:

• workspace — which directory is writable;
• network — whether outbound calls are allowed;
• privileges — whether elevating or escaping the sandbox is possible;
• approvals — which actions still need a human.

Exact Codex sandbox modes and defaults evolve; verify current options in OpenAI docs. The engineering rule is stable: match sandbox strictness to trust in the task and the data the agent can read.

Example

Tighter for unknown repos and exploratory tasks. Looser only for disposable clones where secrets are absent and network is unnecessary.

Agentic coding use

Sandboxing pairs with Git worktrees: isolate the files and isolate the runtime. Together they make parallel agents safer.

Watch out

A sandbox is not a substitute for secret hygiene. If credentials are mounted into the environment, the agent can still misuse them inside the box.