How OpenAI Operates Codex Safely

Instead of letting Codex run freely, OpenAI controls it by combining sandbox and approval policy together. The sandbox defines write paths, network access, and protection boundaries, while the approval policy requires human review for actions outside the sandbox or for high-risk tasks. Users can approve once or allow that type for the entire session, and for repetitive low-risk requests, Auto-review mode automatically approves them to maintain flow.

Network and authentication are also strictly restricted. Only known destinations are allowed, unfamiliar domains are blocked without approval, and domains like pastebin.com can be explicitly blocked. CLI and MCP OAuth credentials are stored in the OS keyring, and login is pinned to ChatGPT and a specific enterprise workspace.

Command policy is managed with prefix_rule. Read-only patterns like gh pr view/list and kubectl get/describe/logs are allowed, while dangerous commands are blocked or routed to approval. This configuration is deployed via cloud-managed requirements, macOS managed preferences, and local requirements files, and applies across the desktop app, CLI, and IDE extension.

Visibility is secured through OpenTelemetry logs.

• User prompts
• Tool approval decisions and execution results
• MCP server usage
• Network proxy allow/deny events

These logs can be aggregated into the Compliance Platform and SIEM, and OpenAI's AI security triage agent analyzes the original request, tool activity, approvals, and network policy decisions together to distinguish normal behavior from actual risk.