OpenAI Discloses Codex Safe Operations

OpenAI explained that it operates Codex within a restricted execution environment, using a method that quickly passes low-risk tasks while stopping high-risk tasks for approval.

• Sandbox controls write scope, network access, and protected paths.
• Approval policy requires user approval for actions outside the sandbox or dangerous operations.
• auto_review mode sends planned actions and recent context to a separate subagent to auto-approve low-risk requests.
• The network only passes allowed destinations, and unfamiliar domains are subject to approval.
• CLI/MCP OAuth credentials are stored in the OS keyring, using ChatGPT login and enterprise workspace pinning.
• prefix_rule allows repetitive commands like gh pr view/list and kubectl get/describe/logs while controlling dangerous patterns.

The management method is deployed via cloud-managed requirements, macOS managed preferences, and local requirements files, applied across the desktop app, CLI, and IDE extension.

For operations and auditing, OpenAI stated that it exports OpenTelemetry logs covering user prompts, approval decisions, execution results, MCP server usage, and network allow/deny events, and that Codex activity can also be checked in the Compliance Platform for Enterprise/Edu. OpenAI also uses these logs for security triage and rollout tuning.