Allow Windows users to run Codex in "no sandbox" mode and explicitly approve/deny commands

[rwalle]

What variant of Codex are you using?

CLI

What feature would you like to see?

Currently, for Windows users, whenever they use Codex with any new folder (workspace), they will be greeted with the sandbox setup screen and have to choose between default sandbox, non-admin sandbox or quit.

We would like another "no sandbox" option where user explicitly approves/denies commands.

Additional information

The default sandbox is not allowed by IT (due to concerns documented in #12343 and elsewhere), while non-admin sandbox carries significant risk and allows running arbitrary command without approval in our testing.

We do notice that if user chooses "quit" and immediate open codex again for the same folder, they can use Codex in a mode where they explicitly approve/deny any potentially risky command. There is no sandbox being applied in this mode.

Could Codex make this "no sandbox" mode an explicit choice in that screen?

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• Opportunity: make host-faithful local use a first-class Codex workflow #17660

Powered by Codex Action

[rwalle]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

* [Opportunity: make host-faithful local use a first-class Codex workflow #17660](https://github.com/openai/codex/issues/17660)

Powered by Codex Action

not a duplicate

[etraut-openai]

Using Codex without any form of sandboxing is highly discouraged. It's not safe, so it's not an option that we want to make readily available. The "no sandbox" mode is recommended only if you have your own sandbox in place (e.g. a container or VM).

[rwalle]

Using Codex without any form of sandboxing is highly discouraged. It's not safe, so it's not an option that we want to make readily available. The "no sandbox" mode is recommended only if you have your own sandbox in place (e.g. a container or VM).

Thanks for your reply. Just in case there is any confusion -- here the behavior is that user manually approves/denies any risky action, which is already there as an existing mode, just not exposed. This is also consistent with the default behavior of other coding agents in our survey (at least Claude Code and Gemini CLI)

The current "unelevated sandbox" carries more risk than manual approval workflow in our opinion -- we can easily come up with examples where a command that writes outside the current workspace folder runs without approval.