Security concern: CodexSandboxOffline/Online assigned to entire user profile tree on Windows 11

[pperliti]

What version of Codex CLI is running?

0.101.0

What subscription do you have?

Bring Your Own Key

Which model were you using?

gpt-5.2-codex

What platform is your computer?

Windows 11 Pro

What terminal emulator and version are you using (if applicable)?

PowerShell

What issue are you seeing?

On Windows 11, Codex’s experimental sandbox creates two local users (CodexSandboxOffline and CodexSandboxOnline) that belong to the CodexSandboxUsers group.
These users are granted permissions on the project folders (and subfolders) where Codex-CLI is executed.

While this is understandable (the goal is to add an extra security layer when running commands), what I find unacceptable is that these users are also granted access to C:\Users\<USER> and—indiscriminately—to ALL subfolders under that directory. Aside from the fact that this approach dirties the environment (after uninstalling codex-cli and removing the Windows users, stale/unreferenced user SIDs can still remain on ACLs), it looks like a potential attack surface in the event of malicious commands executed via codex-cli.

The same behavior can be observed when using the IDE extension (which effectively downloads precompiled Windows binaries, but ultimately codex-windows-sandbox.exe mirrors the same behavior).

Other than using WSL, is there any way to avoid this pollution? And why isn’t this explicitly stated in the documentation? (It wouldn’t fix the issue, but at least users would be aware of it.)

What steps can reproduce the bug?

Install codex-cli on Windows and choose to setup the default sandbox when asked.

What is the expected behavior?

No response

Additional information

No response

[rayjasson98]

It might also pollute your SSH configuration in ~/.ssh, as mentioned here: #12226

[686d7066]

I just noticed the same problem. I have Windows 11 Controlled Folder Access active, meaning every application trying to access my user folder needs to be given explicit permission to do so.

I just installed the latest Codex extension for VS Code and started a conversation about reading and understanding the code of a simple test project and am getting absolutely swamped by Windows Notification about how Codex tries to access all kinds of files in my user directory, causing a new security notification every 2-3 seconds.

Why is it constantly trying to access my favorites? What is its deal trying to access my documents? The simple task I have given it does not warrant the try to read through my personal profile at all.

I see no reason why it should have any business inside my user profile at all.

[debovis]

I am having the same problem as 686d7066, IT messaged me pretty quickly.

[JackTrapper]

Two other issues where Codex granted itself NTFS permissions:

• Windows sandbox sets incorrect ACLs when creating new folders, causing issues with apply_patch #14585
• Windows sandbox may auto-apply NTFS deny ACE on world-writable workspace paths #14006

In my case it added CodexSandboxOffline (or CodexSandboxOnline; i didn't realize there were two) to D:\.
And it removed all other ACLs that were present (blocking all users from the D: drive).

[mvdbosch]

I noticed the same and got swamped by security warnings. This is really ugly and dangerous behaviour.

[PatentiaPistorius]

How has no one from Open AI replied to this? How is this still an ongoing issue? This also affects VSCode Codex extension users.

Does anyone know how to broadly and easily remove the ACL permissions for CodexSandboxUsers? Why the hell does Codex need read access for basically my entire computer?

Seems like a massive invasion of privacy and a serious screw up that Codex now has read access to basically my whole computer. And the weirdest thing is, I never had any issues before using Codex with VSCode, it was restricted to the project folder, it worked fine, and there was no invasive privacy problems. Then I was forced to accept this sandbox option 2-3 weeks ago and not only did it break functionality, it seems it's also a major privacy invasion whether intentional or not.

[JackTrapper]

Why the hell does Codex need read access for basically my entire computer?

In my case it was correctly getting access denied. So it probably ran a powershell script call to icacls to try to resolve it. I assume it was running as me; who has WRITE_DACL permission on the D:\ folder. I didn't notice any such call. And when i asked it to review the chat conversataion: it couldn't find any call either.

In order to protect against this, i removed my WRITE_DACL permission from D:\.