Running Codex safely at OpenAI

OpenAI has introduced a security framework for the deployment of Codex, focusing on technical boundaries, managed configurations, and detailed audit trails to ensure the safe operation of autonomous coding agents. This approach allows developers to execute low-risk actions without friction while requiring explicit human review for high-risk operations.

Security Controls and Execution Boundaries

OpenAI employs a set of technical controls to govern how Codex interacts with systems and networks, ensuring it operates within a bounded environment.

Sandboxing and Approval Policies

Execution is managed through a combination of sandboxing and approval policies. The sandbox defines the technical boundaries of the system, specifying where Codex can write files and which network paths are protected. When Codex needs to perform an action outside of this sandbox, it must trigger an approval policy. Users can grant approval for a specific action or for a type of action for the duration of a session.

To reduce user interruption, OpenAI uses Auto-review mode. This feature utilizes an auto-approval subagent that analyzes the planned action and recent context to automatically approve low-risk actions or high-risk actions that have sufficient user authorization, while still stopping for review on actions with unintended consequences.

Network and Identity Management

Codex is restricted from open-ended outbound network access. A managed network policy allows known-good destinations and blocks unwanted destinations, requiring human approval for any unfamiliar domains.

Authentication is handled through secure mechanisms to ensure activity is tied to organizational controls:

• Credentials: CLI and MCP OAuth credentials are stored in the secure OS keyring.
• Authentication: Login is forced through ChatGPT.
• Workspace Integration: Access is pinned to the ChatGPT enterprise workspace, making all activity available in the ChatGPT Compliance Logs Platform.

Command Rules and Configuration

OpenAI uses specific rules to differentiate between benign and dangerous shell commands. Common development commands are permitted without approval outside the sandbox, while dangerous patterns are either blocked or require explicit approval.

These security postures are enforced through managed configurations, including cloud-managed requirements, macOS managed preferences, and local requirements files. These admin-enforced controls are consistent across the desktop app, CLI, and IDE extension and cannot be overridden by users.

Agent-Native Telemetry and Auditing

While traditional security logs track what happened (e.g., a process started), OpenAI implements agent-aware telemetry to explain why an action was taken.

OpenTelemetry Integration

Codex supports OpenTelemetry log export for a variety of events, including:

• User prompts
• Tool approval decisions
• Tool execution results
• MCP server usage
• Network proxy allow/deny events

These logs are available via the OpenAI Compliance Platform for Enterprise and Edu customers and can be centralized in SIEM and compliance logging systems.

AI-Powered Security Triage

OpenAI utilizes an AI-powered security triage agent to analyze Codex logs. When an endpoint security tool flags a suspicious event, the triage agent inspects the original user request, tool activity, approval decisions, and network policy results to determine the intent. This analysis allows security teams to distinguish between expected agent behavior, benign mistakes, and actual security threats.

Operationally, these logs are also used to monitor internal adoption, track MCP server usage, and tune the network sandbox and rollout configurations.