codex ↗

OpenAI's Rust-based local agent (npm @openai/codex), gpt-5-class with built-in OS-level sandboxing (Seatbelt on macOS, Landlock + seccomp on Linux). CVE-2025-59532 sandbox bypass (fixed 0.39.0) и CVE-2025-61260 config-load RCE (fixed 0.23.0).

Version Pinning

Both 2025 CVEs were fixed in 0.23.0 and 0.39.0. Pin to a known-good minor; never auto-update to latest.

npm install -g @openai/[email protected]
codex --version

Tip: lock the version in package.json or mise.toml; subscribe to GitHub Security Advisories for openai/codex.

Network Exposure

--remote ws://host:port exposes the TUI to an app-server; [sandbox_workspace_write] network_access = true lets sandboxed shell commands reach the internet (default deny on Linux; silently ignored on macOS Seatbelt per issue #10390).

sandbox_mode = "workspace-write"
[sandbox_workspace_write]
network_access = false

Tip: scope network per-task: codex --config sandbox_workspace_write.network_access=true only for installs.

Authentication (ChatGPT OAuth + API Key)

Prefer "Sign in with ChatGPT" device-code OAuth over a long-lived OPENAI_API_KEY — refresh token rotates every ~10 days and can be revoked from your OpenAI account.

codex login          # OAuth device flow
codex login --api-key $OPENAI_API_KEY
codex logout         # clears keychain + auth.json

Tip: enable MFA on the OpenAI account backing OAuth; use codex logout rather than rm so keyring entries are also wiped.

Sandbox (Default-On Seatbelt / Landlock)

Defaults to sandbox_mode = "workspace-write": read-only outside workspace, writes confined to session cwd, network blocked. macOS Seatbelt + Linux Landlock+seccomp. Never run as root.

sandbox_mode = "workspace-write"
[sandbox_workspace_write]
writable_roots = ["/Users/me/projects/hardenclaw"]
exclude_tmpdir_env_var = false

Tip: for code review of untrusted repos downgrade to sandbox_mode = "read-only" and require --ask-for-approval on-request.

Approval Modes / Tool Allowlist

--ask-for-approval accepts untrusted (prompt for state-mutating), on-request (default with workspace-write), never (silent — CI only).

codex --sandbox read-only --ask-for-approval untrusted
codex exec --sandbox workspace-write -a on-request "refactor auth.ts"

Tip: configure approvals_reviewer = "auto_review" so a secondary model screens approval requests for exfiltration/credential-probing.

Credentials (`~/.codex/auth.json`)

Holds access_token, refresh_token, id_token, account_id — treat like an SSH private key. Verify mode 0600. Codex also reads workspace .env.

chmod 600 ~/.codex/auth.json
ls -la ~/.codex/auth.json    # expect -rw-------

Tip: on shared boxes, CODEX_HOME=/run/user/$UID/codex puts tokens on tmpfs that disappears on logout.

`--dangerously-bypass-approvals-and-sandbox` Risks

Alias --yolo. Disables Seatbelt/Landlock AND all approval prompts. A single malicious AGENTS.md, web result, or MCP response can rm -rf ~. Reserve for throwaway containers only.

# ONLY inside a disposable container
docker run --rm -it -v $PWD:/work codex-sandbox \
  codex --dangerously-bypass-approvals-and-sandbox "..."

Tip: add a shell alias that refuses the flag outside a container: alias codex='[ -f /.dockerenv ] || _strip_yolo; command codex'.

Prompt Injection (Markdown / Web / MCP)

AGENTS.md files at every directory level are injected as user messages near top of context (NVIDIA documented indirect injection via dependency-supplied AGENTS.md). Web search results, file contents, MCP tool output are all untrusted text.

[mcp_servers.github]
command = "/usr/local/bin/mcp-github"   # absolute path, not npx
args = ["--readonly"]
enabled_tools = ["search_code", "get_issue"]

Tip: disable --search for untrusted repos; review every AGENTS.md with git log -p; never auto-load project .codex/config.toml from a freshly cloned repo.

Updates

CVE cadence (0.23.0, 0.39.0) shows Codex is patching live security issues monthly.

npm view @openai/codex versions --json | tail
npm audit --package-lock-only

Tip: automate weekly gh api repos/openai/codex/security-advisories check in CI; alert on any new GHSA.

Audit Logs

Session transcripts to $CODEX_HOME/history.jsonl (cap with [history] max_bytes). Lifecycle hooks (PreToolUse / PostToolUse in ~/.codex/hooks.json) stream every shell invocation to syslog or a SIEM.

log_dir = "/var/log/codex"
[history]
persistence = "save-all"
max_bytes = 104857600

[[hooks.PreToolUse]]
matcher = "^Bash$"
[[hooks.PreToolUse.hooks]]
type = "command"
command = "logger -t codex"

Tip: set allow_managed_hooks_only = true in /etc/codex/requirements.toml so users can't disable audit hooks.

References & further reading