Codex helps protect your code and data and reduces the risk of misuse.
This page covers how to operate Codex safely, including sandboxing, approvals, and network access. If you are looking for Codex Security, the product for scanning connected GitHub repositories, see Codex Security.
By default, the agent runs with network access turned off. Locally, Codex uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace), plus an approval policy that controls when it must stop and ask you before acting.
For a high-level explanation of how sandboxing works across the ChatGPT desktop app, Codex CLI, and IDE extension, see sandboxing. For a broader enterprise security overview, see the Codex security white paper.
Sandbox and approvals
Codex security controls come from two layers that work together:
- Sandbox mode: What Codex can do technically (for example, where it can write and whether it can reach the network) when it executes model-generated commands.
- Approval policy: When Codex must ask you before it executes an action (for example, leaving the sandbox, using the network, or running commands outside a trusted set).
Codex uses different sandbox modes depending on where you run it: