Codex on Windows adopts Microsoft's MXC sandbox: no admin setup and per-path file controls, but loopback stays open and commands run as the user

Why it matters

【Key points】

On Oct 9, OpenAI's developer account announced a Codex sandbox mode for Windows built on Microsoft Execution Containers (MXC), which Microsoft made generally available on Oct 8 (e/706). It needs a compatible Windows 11 device.

Per OpenAI's docs, MXC is now the recommended of three Windows sandboxes. Unlike the legacy elevated mode, it needs no admin-approved setup, sandbox accounts, permission changes or firewall rules: commands run as the user, under a per-command policy for readable, writable and denied paths and network access. It ships in Codex CLI 0.162.0 (off by default via prefer_mxc) and is rolling out in the desktop app; admins can enforce it or block it with allow_mxc = false.

【Verifiable】

OpenAI Developers post: https://x.com/OpenAIDevs/status/2108573188703781190

Windows sandbox docs: https://learn.chatgpt.com/docs/windows/windows-sandbox

Documented limits: MXC allows connections to host loopback services and drops the proxy's private-network checks; leftover child processes are killed when the foreground command exits; explicitly selecting mxc on an unsupported device fails instead of falling back.

【Our read】

1. Isolation for local coding agents is moving into the operating system. Needing admin sign-off often stalled Codex in enterprise IT; native isolation lowers that barrier and touches the host far less.

2. The boundary moves too. Running as the user and allowing loopback are trade-offs for compatibility. "Sandboxed" does not mean "can't reach local services"; security teams should recheck the defaults.

3. Watch when MXC becomes the default, and whether other coding agents adopt the same OS-level sandbox. If they do, MXC could become a common permission layer for agents on Windows.