Codex’s sandbox problem is mostly a Windows problem

The repo’s own labels show it. Between 21 April and 20 May, 172 new openai/codex issues carried the sandbox label (`repo:openai/codex is:issue label:sandbox created:2026-04-21..2026-05-20`). Of those, 61 were also labeled windows-os (`repo:openai/codex is:issue label:sandbox label:windows-os created:2026-04-21..2026-05-20`). Between 18 September and 17 October, the same two searches with `created:2026-09-18..2026-10-17` return 894 and 621. All new issues in those same two windows went from 3,096 to 7,049 (`repo:openai/codex is:issue created:<window>`). So total volume a bit more than doubled, while Windows sandbox reports grew about tenfold.

The issues are piling up. Only 55 of those 621 are closed (`repo:openai/codex is:issue label:sandbox label:windows-os created:2026-09-18..2026-10-17 is:closed`). As of 21 October, 1,322 Windows sandbox issues are open (`repo:openai/codex is:issue label:sandbox label:windows-os is:open`), out of 2,151 open sandbox issues in total (`repo:openai/codex is:issue label:sandbox is:open`).

A second, separate measure points the same way. Counted by calendar quarter, the share of all new Codex issues with “windows” in the title rose from 51 of 1,987 (2.6%) in Q4 2025 to 254 of 3,834 (6.6%) in Q1 2026, 1,380 of 8,991 (15.3%) in Q2 and 3,343 of 14,549 (23.0%) in Q3. The searches are `repo:openai/codex is:issue windows in:title created:<quarter>` and `repo:openai/codex is:issue created:<quarter>`, for example `created:2026-07-01..2026-09-30` for Q3. A title search can catch false hits like “context windows”. In a sample of 80 Windows-titled issues, 20 per quarter, none were false hits. A wider scan of 651 titles turned up one (#14447). That check covers these title counts only, not the label counts above. Over the same quarters, the Windows-titled share in Cline went from 2.9% to 5.5%, and Gemini CLI showed no rise.

We haven’t checked the cause. Better labeling or more Windows users could explain part of the rise.

The reports cover different failures, not one bug. Sandbox setup fails with a sharing violation (#52354). A scoped read grant doesn’t reach workspace dependency files (#50409). `network_access=false` under workspace-write doesn’t reliably block the network (#46662). The sandbox leaks kernel access tokens with every sandboxed command (#54400).

If you run Codex on Windows, the sandbox mode you pick is the part most likely to misbehave, and it misbehaves both ways. Some reports describe commands being blocked that should run. Others describe restrictions that don’t hold. So treat workspace-write on Windows as a convenience, not a boundary. Before you rely on a denial, check that the action really is denied. If you need the guarantee, put WSL or a container in front of it.

The durable lesson: an agent’s sandbox is only as mature as the OS layer underneath it, and the issue tracker tells you which platform is behind.