OpenAI · Coding agent
OpenAI Codex
OpenAI's coding agent, available as a CLI, IDE extension and cloud environment — with sandboxing and approval modes as its primary native controls.
What you are actually governing
Codex approaches agent safety from the sandbox rather than from the permission prompt. Execution is designed to run inside a restricted environment by default, with configurable approval modes governing how much autonomy the agent has and when it must stop and ask. That is a defensible architecture — it assumes the model will sometimes be wrong and bounds the consequences.
Instruction files are the artifact class to govern. Codex reads `AGENTS.md`, a convention that has spread across multiple agent tools precisely because a vendor-neutral name was useful. The consequence for a security team is that one file in a repository now steers several different agents, and a change to it propagates to all of them without anything resembling a deployment.
MCP support means the connector surface is shared with every other agent in the company. This is the point that gets missed in per-tool reviews: an MCP server evaluated for one agent is, in practice, reachable from whichever others get pointed at the same configuration. The server is the unit of risk, not the tool that connects to it.
The sandbox is real protection and the strongest thing here, with one predictable failure mode: it gets loosened. Approval modes exist on a spectrum from ask-before-everything to full autonomy, and the pressure is always toward the permissive end because that is where the agent feels productive. Whether the fleet is actually running with the approval policy the security team believes it is running is not a question the local configuration answers.
Artifact classes this surface loads
Each of these changes what the agent does, and each arrives through a channel with no dependency review. This is the inventory a governance programme has to cover — not a feature list.
- AGENTS.md instruction files
- MCP servers
- Configuration profiles
- Approval policies
What OpenAI genuinely controls
Documented controls worth configuring fully before buying anything. Every one is cited to OpenAI's own documentation below.
- Sandboxed execution by default
Commands run in a restricted environment with constrained filesystem and network access rather than directly on the host.
- Approval modes
Configurable autonomy levels determine when the agent must stop and request confirmation, from per-action approval upward.
- Configuration profiles
Named configurations let different projects run under different, deliberately chosen policies.
- AGENTS.md instructions
Repository-scoped instruction files, committed to version control and therefore reviewable through pull request.
What is still open once those are configured
Not criticism of the product — the honest boundary of a per-machine configuration model. These are fleet questions, and local settings were never designed to answer them.
- Approval policy drift
Autonomy is locally configurable, so nothing centrally establishes that machines are running the intended approval mode.
- No instruction-file vetting
AGENTS.md is reviewed only as well as your pull request process reviews prose. Most review processes do not read it at all.
- Shared MCP risk, separate governance
Connectors are the same servers other agents use, but each tool governs them independently and none has the full picture.
- No cross-surface attribution
Session cost and artifact-version attribution live in the vendor's tooling, separate from every other AI surface's, so there is no single answer to what an incident touched.
Frequently asked
- Is AGENTS.md the same thing as CLAUDE.md?
- Functionally yes — both are repository instruction files loaded automatically to steer an agent. AGENTS.md emerged as a cross-tool convention, which makes it higher-leverage and higher-risk: one file influences several different agents at once.
- Does Codex sandboxing make artifact vetting unnecessary?
- No. Sandboxing bounds what a misled session achieves on the machine. It does not prevent an unreviewed instruction file or MCP server from steering the agent, and it does not give you an inventory of either.
Sources
Compiled from OpenAI's own documentation on 2026-07-25. Products in this category change quickly — verify against the source before a decision depends on a specific mechanism.