OpenAI adds a Codex sandbox on Windows built on Microsoft Execution Containers
An update for builders using Codex on Windows: We’ve built a new sandbox mode using @Microsoft’s Execution Containers (MXC) for faster setup, stronger network enforcement, and granular file access controls. Requires a compatible Windows 11 device.
Context
Agents that run commands on a developer's own machine need firm limits on files and network access, and OpenAI says Microsoft's new native isolation lets Codex enforce those limits on Windows with less setup.
Codex runs commands in a sandbox so it cannot write outside the working folder or reach the network without the user's approval, according to OpenAI's docs. OpenAI has written that Windows, unlike macOS and Linux, did not offer a ready made isolation tool, so it built its own sandbox modes using separate low privilege users, permission boundaries and firewall rules. Microsoft Execution Containers, or MXC, add native process isolation to recent Windows 11 builds.
Deep dive
OpenAI Developers said on October 9 that it has built a new Codex sandbox mode on Windows using Microsoft's Execution Containers, promising faster setup, stronger network enforcement and granular file access controls. The post says it requires a compatible Windows 11 device.
According to OpenAI's Windows sandbox docs, Codex now supports three Windows sandbox modes. The new mxc mode is recommended on compatible devices and uses native process isolation without administrator approved setup, extra Windows accounts or local firewall rules. The older elevated mode, which needs administrator approved setup, becomes the preferred fallback, and the unelevated mode remains a weaker last resort that the docs say has weaker network isolation.
The docs say the Codex desktop app automatically prefers MXC for consumer accounts when the device supports it, while enterprise deployments and standalone CLI users can turn on the same behavior with a prefer_mxc setting. If MXC is unavailable or blocked by policy, Codex falls back to its existing setup flow. Administrators can also block MXC through policy.
According to the same docs, Microsoft introduced MXC process isolation in Windows 11 24H2 build 26100.9278 and 25H2 build 26200.9278, and is still rolling the capability out to Windows 11 devices. OpenAI's docs include a command to check whether a device supports it.
What to expect next
Watch how quickly Microsoft rolls MXC out across Windows 11 devices, since Codex only uses the new mode where it is available.
Also watch whether other coding agents adopt MXC for their own Windows sandboxes, and whether Microsoft publishes its own documentation and security details for the feature. Enterprise teams will likely want to see how MXC interacts with their existing device policies before turning it on widely.