When Codex for Windows launched, users faced a lousy choice: approve every command manually, which defeats the whole point of an AI coding agent, or give it full access and hope for the best. Neither option was great. The problem is that Windows lacks the built-in isolation tools that macOS and Linux offer, like Seatbelt or seccomp. So the Codex team had to get creative. They explored Windows-native options like AppContainer, Windows Sandbox, and Mandatory Integrity Control, but none fit the bill. Codex isn’t a simple app with fixed permissions—it’s a dynamic agent that reads and writes files, runs commands, and sometimes needs internet access, all based on user conversations with the model. The team ultimately built a custom sandbox from scratch to enforce file read/write limits and network restrictions without compromising the agent’s flexibility. Why it matters: This isn’t just a Windows update—it’s a glimpse into the future of AI safety engineering, where agents need operating system-level guardrails that OS vendors haven’t built yet.