> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/by-ai-vendor/openai/chatgpt-codex.md).

# ChatGPT Codex

Security guidance for ChatGPT Codex across desktop, CLI, IDE, cloud, SDK, and automation workflows, including sandboxing, hooks, OpenTelemetry, approvals, network access, and evidence.

{% hint style="warning" %}
**In short:** ChatGPT Codex is OpenAI's coding agent across the command line, IDE extension, ChatGPT Desktop, Codex web and cloud tasks, the Codex SDK, noninteractive automation, and supported remote clients. The product can look similar across these surfaces while executing with very different filesystem, credential, network, and audit boundaries.
{% endhint %}

## What to focus on first

<table data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-diagram-project" style="color:$primary;">:diagram-project:</i></h3></td><td><strong>Separate each execution surface</strong></td><td>The same Codex label can mean local shell access, a remote host, a cloud container, a desktop task, or CI automation. Each surface needs its own owner and approval path.</td><td><a href="/handbook/3.-runtime-sandbox-and-autonomy/3.9-central-hosted-agent-runtime-hardening.md">3.9 Central hosted-agent runtime hardening</a></td></tr><tr><td><h3><i class="fa-box" style="color:$primary;">:box:</i></h3></td><td><strong>Make the sandbox explicit</strong></td><td>Codex can inspect files, run commands, install dependencies, open browsers, and write code. Keep defaults least-privilege and test what each profile really contains.</td><td><a href="/handbook/3.-runtime-sandbox-and-autonomy/3.1-what-even-is-an-ai-sandbox.md">3.1 What Even is an AI Sandbox?</a></td></tr><tr><td><h3><i class="fa-code-branch" style="color:$primary;">:code-branch:</i></h3></td><td><strong>Govern hooks and repo instructions</strong></td><td>Hooks, setup scripts, AGENTS.md files, MCP config, tests, and command output can change what the agent sees and does. Review them before broad rollout.</td><td><a href="/handbook/2.-supply-chain-and-extensibility/2.6-ai-hooks-inference-controls-and-lifecycle-automation.md">2.6 AI hooks: inference controls and lifecycle automation</a></td></tr><tr><td><h3><i class="fa-plug" style="color:$primary;">:plug:</i></h3></td><td><strong>Constrain MCP, plugins, and network</strong></td><td>Tool access can turn a coding assistant into an actor across SaaS, secrets, browsers, CI, and internal services. Allowlist by need, identity, and destination.</td><td><a href="/handbook/2.-supply-chain-and-extensibility/2.3-mcp-gateways-and-allowlisting.md">2.3 MCP gateways and allowlisting</a></td></tr><tr><td><h3><i class="fa-route" style="color:$primary;">:route:</i></h3></td><td><strong>Collect runtime evidence early</strong></td><td>Codex evidence varies by local versus cloud execution and by ChatGPT versus API authentication. Route OpenTelemetry and correlate it with Git, endpoint, CI, proxy, and cloud logs.</td><td><a href="/handbook/6.-observability-audit-and-evidence/6.2-opentelemetry-for-ai-runtime-visibility.md">6.2 OpenTelemetry for AI runtime visibility</a></td></tr><tr><td><h3><i class="fa-check-double" style="color:$primary;">:check-double:</i></h3></td><td><strong>Keep human review in the path</strong></td><td>Noninteractive jobs, scheduled tasks, and cloud agents can continue after the user leaves. Require review before merge, deploy, deletion, secret changes, or policy changes.</td><td><a href="/handbook/1.-identity-and-access/1.7-human-in-the-loop-and-approval-policies.md">1.7 Human-in-the-loop and approval policies</a></td></tr></tbody></table>

## What is ChatGPT Codex?

Codex can inspect and modify repositories, run commands and tests, review diffs, use Git, create pull requests, operate browsers and development tools, and call plugins or MCP servers.

Codex Local and Codex Cloud are separate administrative capabilities in managed ChatGPT workspaces. Security teams should decide which user groups may use each one and then configure each execution surface.

## Surfaces and their security considerations

| Surface                                                    | Where work runs                                                                                           | Main security considerations                                                                                                                                                                                         |
| ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Codex CLI**                                              | On the user's workstation, development server, or shell host.                                             | Inherits the operating-system user's files, environment variables, credentials, tools, and network reach, subject to the Codex permission profile and approval policy.                                               |
| **Codex IDE extension**                                    | In the local or remote VS Code extension host. Other IDEs can run the CLI in their terminal.              | IDE workspace trust, extension deployment, remote-development hosts, open files, integrated terminals, and repository instructions are part of the boundary.                                                         |
| **ChatGPT Desktop, Codex section**                         | Local machine, supported remote or SSH environment, or an OpenAI cloud environment selected for the task. | Treat local, remote-host, and cloud sessions separately. Desktop can add parallel agents, worktrees, visual diff review, previews, browser tools, Computer Use, Remote Control, plugins, skills, and scheduled work. |
| **Codex web and delegated cloud tasks**                    | An isolated OpenAI-managed container linked to an approved repository and environment.                    | Scope GitHub access, environment membership, setup scripts, secrets, and network policy. Setup runs may have network access before the agent phase.                                                                  |
| **Codex SDK and app server**                               | In an application or service environment chosen by the developer.                                         | The application owner controls the host, identity, sandbox, approvals, persistence, and exposed tools. Use read-only or workspace-scoped sandboxes by default.                                                       |
| **codex exec, CI, and other automation**                   | In a local process, CI runner, scheduled job, or another automation host.                                 | Noninteractive execution can remove the human approval step. Use disposable runners, service identities, deterministic policy, and review before merge or deploy.                                                    |
| **Mobile Remote and other remote clients**                 | The task continues on the paired desktop, another Codex host, or in Codex cloud.                          | A phone is a control surface, not the execution boundary. Require workspace permission, device controls, pairing review, and rapid revocation.                                                                       |
| **GitHub, Slack, code review, and scheduled integrations** | Usually in OpenAI cloud or the configured workflow environment.                                           | Scope repository and workspace grants, limit automated triggers, separate service identities, constrain network and tools, and require branch protection.                                                            |

## Core security model

Local Codex uses two complementary control layers:

* **Permission profiles** define filesystem and network access.
* **Approvals and command rules** decide whether an action runs, is denied, or requires review.
* **Managed requirements** constrain which profiles, MCP servers, plugins, and related settings users may select.
* **Repository instructions and tools** can influence agent behavior through AGENTS.md files, skills, hooks, MCP configuration, build scripts, tests, and command output.

The built-in local profiles include read-only, workspace, and danger-full-access. Full access removes normal local sandbox restrictions and should not be available in a routine enterprise deployment.

## How to configure Codex securely

### Workspace access

* Use ChatGPT workspace roles and groups to scope Codex access.
* Configure **Codex Local** and **Codex Cloud** separately.
* Require approved ChatGPT workspace authentication on managed endpoints where supported.
* Prevent personal API-key use when it falls outside policy.
* Treat ChatGPT workspace administration and API Platform organization administration as separate control planes.
* Use distinct service identities for CI, scheduled automation, code review, and other unattended work.

### CLI and IDE

Use managed **requirements.toml** through the supported cloud assignment, system policy, MDM, or equivalent management path.

* Allow only reviewed permission profiles and set a least-privilege default.
* Omit **danger-full-access** so users cannot select it.
* Deny reads from environment files, keychains, cloud credentials, SSH material, browser profiles, production configuration, and unrelated directories.
* Restrict writes to approved repositories and output folders.
* Keep network off by default or allow only task-required domains.
* Use command rules to block or prompt for dangerous shell tools and entry points.
* Allowlist MCP servers by both name and identity.
* Restrict plugin sources, hooks, web-search behavior, and feature flags.
* Test mixed client versions before relying on a newly introduced managed control.
* Apply the policy to remote IDE extension hosts, not only the user's laptop.

### ChatGPT Desktop Codex sessions

* Confirm that Desktop receives the same Codex Local requirements as the CLI and IDE.
* Treat local, SSH or remote-host, and cloud sessions as different policy targets.
* Review workspace roots before a session starts.
* Use isolated worktrees for parallel agents and still require human diff review.
* Keep Computer Use, browser access, full Chrome DevTools access, and Remote Control off unless there is an approved need.
* Review plugins, skills, MCP servers, Appshots, local memories, and scheduled work as separate sources of context or authority.
* Restrict which devices may be discovered and controlled remotely.
* Apply the shared desktop controls described in **ChatGPT Work**.

### Codex cloud

* Grant repository access only to required organizations and repositories.
* Create separate environments for different repository or data trust levels.
* Review setup and maintenance scripts as code. Pin dependencies and avoid unverified installers.
* Store secrets in the supported secret field instead of ordinary environment variables where possible.
* Remember that environment variables may be available throughout the task and that environment caches may be visible to other users who can access the same environment.
* Leave agent internet access off unless the task needs it. When enabled, use a domain allowlist.
* Account for the fact that outbound traffic passes through OpenAI's HTTP and HTTPS proxy.
* Require branch protection, CI, code review, and deployment gates after Codex produces changes.

### SDK and noninteractive automation

* Start the SDK and app server in read-only or workspace-scoped mode.
* Authenticate callers and map them to narrow task authority.
* Do not allow untrusted prompts to choose sandbox mode, approval policy, workspace roots, MCP servers, or credentials.
* For **codex exec**, keep the default read-only sandbox unless the job must write.
* Use workspace-write only in an isolated repository copy or disposable runner.
* Reserve danger-full-access for a separately isolated environment with no valuable credentials or network reach.
* Fail closed when required MCP servers or policy files are unavailable.
* Set time, spend, concurrency, and output limits.
* Require review before automation can merge, deploy, rotate secrets, alter security policy, or make destructive infrastructure changes.

### Remote and integration surfaces

* Enable Remote Control only for approved roles and managed devices.
* Require the desktop or host to opt into discovery and control.
* Revoke pairings and sessions promptly after device loss or role change.
* Limit Slack and GitHub triggers to approved channels, repositories, actors, and action types.
* Use branch protections and a separate deployment identity after Codex creates or reviews code.

## Monitoring and incident response

* Use workspace and Codex analytics for adoption and product activity.
* Use the Compliance API for supported audit records, and test the current coverage of local clients, cloud tasks, prompts, actions, and content needed by the organization.
* Use local OpenTelemetry only with an approved endpoint, redaction, access, and retention plan.
* Correlate Codex activity with endpoint, source-control, CI, proxy, secret-manager, and cloud audit logs.
* Keep an inventory of local clients, cloud environments, repository grants, plugins, MCP servers, skills, hooks, Remote Control pairings, scheduled tasks, and integrations.
* Be able to revoke ChatGPT sessions, API keys, repository grants, plugin and MCP credentials, remote pairings, and cloud environments.

## Codex security review checklist

* Every approved surface has a named owner and a documented execution location.
* Codex Local and Codex Cloud are separately assigned.
* Managed requirements reach the CLI, IDE, and Desktop clients in use.
* Full access is unavailable and sensitive paths are explicitly denied.
* Local, remote-host, and cloud sessions have been tested separately.
* Cloud setup scripts, environment variables, secrets, caches, and network allowlists are reviewed.
* Noninteractive jobs use service identities and disposable runners.
* Mobile Remote cannot bypass local permissions or the approval policy.
* Audit coverage has been tested for each surface instead of inferred from another one.
* Human review remains required before merge, deployment, destructive changes, or changes to security controls.

## ChatGPT Codex provider documentation

* [Using Codex with your ChatGPT plan](https://help.openai.com/en/articles/11369540-using-codex-with-your-chatgpt-plan)
* [Codex quickstart](https://learn.chatgpt.com/docs/quickstart)
* [Enterprise admin rollout](https://learn.chatgpt.com/docs/enterprise/admin-setup)
* [Agent approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security)
* [Permission profiles](https://learn.chatgpt.com/docs/permissions)
* [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration)
* [Codex cloud environments](https://developers.openai.com/codex/cloud/environments)
* [Codex cloud internet access](https://learn.chatgpt.com/docs/cloud/internet-access)
* [Codex CLI noninteractive mode](https://developers.openai.com/codex/noninteractive)
* [Codex SDK](https://developers.openai.com/codex/sdk)
* [Governance and observability](https://learn.chatgpt.com/docs/enterprise/governance)
* [Compliance API](https://learn.chatgpt.com/docs/enterprise/compliance-api)

## Applicable Harmonic guidance

* [Securing Codex Best Practice](https://www.harmonic.security/resources/securing-codex-best-practice)

*Last reviewed: August 18, 2026*

## Related handbook guidance

* [OpenAI](/by-ai-vendor/openai.md)
* [2.2 MCP servers: securing the protocol](/handbook/2.-supply-chain-and-extensibility/2.2-mcp-servers-securing-the-protocol.md)
* [2.6 AI hooks: inference controls and lifecycle automation](/handbook/2.-supply-chain-and-extensibility/2.6-ai-hooks-inference-controls-and-lifecycle-automation.md)
* [3.1 What Even is an AI Sandbox?](/handbook/3.-runtime-sandbox-and-autonomy/3.1-what-even-is-an-ai-sandbox.md)
* [6.2 OpenTelemetry for AI runtime visibility](/handbook/6.-observability-audit-and-evidence/6.2-opentelemetry-for-ai-runtime-visibility.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://handbook.harmonic.security/by-ai-vendor/openai/chatgpt-codex.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.