What version of Codex is running?
codex-cli 0.92.0
What subscription do you have?
Business
Which model were you using?
gpt-5.2-codex
What platform is your computer?
Microsoft Windows NT 10.0.26200.0 x64
What terminal emulator and version are you using (if applicable)?
WezTerm (version 20240203-110809-5046fc22) running PowerShell-7.5.4
What issue are you seeing?
Here is an example from ~\.codex\.sandbox\sandbox.log - it seems like every occurrence follows this same pattern, terminating with CreateProcessAsUserW failed: 5 (even including some extremely similar errors from 1-2 weeks ago)
[2026-01-28 23:52:44.536 codex.exe] START: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
Get-ChildItem -Force
[2026-01-28 23:52:44.542 codex.exe] sandbox setup required: sandbox setup marker missing or incompatible
[2026-01-28T13:52:50.266862700+00:00] ensuring sandbox users offline=CodexSandboxOffline online=CodexSandboxOnline
[2026-01-28T13:52:50.679248100+00:00] firewall rule configured name=codex_sandbox_offline_block_outbound protocol=256 LocalUserAuthorizedList=O:LSD:(A;;CC;;;S-1-5-21-xxxxx)
[2026-01-28T13:52:50.690563400+00:00] granting write ACE to D:\repo\subdir for sandbox group and capability SID
[2026-01-28T13:52:50.719824400+00:00] read-acl-only mode: applying read ACLs
[2026-01-28T13:52:50.721659100+00:00] read ACL run completed
[2026-01-28 23:52:50.962 codex-windows-sandbox-setup.exe] setup binary completed
[2026-01-28 23:52:50.975 codex.exe] setup refresh: spawning X:\scoop\persist\nodejs\bin\node_modules\@openai\codex\vendor\x86_64-pc-windows-msvc\codex\codex-windows-sandbox-setup.exe (cwd=D:\repo\subdir, payload_len=668)
[2026-01-28T13:52:51.005385400+00:00] setup refresh: processed 3 write roots (read roots delegated); errors=[]
[2026-01-28 23:52:51.005 codex-windows-sandbox-setup.exe] setup binary completed
[2026-01-28T13:52:51.029863800+00:00] read-acl-only mode: applying read ACLs
[2026-01-28T13:52:51.032045+00:00] read ACL run completed
[2026-01-28 23:52:51.615 codex-command-runner.exe] runner start cwd=D:\repo\subdir cmd=["C:\\Program Files\\WindowsApps\\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\\pwsh.exe", "-Command", "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;\nGet-ChildItem -Force"] real_codex_home=C:\Users\username\.codex
[2026-01-28 23:52:51.618 codex-command-runner.exe] runner: effective cwd=D:\repo\subdir (requested D:\repo\subdir)
[2026-01-28 23:52:51.628 codex-command-runner.exe] runner: spawn failed: CreateProcessAsUserW failed: 5
[2026-01-28 23:52:51.633 codex.exe] FAILURE: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
Get-ChildItem -Force (exit code 1)
[2026-01-28 23:52:55.612 codex.exe] START: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
Get-Location
[2026-01-28 23:52:55.623 codex.exe] setup refresh: spawning X:\scoop\persist\nodejs\bin\node_modules\@openai\codex\vendor\x86_64-pc-windows-msvc\codex\codex-windows-sandbox-setup.exe (cwd=D:\repo\subdir, payload_len=668)
[2026-01-28T13:52:55.651159600+00:00] setup refresh: processed 3 write roots (read roots delegated); errors=[]
[2026-01-28 23:52:55.651 codex-windows-sandbox-setup.exe] setup binary completed
[2026-01-28T13:52:55.676336500+00:00] read-acl-only mode: applying read ACLs
[2026-01-28T13:52:55.679250100+00:00] read ACL run completed
[2026-01-28 23:52:55.734 codex-command-runner.exe] runner start cwd=D:\repo\subdir cmd=["C:\\Program Files\\WindowsApps\\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\\pwsh.exe", "-Command", "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;\nGet-Location"] real_codex_home=C:\Users\username\.codex
[2026-01-28 23:52:55.736 codex-command-runner.exe] runner: effective cwd=D:\repo\subdir (requested D:\repo\subdir)
[2026-01-28 23:52:55.745 codex-command-runner.exe] runner: spawn failed: CreateProcessAsUserW failed: 5
[2026-01-28 23:52:55.749 codex.exe] FAILURE: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
Get-Location (exit code 1)
[2026-01-28 23:53:00.397 codex.exe] START: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
Get-Location
[2026-01-28 23:53:00.407 codex.exe] setup refresh: spawning X:\scoop\persist\nodejs\bin\node_modules\@openai\codex\vendor\x86_64-pc-windows-msvc\codex\codex-windows-sandbox-setup.exe (cwd=D:\repo\subdir, payload_len=668)
[2026-01-28T13:53:00.434565+00:00] setup refresh: processed 3 write roots (read roots delegated); errors=[]
[2026-01-28 23:53:00.434 codex-windows-sandbox-setup.exe] setup binary completed
[2026-01-28T13:53:00.460019700+00:00] read-acl-only mode: applying read ACLs
[2026-01-28T13:53:00.462272800+00:00] read ACL run completed
[2026-01-28 23:53:00.514 codex-command-runner.exe] runner start cwd=D:\repo\subdir cmd=["C:\\Program Files\\WindowsApps\\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\\pwsh.exe", "-Command", "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;\nGet-Location"] real_codex_home=C:\Users\username\.codex
[2026-01-28 23:53:00.516 codex-command-runner.exe] runner: effective cwd=D:\repo\subdir (requested D:\repo\subdir)
[2026-01-28 23:53:00.526 codex-command-runner.exe] runner: spawn failed: CreateProcessAsUserW failed: 5
[2026-01-28 23:53:00.530 codex.exe] FAILURE: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
Get-Location (exit code 1)
[2026-01-28 23:53:05.709 codex.exe] START: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
pwd
[2026-01-28 23:53:05.719 codex.exe] setup refresh: spawning X:\scoop\persist\nodejs\bin\node_modules\@openai\codex\vendor\x86_64-pc-windows-msvc\codex\codex-windows-sandbox-setup.exe (cwd=D:\repo\subdir, payload_len=668)
[2026-01-28T13:53:05.753275800+00:00] setup refresh: processed 3 write roots (read roots delegated); errors=[]
[2026-01-28 23:53:05.753 codex-windows-sandbox-setup.exe] setup binary completed
[2026-01-28T13:53:05.777629900+00:00] read-acl-only mode: applying read ACLs
[2026-01-28T13:53:05.779460600+00:00] read ACL run completed
[2026-01-28 23:53:05.825 codex-command-runner.exe] runner start cwd=D:\repo\subdir cmd=["C:\\Program Files\\WindowsApps\\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\\pwsh.exe", "-Command", "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;\npwd"] real_codex_home=C:\Users\username\.codex
[2026-01-28 23:53:05.827 codex-command-runner.exe] runner: effective cwd=D:\repo\subdir (requested D:\repo\subdir)
[2026-01-28 23:53:05.836 codex-command-runner.exe] runner: spawn failed: CreateProcessAsUserW failed: 5
[2026-01-28 23:53:05.840 codex.exe] FAILURE: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
pwd (exit code 1)
[2026-01-28 23:53:10.704 codex.exe] START: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
cmd /c dir
[2026-01-28 23:53:10.714 codex.exe] setup refresh: spawning X:\scoop\persist\nodejs\bin\node_modules\@openai\codex\vendor\x86_64-pc-windows-msvc\codex\codex-windows-sandbox-setup.exe (cwd=D:\repo\subdir, payload_len=668)
[2026-01-28T13:53:10.741790300+00:00] setup refresh: processed 3 write roots (read roots delegated); errors=[]
[2026-01-28 23:53:10.741 codex-windows-sandbox-setup.exe] setup binary completed
[2026-01-28T13:53:10.767054+00:00] read-acl-only mode: applying read ACLs
[2026-01-28T13:53:10.769115900+00:00] read ACL run completed
[2026-01-28 23:53:10.819 codex-command-runner.exe] runner start cwd=D:\repo\subdir cmd=["C:\\Program Files\\WindowsApps\\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\\pwsh.exe", "-Command", "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;\ncmd /c dir"] real_codex_home=C:\Users\username\.codex
[2026-01-28 23:53:10.821 codex-command-runner.exe] runner: effective cwd=D:\repo\subdir (requested D:\repo\subdir)
[2026-01-28 23:53:10.832 codex-command-runner.exe] runner: spawn failed: CreateProcessAsUserW failed: 5
[2026-01-28 23:53:10.837 codex.exe] FAILURE: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
cmd /c dir (exit code 1)
What steps can reproduce the bug?
See uploaded thread: 019c04d8-9c59-7222-
I believe I first encountered this error immediately after updating to the version where the elevated_windows_sandbox feature was shipped 1-2 weeks ago. Since then, I have noticed it occur in/with multiple different:
- repos/locations
- models
- sandbox/approval settings
- various other
config.toml keys/values
The only thing that has consistently worked as a temporary fix has been disabling the elevated_windows_sandbox feature using command line flag/config.toml, and relying on the previous experimental_windows_sandbox feature instead.
What is the expected behavior?
Commands executed by the agent should follow whatever sandbox/policy settings are configured, i.e. read-only commands within the workspace should proceed without first requiring explicit approval and/or failing with (no output).
Additional information
I thought I would mention that, when I was doing some testing to try to find the root cause, I had this interaction with the model - and I am almost certain that I remember something very similar occurring a week or two ago, when I was troubleshooting the exact same sandbox issues:
╭───────────────────────────────────────────────────╮
│ >_ OpenAI Codex (v0.92.0) │
│ │
│ model: gpt-5.2-codex xhigh /model to change │
│ directory: D:\repo\subdir │
╰───────────────────────────────────────────────────╯
› try running a simple cmd like get-childitem
• *Preparing to run shell command*
$ Get-ChildItem -Force
✗ (1) • 655ms
• *Preparing to rerun with escalated privileges*
$ Get-ChildItem -Force
Directory: D:\repo\subdir
Mode LastWriteTime Length Name
---- ------------- ------ ----
d---- 28/01/2026 5:19 AM .ruff_cache
...
...
✓ • 1.21s
─ Worked for 16s ───────────────────────────────────────────────────────────────────────
• Ran Get-ChildItem -Force successfully. I can proceed with whatever you want next.
› why did the first attempt fail
• *The sandbox required escalation and produced no output with exit code 1, indicating a likely failure or blocked
execution to address next.*
• The first run was blocked by sandbox permissions. It needed escalated access to list the workspace, so it exited with
code 1 and no output. I re-ran it with escalated permissions and it succeeded.
Very much makes me wonder if perhaps the issue is with the model itself, or at least how it interacts with the harness/sandbox.... Though, judging by the system prompt's description of the on-request option for approval_policy, maybe there actually is an issue with the sandbox, as it doesn't sound like simple read-only commands, e.g. gci, should require escalation ? specifically wrt to below (apologies if I am looking at some unrelated piece of the framework lol):
... Here are scenarios where you'll need to request approval:\r\n- You need to run a command that writes to a directory that requires it (e.g. running tests that write to /var)\r\n- You need to run a GUI app (e.g., open/xdg-open/osascript) to open browsers or files.\r\n- You are running sandboxed and need to run a command that requires network access (e.g. installing packages)\r\n- If you run a command that is important to solving the user's query, but it fails because of sandboxing, rerun the command with approval. ALWAYS proceed to use the `sandbox_permissions` and `justification` parameters - do not message the user before requesting approval for the command.\r\n- You are about to take a potentially destructive action such as an `rm` or `git reset` that the user did not explicitly ask for. ...
What version of Codex is running?
codex-cli 0.92.0
What subscription do you have?
Business
Which model were you using?
gpt-5.2-codex
What platform is your computer?
Microsoft Windows NT 10.0.26200.0 x64
What terminal emulator and version are you using (if applicable)?
WezTerm (version
20240203-110809-5046fc22) running PowerShell-7.5.4What issue are you seeing?
Here is an example from
~\.codex\.sandbox\sandbox.log- it seems like every occurrence follows this same pattern, terminating withCreateProcessAsUserW failed: 5(even including some extremely similar errors from 1-2 weeks ago)What steps can reproduce the bug?
See uploaded thread: 019c04d8-9c59-7222-
I believe I first encountered this error immediately after updating to the version where the
elevated_windows_sandboxfeature was shipped 1-2 weeks ago. Since then, I have noticed it occur in/with multiple different:config.tomlkeys/valuesThe only thing that has consistently worked as a temporary fix has been disabling the
elevated_windows_sandboxfeature using command line flag/config.toml, and relying on the previousexperimental_windows_sandboxfeature instead.What is the expected behavior?
Commands executed by the agent should follow whatever sandbox/policy settings are configured, i.e. read-only commands within the workspace should proceed without first requiring explicit approval and/or failing with
(no output).Additional information
I thought I would mention that, when I was doing some testing to try to find the root cause, I had this interaction with the model - and I am almost certain that I remember something very similar occurring a week or two ago, when I was troubleshooting the exact same sandbox issues:
Very much makes me wonder if perhaps the issue is with the model itself, or at least how it interacts with the harness/sandbox.... Though, judging by the system prompt's description of the
on-requestoption forapproval_policy, maybe there actually is an issue with the sandbox, as it doesn't sound like simple read-only commands, e.g.gci, should require escalation ? specifically wrt to below (apologies if I am looking at some unrelated piece of the framework lol):