No sandbox
sandbox_mode = "danger-full-access", in config.toml or a profile file, or default_permissions = ":danger-full-access".
AI coding agents · Codex CLI
What Codex CLI can do without asking, and how to lock it down
Two settings decide it: the sandbox says what a command can touch, the approval policy says when Codex stops to ask. Both changed this year: --full-auto is gone and profiles are separate files now.
~/.codex/config.toml −risky+fixed−approval_policy = "never"−sandbox_mode = "danger-full-access"+approval_policy = "on-request"+sandbox_mode = "workspace-write"
Where Codex keeps its settings
~/.codex on every OS; CODEX_HOME moves it. A project's files load only once you trust the project.
| Scope | File | What's in it |
|---|---|---|
| You | ~/.codex/config.toml | approval_policy, sandbox_mode, MCP servers, notify, the trusted projects. |
| Profiles | ~/.codex/<name>.config.toml | A layer picked with --profile. [profiles.x] tables inside config.toml are ignored now. |
| This project | .codex/config.toml | Project overrides, trusted projects only. |
| Command rules | ~/.codex/rules/*.rules | "Always allow" answers: those commands run outside the sandbox. |
| Instructions | ~/.codex/AGENTS.mdAGENTS.md | Text added to every session. |
| Admin | /etc/codex/requirements.toml | Limits you can't override. |
What it may do without asking
approval_policy and sandbox_mode in config.toml, or -a and -s on the command line.
| Setting | What it does |
|---|---|
sandbox_mode = "read-only" | Reads files and runs read-only commands. |
sandbox_mode = "workspace-write" | Reads, edits and runs commands in the project; no network unless you turn it on. |
sandbox_mode = "danger-full-access" | No sandbox: commands can read and change everything you can. |
approval_policy = "on-request" | The model decides when to ask; what the sandbox allows runs. |
approval_policy = "never" | Never asks. The sandbox still applies. |
--yolo | Alias for --dangerously-bypass-approvals-and-sandbox: no approvals, no sandbox, live web search. |
Six things to check
Never asks
approval_policy = "never". Together with no sandbox, nobody approves anything.
A bypass flag in an alias
codex --dangerously-bypass-approvals-and-sandbox or codex --yolo in a shell alias, script, hook or MCP command.
Keys in config.toml
A token in an MCP server's env, http_headers, args or URL. Use bearer_token_env_var or env_vars instead.
Requests sent elsewhere
notify runs a program after every turn; openai_base_url sends every request to another server.
Old answers that skip the sandbox
prefix_rule(..., decision = "allow") in ~/.codex/rules/default.rules, written when you chose "always allow".
Lock it down
In ~/.codex/config.toml. Then delete any [profiles.*] tables and any approval_policy = "untrusted": it's retired and can stop Codex from starting.
approval_policy = "on-request" approvals_reviewer = "user" sandbox_mode = "workspace-write" web_search = "cached" [sandbox_workspace_write] network_access = false [shell_environment_policy] ignore_default_excludes = false
Codex asks before going outside the project or onto the network, you answer the prompts yourself, and commands don't get your *KEY*, *SECRET* or *TOKEN* variables.
Or check all of it at once
For Codex, NeuroShield reads config.toml and profile files (following CODEX_HOME), each project's .codex/config.toml, skills and shell aliases: no sandbox, never asking, bypass flags, keys in MCP servers, and requests sent elsewhere.
Read only
It reads settings files and never runs your agents, their MCP servers or their scripts.
Nothing leaves this computer
The check runs locally. No account, no upload, no AI inside: fixed, published rules.
Nothing changes without your OK
Where a safe fix exists, Fix It for Me makes it after you confirm, with a backup and Undo.
Questions
What does codex --yolo do?
It's an alias for --dangerously-bypass-approvals-and-sandbox: no approvals, no sandbox, live web search. The docs say to use it only inside an externally hardened environment.
Is --full-auto still a thing?
No, it was removed. Use --sandbox workspace-write, or --approve-for-me to hand prompts to a reviewer agent.
Where is the Codex config file?
~/.codex/config.toml (Windows: C:\Users\<you>\.codex\config.toml). CODEX_HOME moves it.
See your own agents
The check is free: how many agents you have and what they can do. Details and fixes come with Shields.