Running Codex safely at OpenAI

OpenAI just published a look under the hood at how it lets its own engineers use Codex day to day, and the short version is: carefully. The company isn't just eating its own dog food here, it's building a whole fence around the bowl first — sandboxing, approval gates, network restrictions, and logging built specifically for how autonomous coding agents behave, not how a human dev behaves.

The sandboxing piece is the backbone. Codex gets to touch code and run commands inside an isolated environment, so a bad suggestion or a weird hallucinated shell command can't just reach out and mess with production systems or internal tools. On top of that sits an approval layer: certain actions, especially anything touching sensitive systems or wider network access, need a human to sign off before Codex can proceed. It's the digital equivalent of giving an intern a laptop that only connects to the practice server.

Network policy is where things get more granular. Rather than a blanket allow-or-block switch, OpenAI describes tuning what Codex can actually reach on the internet or internal infrastructure, limiting the blast radius if something goes sideways. That matters more for agents than for old-school static tools, because an agent can chain actions together in ways a linter or a script never could — one bad call can cascade into ten.

The telemetry angle is arguably the most interesting bit, because it's not just bolting old monitoring tools onto a new product. OpenAI says it built logging and observability that's