An operation can use Codex’s MXC Windows sandbox and still receive network-allow defaults. Superpower Daily’s bounded review of version 0.162.1 finds that selecting MXC does not itself restrict networking. The permission profile and managed-network configuration determine the generated rules—a distinction that matters when evaluating what a sandbox setting actually promises.
The finding concerns source-level behavior, not a demonstrated escape or a tested security boundary. The code distinguishes three network-policy paths: a network-disabled profile, a network-enabled profile without managed networking, and a managed-network invocation. Each produces a different policy.
Our question was configuration-specific: which paths select MXC, generate network restrictions or reject an unavailable backend? We reassessed saved public evidence, preserving the October 9, 2026, cutoff of 20:31:10.299 UTC. The sample covers stable 0.162.1 and prerelease 0.163.0-alpha.4. Detailed selection, launch and network-policy tracing covers the stable version; the prerelease comparison covers selection controls only.
This was a source review, not a new collection or experiment. We did not execute Codex, test packets or establish equivalence between tagged source and distributed binaries. Other operating-system or organizational controls could restrict access despite generated allow defaults. The result is a configuration checklist, not a certification of runtime protection.
The profile supplies the network defaults
The clearest evidence is in the stable version’s policy translator, the code that turns a permission profile into a native MXC request. It checks whether networking is enabled and whether a managed-network context is present. Those inputs—not the backend name alone—set the outgoing and incoming traffic defaults.
Same MXC backend, different generated defaults
Network-disabled profile
Without managed networking, outgoing traffic, incoming traffic and host loopback receive deny defaults. Host loopback means access back to the same machine.
Network-enabled profile
Without managed networking, outgoing traffic, incoming traffic and host loopback receive allow defaults. Both sides describe generated policy for a 0.162.1 MXC invocation.
This is not evidence that MXC has no restrictions. Filesystem permissions are translated separately into writable, read-only and denied paths, including read-only carveouts. The request also disables mutation of discretionary access-control lists, which govern object access. Network-allow defaults therefore describe one dimension of the generated policy, not unrestricted execution.
A preference can leave another backend in place
Before network policy is generated, Codex must select a backend. In 0.162.1, setting windows.sandbox="mxc" selects WindowsMxc, subject to configuration constraints. The elevated and unelevated settings instead select the legacy restricted-token implementation. A resolved MXC preference can override that configured choice for local execution.
The automatic route is conditional. The features.prefer_mxc setting must be enabled, the configuration must permit MXC, and the native backend must be available. If those checks fail, Codex retains the configured backend. Depending on that configuration, the retained choice can be legacy containment or no backend. A preference is not an MXC requirement.
Eligibility also depends on local-binding permissions—the permission for local clients and servers. An effective denial blocks automatic MXC eligibility. Managed network requirements take precedence over feature-level or active-profile binding values. Reading one feature flag in isolation therefore misses the configuration layers that decide whether its preference can take effect.
An operation must still enter the sandbox
The sandbox manager makes another decision before honoring WindowsMxc: whether the operation should be sandboxed at all. Its Forbid preference returns no sandbox. Require requests one. Auto evaluates filesystem, network and managed-network requirements. A configured backend is thus not proof that every operation passes through it. We did not inventory every caller, approval or escalation path.
Once an operation enters the WindowsMxc transformation branch, however, an unavailable native backend produces an error rather than a legacy fallback there. This is distinct from automatic selection retaining another backend earlier. Higher-level retries through another authorization path remain outside our review, so the error cannot establish an application-wide guarantee of rejection.
There is meaningful rejection behavior beyond that availability check. The helper excludes older AppContainer fallback backends from its availability test. Native launch rejects permissiveLearningMode and checks support for native denied paths when the request contains them. Those safeguards counter any reading that this finding describes an unconditional, permissive launch path.
Dedicated proxy ports do not define the loopback boundary
Managed networking introduces requirements that the ordinary network-enabled path does not have. The MXC transformation needs a proxy context local to the executor. Validation requires dedicated proxy ports, rejects port zero and requires allow_local_binding=true. The helper explains the last constraint in terms of native host-loopback access being bidirectional.
The generated native policy denies non-loopback traffic by default. But its outgoing allow rule covers the IPv4 loopback range and IPv6 localhost without port restrictions; host loopback is also allowed. Dedicated ports are a validation requirement, not a native rule limiting local access to those ports. Proxy destination filtering and dedicated-listener isolation were not audited.
Reader comments
Newest comments first. Replies stay oldest first.