OpenAI builds custom Windows sandbox for Codex in Rust

Most AI coding tools lack native sandboxing on Windows — Linux has "bubble wrap" and macOS has "seatbelt," but Windows has no built-in equivalent, so most tools either punt to WSL or skip sandboxing entirely. OpenAI addressed this gap by building a custom Windows security sandbox from scratch in Rust for its Codex app, using Windows-native primitives including restricted tokens, file system ACLs, dedicated sandbox users, and firewall rules. OpenAI open-sourced the entire implementation — something NetworkChuck notes no other AI coding tool vendor has done for Windows. When asked why competitors haven't done the same, the OpenAI team reportedly said, "It's kind of hard."