Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Codex Log Every Command the Agent Ran?
No. Codex leaves a work log you can read after the run and asks for approval before a command reaches outside the sandbox, but the Codex pages reviewed describe no audit export, so proving every command to a third party is a reconstruction.
Payments teams often get the audit request months after the work. An auditor asks what the agent ran against the payments service during a migration window, and the team has a finished task, a transcript nobody saved and a container that no longer exists. Codex does leave something behind: its internet-access page tells a team to "review the agent output and work log," and its local documentation describes the approval prompt before a command that needs the network. Neither is a record with a schema, a retention period or an export. That gap turns a yes or no question into one about evidence. A command log is written by the party that ran the command, lives in the product that produced it, and holds whatever the command printed, including values a team would rather keep out of a file. The same agent often works a rendered page, where the log records the click and not the fields the model received. The record an auditor wants shows the command, the value the model saw and the person who approved the action, and those three sit in different places unless something puts them in one. For that team, the difference decides whether an incident review takes an afternoon or a quarter of the year.
Key findings
- For a command log to answer an auditor about a page the agent worked, the values on that rendered page would have to be replaced with consistent tokens before any model reads it, so the record holds ACCT_001 where the account number sat (What Is an AI Control Record?).
- It would also require a named person approving each consequential command and an account of what the model received that leaves the product for the customer's monitoring (What Is Supervised Delegation?).
- OpenAI's Codex internet-access page tells a team to "review the agent output and work log," and it describes no export, retention period or per-command identifier (OpenAI, Internet Access, 2026).
- OpenAI's cloud environment page states that secrets "are removed before the agent phase starts" while "Environment variables are set for the full duration of the chat (including setup scripts and the agent phase)," so a command can read a value from its environment after setup (OpenAI, Cloud Environment, 2026).
- The agent-approvals page states that "Codex asks for approval to edit files outside the workspace or to run commands that require network access," an approval the page does not describe as stored with a name (OpenAI, Agent approvals, 2026).
- OpenAI's governance paper states that "Actions that can only be reviewed after the fact should be more easily reversible," the property a review-only log assumes the team has arranged (Shavit et al., 2023).
What does Codex record while the agent works?
A governed browser environment covers what an agent reads and does on a rendered page, such as a console, a settings page or a sign-up form, and it does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. A shell command sits outside that scope, which is why a command log answers this question only in part, and why a record built on the page is a different artifact from a record built on the process.
OpenAI's Codex internet-access page states that "By default, Codex blocks internet access during the agent phase" and that setup scripts "still run with internet access so you can install dependencies" (OpenAI, Internet Access, 2026). The same page gives the review step as "review the agent output and work log," with no export, schema or retention term attached to it (OpenAI, Internet Access, 2026).
Take one record type: an auditor asking what ran against the payments service. The commands sit in the task's output, the reasoning around them in the work log, and the container's settings in the environment configuration. The page adds that "Setup scripts run in a separate Bash session from the agent," so a variable exported during setup does not carry into the agent phase (OpenAI, Cloud Environment, 2026). The record holds the command and what it printed, not a signature, a per-command identifier or the identity of whoever answered an approval prompt.
A review of coding agents and sandboxes found that Codex is one of two coding agents whose documentation describes approval by default before network access, and it does not fully document a per-action audit record (Can AI Coding Agents Read Your API Keys?).
Where does the work log live, and who can read it?
In the task, on the vendor's side, for as long as the task exists. The pages reviewed describe a review step, not custody: nothing says who outside the account may have a copy, how long the output is kept, or whether the task's owner can delete it. An auditor's request asks for something built to leave.
The cloud environment page states that "Environment variables are set for the full duration of the chat (including setup scripts and the agent phase)" (OpenAI, Cloud Environment, 2026). An agent that can run a command can print its environment, and the log keeps the output. A value stored that way is in the record twice, as the setting and as text a command produced, which makes the log a copy of the value it was meant to protect. Does Codex Have Access to My Repository Secrets? works the same distinction from the credential side.
A log of commands answers what the process did. It does not answer what the model read on a page the agent opened: a page is not a command, and its fields appear in the log only if a command fetched them. A record of what an agent did on a page is a separate artifact, as (Does the ChatGPT Compliance API Record What the Agent Did in the Browser?) sets out for another product.
What do the vendors themselves say?
OpenAI's agent-approvals page describes the local default: "Locally, Codex uses an OS-enforced sandbox that limits what it can touch" (OpenAI, Agent approvals, 2026). The same page states that "Codex asks for approval to edit files outside the workspace or to run commands that require network access," a gate on what the agent may do rather than a record of who opened it (OpenAI, Agent approvals, 2026). A gate keeps a run inside a boundary; it says nothing about what a reader can check later.
Coder's documentation tells teams not to give agents "full permissions on behalf of a user" and to use "separate identities with limited scope," a rule about the account an agent acts as that says nothing about what its log keeps (Coder, 2026). 1Password's post on its agent sandbox states that "The agent can work with real systems without holding any credentials in its context," the design a command log would need in order to stay free of values (1Password, 2026).
| Dimension | What the vendor page states | What a buyer should verify |
|---|---|---|
| Work log | "review the agent output and work log" (OpenAI, Internet Access, 2026) | Whether the log exports, and in what format |
| Approval | "Codex asks for approval to edit files outside the workspace or to run commands that require network access" (OpenAI, Agent approvals, 2026) | Whether the approver's name is stored with the command |
| Identity | "separate identities with limited scope" (Coder, 2026) | Whether the log shows the agent or the person's login |
What does an approval prove after the fact?
An approval proves that someone was asked. It does not prove who answered, what they were shown or that the answer was kept anywhere a third party can read. On a shared build machine the identity question is harder: the session belongs to a team rather than a person, and no page describes a record of who answered the prompt.
OpenAI's governance paper calls human approval "a standard way to limit egregious failures" and asks that "Actions that can only be reviewed after the fact should be more easily reversible" (Shavit et al., 2023). The same paper holds that "at least one human entity is accountable for every uncompensated direct harm," an accountability a prompt answer does not document (Shavit et al., 2023).
The Attacker Moves Second reports that adaptive attacks bypassed 12 published defenses with "attack success rate above 90% for most" (Nasr et al., 2025). A gate that can be talked past is worth what its record is worth.
An approval is also an identity claim. New York's regulator advises that "Covered Entities should consider using authentication factors that can withstand AI-manipulated deepfakes," which is the standard the identity behind an approval has to meet (New York State Department of Financial Services, 2024). A prompt in a terminal is answered by whoever holds the session, and no page describes a factor behind that.
What should a security team ask for in writing?
What does the model receive from a rendered screen? When the same agent works a billing console, the log records the call and not the fields on the page, so a team with a data protection obligation has to ask which values the model was shown, whether any were tokens, and where that record is kept.
The DAPLab position paper puts the reason in one line: "human oversight breaks under scale," the argument against a review step as the only control on a long run (DAPLab, 2026).
Then the five asks that turn a log into evidence. An export with a schema and a per-command identifier, so a command can be followed across the log and the change record. The approver's name against the command it covered. A retention term and a custody statement, in the contract rather than in a help page. A copy in the organization's own monitoring, with the task's timestamps. And a statement of what a successful injection would collect, the exposure the record exists to bound.
Two of those asks have pages of their own. What Is the Least Access a Coding Agent Needs to Finish a Task? explains why the last item decides what the first four are worth, and Can a Coding Agent Use a Credential It Cannot Read? describes the credential an agent can use without holding it.
What does a governed environment change?
A governed environment changes what a record can show. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers.Values on the rendered page are replaced with consistent tokens before any model reads it, so the screen the model receives holds ACCT_001 for the whole run and the payment amount, which the command record does not use, renders as PAY_001, while the real values resolve only at the approved destination. A named person approves each consequential action, and every screen as tokens, every action and every approval lands in a record that exports to the organization's own monitoring. The record is written where the page is read, not where the command runs, which is what makes it checkable later.
Read that against a command log. The log still shows what the process ran, and the record shows what the model was given and who allowed it. Both are needed to answer the auditor's question, and only the second is evidence about the data rather than about the tool. The scope is the rendered page, which means the terminal, the IDE, the local filesystem, direct API calls and MCP stay outside it and keep whatever logging their own tools provide. A team that expects one artifact to cover both will find the gap during an incident, the worst time to learn which record is which.
The comparison for the product on this page is here: (RedactSure vs OpenAI Codex: 2026 Comparison & Alternative).
What the record shows
Control over what a model receives on a screen, who approves an action and where the record is kept decides whether a trail can be examined by anyone outside the team that ran it. OpenAI's Codex pages describe a work log to review, an approval before a command that needs the network, and an environment that hands the agent its variables; they describe no export, no retention period and no approver's name against a command. Neither the local sandbox nor the cloud task leaves an artifact an auditor can query. A team can check this on its own system: run one task against a test service, keep the work log, then ask for the export an auditor would request. Compare the commands in the log with the container's own output and with the name behind the one approval the run needed; whatever cannot be matched across those three lists is what a third party would have to reconstruct.
Methodology and limitations
This page rests on OpenAI's Codex documentation for the cloud environment, its internet-access page and its agent-approvals page, with the material in Sources. The vendor pages were read between October 16, 2026 and October 21, 2026, and each Sources line carries its page's date. Public documentation read in full gives a sound view of where a product applies its control; it does not show what one run did.
No product on this page was tested for this page, so "not described" means the pages reviewed, not a claim about behavior nobody recorded. Codex features change and the page carries its date; RedactSure is deploying now with enterprise and government customers. The example is a record type, an auditor asking what ran against the payments service, not an organization. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing replaces a pilot of one workflow on the organization's screens.
Frequently asked questions
Does Codex log every command the agent ran?
No, not in the form that question means. The internet-access page advises a team to "review the agent output and work log," so a record exists for review inside the task. The pages reviewed describe no export, no per-command identifier and no retention term, and the log keeps whatever a command printed. An auditor outside the account gets a reconstruction: the log as someone copied it, the container's settings, and the approval someone remembers answering.
How long does Codex keep a task's work log?
Not from the pages reviewed. The cloud environment and internet-access pages describe the phases of a task and the review step, and neither states a retention period or a deletion path. That matters for an incident that surfaces after the task closes: the record may exist for as long as the product decides, and the team cannot promise an auditor it will remain. Ask for the retention term in writing before a run that matters.
Can I export Codex's command history to my SIEM?
No export is described. The review step on the internet-access page is "review the agent output and work log," an instruction to a reader rather than a feed, and the cloud environment page names no destination for it. A team that needs the commands in its own monitoring has to copy them out or rebuild them from the task. That step is incomplete, arrives late, and depends on someone remembering to do it.
What does an approval prove after the fact?
That someone was asked, and not much more. The agent-approvals page states that "Codex asks for approval to edit files outside the workspace or to run commands that require network access," and it describes no stored record of who answered or what they were shown. An approval narrows what a run can do, which is its purpose. It becomes evidence only when the identity, the command and the answer are kept together.
Does the work log show what the agent read, or only what it ran?
Only what it ran, plus whatever the command printed. A page the agent opens in a browser session is not a command; its fields appear in the log only if a command fetched or wrote them. So an auditor asking which account numbers reached the model gets a command list and a gap. The fields have to be recorded where the page is rendered, as tokens, if that question is to have an answer.
What should I keep outside Codex to answer an auditor?
The three things the product does not join: the approver's name against the command it covered, the retention term for the output, and a record of what the model received on any rendered page. Keep them in the organization's own monitoring with the task's timestamps, so the two accounts can be compared. Without that copy, an incident review starts by asking people what they remember, which is where a record stops being one.
How RedactSure Keeps a Command Record an Auditor Can Check
A work log kept inside the product still leaves the auditor asking what the model saw and who allowed it. Adaptive attacks bypassed 12 published defenses with "attack success rate above 90% for most," so a command list cannot explain a miss.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the payments console renders the routing number and the amount, and the model keeps both while the log holds the command. Inside, the same console shows ACCT_001, the amount the command record does not need renders as PAY_001, the real values resolve at the approved destination when the payments lead approves, and the screen, the action and her name land in the control record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A work log that lives in the product answers a question about the tool, not about the payments service. Bring one task and see, with test values, which screen the model reads and what the record holds. Book a demo