Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Codex's Full Sandbox Escalation Expose Your Credentials?
Not for a credential Codex removed before the agent phase, but yes for one held as an environment variable, which is set for the full duration of the chat and readable by the wider command set an escalation permits. Before approving an escalation, read the environment list and move anything that matters out of the environment.
A Codex run that hits a missing system library stops and asks for permission, because the install writes outside the workspace and reaches the network. The prompt names the command. It does not list the environment that command will inherit, and in the cloud environment variables are set for the full duration of the chat while values entered as secrets are removed before the agent phase starts (OpenAI, Environment, 2026). A team that entered a registry token as a variable has handed it to a process with the network turned on.
Agentic AI is generally understood as systems that pursue goals and take actions without constant human oversight, and an approval is where that oversight is invited back (MIT Sloan Management Review, 2025). The answer turns on which of the two places Codex kept the value. A secret is removed before the agent phase starts, so no later approval restores it. An environment variable is not removed, and the agent phase runs with it.
The stake is a real credential in a process that has just been given the network. Does Codex Have Access to My Repository Secrets? sets out the storage difference; the escalation is a separate decision, taken later, by someone who may not have seen it.
Key findings
- The exposure an escalation creates is decided by what the command inherits: a value the environment holds is readable by every command the approval permits, and no render-layer control reaches a shell, so the environment list is the only place it can be removed (What Does Least Privilege Look Like for Coding Agents?).
- It would also require a named person deciding the escalation against that list and a record of what the run read and who approved it, because the prompt shows the command and not the values behind it (What Is Supervised Delegation?).
- OpenAI's approval documentation does not describe how credentials are stored or handled in a local session, so the person granting an escalation is deciding about a command without a documented view of the values it can reach (OpenAI, Agent, 2026).
- The cloud environment documentation states that "Environment variables are set for the full duration of the chat (including setup scripts and the agent phase)," so a value held that way is present through the run (OpenAI, Environment, 2026).
- OpenAI's cloud environment page states that secrets "are only available to setup scripts" and "are removed before the agent phase starts," so an escalation cannot restore a value the platform has taken out (OpenAI, Environment, 2026).
- Coder's guidance is a boundary rule: do not give agents "full permissions on behalf of a user"; use "separate identities with limited scope" instead (Coder, 2026).
What does full sandbox escalation let the agent read?
Codex runs a task inside a sandbox. Locally the sandbox is OS-enforced and limits what the agent can touch, typically to the current workspace, and network access is off by default (OpenAI, Agent, 2026). A command that needs a path outside the workspace or the network goes through an approval, which is the escalation in question. It does not restore a credential the platform already removed. It changes what the command may reach.
What the command reads is the environment of the process that starts it. In the cloud environment those variables are set for the whole chat, so an escalated install inherits every one of them, including a registry token entered as a variable (OpenAI, Environment, 2026). The record type for this page is one such escalation: a build fails on a missing library, the agent asks to install it, and the command needs a path outside the workspace and the network while the environment holds the token.
Codex is not alone in holding the value in the environment: by their own documentation, 8 of 10 coding agents and sandboxes in the October 2026 review can read environment variables by default, and Docker Sandboxes and Daytona are the two that do not (Can AI Coding Agents Read Your API Keys?). The count scores documentation, not enforcement.
The scope of a governed browser environment is the rendered page, meaning what the agent reads and does on a dashboard, a console, a settings page or a sign-up form. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. That boundary matters because the escalation acts on a shell command, and no page-level control changes what it inherits. A fresh sandbox for each task removes files an earlier run left behind, a different control from the environment (Does Each Agent Task Need a Fresh Sandbox?).
What does the approval show the person granting it?
The approval prompt is a control only if the person reading it can see what the command will carry. OpenAI's governance paper calls human approval "a standard way to limit egregious failures" and asks that actions reviewable only after the fact be "more easily reversible" (Shavit et al., 2023). The same paper holds that "at least one human entity is accountable for every uncompensated direct harm," and an escalation assigns that to a name (Shavit et al., 2023).
What the prompt shows in the pages reviewed is the command. The approval page does not describe how credentials are stored or handled in a local session, and it does not describe a listing of the environment a command would inherit (OpenAI, Agent, 2026). An approval can be given correctly and still leave the approver without the one fact that decides the exposure. Can a Coding Agent Approve Its Own Permission Request? takes the case where the agent supplies its own approval.
The identity of the approver is part of the control. New York's financial regulator advises covered entities to consider "authentication factors that can withstand AI-manipulated deepfakes," which bears on any confirmation a team treats as evidence that a person decided (New York State Department of Financial Services, 2024).
Adaptive attacks bypassed 12 published defenses with an "attack success rate above 90% for most" (Nasr et al., 2025). The finding concerns jailbreaks and prompt injections rather than approval prompts, so it is cited for the direction, not for a rate on approvals.
What do the vendors themselves say?
The vendor pages that bear on this question are OpenAI's Codex documentation for the cloud environment, approvals and internet access, with Coder's guidance for running coding agents. Each is cited for what it states, and the table sets beside it what a buyer should check that the page leaves open.
| Dimension | Codex, per its documentation | What a buyer should verify |
|---|---|---|
| Sandbox | "an OS-enforced sandbox that limits what it can touch (typically to the current workspace)" | whether the command you approve runs inside it or outside |
| Network | "By default, the agent runs with network access turned off." | whether the escalation turns it on for the command, and for how long |
| Approval | "Codex asks for approval to edit files outside the workspace or to run commands that require network access." | what the prompt displays: the command only, or the command and the environment |
| Environment variables | "set for the full duration of the chat (including setup scripts and the agent phase)" | which of your values sit there, and whether any is a credential |
| Codex secrets | "only available to setup scripts"; "removed before the agent phase starts" | whether the value the install needs is entered as a secret rather than a variable |
| Credential handling | not described in the pages reviewed for local CLI and IDE sessions | what record exists of what the run could read |
Coder's guidance adds the frame that agents "can be dangerous if not run with proper boundaries" and should not receive "full permissions on behalf of a user" (Coder, 2026).
What can an escalated command do with the credentials it inherits?
In the cloud environment the variables set for the full duration of the chat are in the process the agent runs, the values entered as secrets are removed before the agent phase starts, and the setup session is separate from the agent's Bash session (OpenAI, Environment, 2026).
A value entered as a secret and used only in setup is outside the escalation, and whether setup writes it where the agent can read it is not described. A value entered as an environment variable is in the process, so the escalated install inherits it and any permitted command can read it. A value a setup script copies into a file the agent reads is the third case, and neither setting controls what the script writes.
Network access changes the reach of the value. Codex blocks internet access in the agent phase by default and setup scripts keep it (OpenAI, Internet, 2026). An escalation for an install requests the network, so a registry token can reach a host outside the workspace. The vendor's advice is an allowlist: limit the domains and HTTP methods a task needs and review "the agent output and work log," which narrows where a request can go, not what it carries (OpenAI, Internet, 2026).
According to a Columbia DAPLab incident list, "Cursor's agent deleted PocketOS's production database via a single rogue API call," and a 13-hour AWS outage followed Amazon's own Kiro agent rebuilding a production environment (Columbia DAPLab, 2026). The design question is storage, decided before the run, and How Do I Keep API Keys Out of Claude Code's Context Window? describes a settings layer that denies or masks a credential and substitutes it only at named hosts. The record has to cover both halves, and What Is an AI Control Record? sets out that side.
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on placeholders such as PKG_001. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the policy and approves each consequential action, and every screen as tokens and every approval is written to a record that exports to the organization's own monitoring.
For this question the control class covers the pages an agent reads, not the process a command runs in. Where Codex opens a registry settings page or a hosting dashboard that displays the token, substitution keeps the value out of the model's context while the model completes the work with the placeholder. That closes the reading half of the exposure and leaves the environment half where it was.
Its scope is the rendered page. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP, so a credential an escalated command inherits from the environment is not closed by it. The escalation question is answered by the storage choice and by the person who approves, and the comparison for this vendor is set out in RedactSure vs OpenAI Codex: 2026 Comparison & Alternative.
What the record shows
Whether an escalation exposes a credential turns on what the command inherits at approval and what record names the person who approved it. The documentation is explicit about lifetimes and silent about the approval view: environment variables are set for the full duration of the chat, secrets are removed before the agent phase starts, and the approval covers commands that need the network or a path outside the workspace (OpenAI, Environment, 2026; OpenAI, Agent, 2026). The exposure follows the storage choice: a variable is readable by the wider command set, and a value removed before the agent phase is not restored by any approval. The exposure has one test on one environment: list every variable it sets, mark which values an install command could use, approve the next escalation with that list, and write down who approved and what the run read.
Methodology and limitations
This page rests on Codex documentation for the cloud environment, approvals and internet access, Coder's guidance, a New York State Department of Financial Services industry letter, a research paper and a governance paper, a Columbia DAPLab incident list, a management review article, and existing RedactSure research pages. Vendor pages were read between October 16, 2026 and October 21, 2026, and each Sources line carries the date for its page. Documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested. "Not described in the pages reviewed" means the pages listed in Sources, and a page that does not address a point leaves it open. Vendor features change and the page carries its date. The example describes a record type, an escalation to run a system package install, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations about a configuration belong to counsel, assessors and the organization's own security and compliance officers, and nothing replaces a pilot on the organization's own environment.
Frequently asked questions
Does Codex's full sandbox escalation expose your credentials?
Not the ones Codex removed before the agent phase, and yes for any value held as an environment variable. Secrets are available only to setup scripts and are removed before the agent starts, so an approval later in the run cannot bring one back. Environment variables are set for the full duration of the chat, and the command you approve inherits them.
Does the approval prompt show which credentials a command can read?
Not from the pages reviewed. The approval covers editing files outside the workspace and running commands that require network access, and the approval page does not describe how credentials are handled in a local session. The prompt names the command; a listing of the environment the command will inherit is not described. Treat the command as the visible half and the environment as the part you check.
Which credentials can the agent read after setup finishes?
Any value held as an environment variable, because those are set for the full duration of the chat. Values entered as secrets are removed before the agent phase starts and are available only to setup scripts, unless a script wrote one where the agent can read it. The setup session is separate from the agent's Bash session, so an export does not carry over. Check the variable list rather than the storage label.
What record exists of what the agent ran after an escalation?
Less than an auditor would ask for. The internet-access page tells a team to review the agent output and work log, which is a review of what the run produced. The approval documentation reviewed here does not describe a per-command record of what the command read or which values it inherited. A team that needs that evidence has to produce it, keeping the environment list and the approver's name beside the output.
Does an internet allowlist stop a credential the agent can read?
No. An allowlist narrows the destinations a request can reach, and the internet-access page advises limiting domains and HTTP methods and reviewing the output and work log. It does not take the value out of the process that holds it, and the page does not explain how the allowlist is enforced. A token in the environment is still readable, and a destination the allowlist permits can still carry it. Verify the enforcement before you rely on the list.
What should a security team require before it approves a command?
The environment list for the run, read at the time of the approval, and a named person who owns the decision. Ask which values are entered as secrets and which as variables, what setup writes to disk, and what the prompt displays. Ask what record names the approver and what the run read. Where the answer is undocumented, treat it as open and test it with a dummy value before the next escalation.
How RedactSure Keeps an Environment List Ahead of an Escalation
An approval that lifts the sandbox for one command hands it the environment the agent phase runs with, and the approver may lack the list. OpenAI's cloud documentation states that environment variables are set for the full duration of the chat (OpenAI, Environment, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the registry's token page renders the real value, the agent reads it for the install, and the model keeps it for the run. Inside the governed environment: the page renders PKG_001, and the real token resolves at the registry only on a named person's approval.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An environment variable is exposed by the command that needs it, not by the page it was copied from. Bring a registry token and see, with test values, what the model reads and where the real value lands. Book a demo