OpenAI Codex reads your code, edits files and runs commands in a loop, across the CLI, the IDE extension, the desktop app and Codex cloud. Locally, it does all of that with your user’s permissions.
Codex ships with good defaults: an operating-system sandbox, command network access off, and cached web search. Most Codex incidents come from turning those defaults off, trusting a repository that carries configuration, or leaving secrets readable. This post covers what goes wrong, the incidents, their impact, and the controls that work.