The problem
What Codex can reach
In its default workspace-write mode, Codex can edit files in your workspace and read files beyond it, because the sandbox limits writes, not reads (Codex docs). That includes ~/.ssh, ~/.aws and every .env file your account can open.
What Codex loads matters as much as what it runs. Your config.toml, a trusted project’s .codex/ folder, AGENTS.md, MCP servers, hooks and notify commands all execute or instruct before you type anything, and every web page, issue and tool result can carry instructions aimed at the model.