Codex Security is an open-source execution harness and sandboxing framework developed by OpenAI. It is designed to provide secure, isolated execution environments specifically for running autonomous coding agents and untrusted model-generated code. In practice, Codex Security operates as an infrastructure layer combining container configurations with system-level security profiles and a TypeScript SDK (@openai/codex-security). Developers integrate the harness into agent workflows to constrain file system access, network interaction, and process execution when agents test, build, or iterate on code. What distinguishes Codex Security from standard CLI coding agents is its focus on isolation and containment. Rather than executing shell commands directly on the host machine, it provides Docker Compose configurations with AppArmor enforcement to prevent unauthorized privilege escalation, host contamination, or destructive agent behavior. Codex Security is distributed as open-source software under the Apache-2.0 license, making it available for local development setups, custom agent platforms, and CI/CD pipelines.
Tags: cli, code assistant, coding agent, developer tools, OpenSource
compose.apparmor.yaml) to restrict agent process capabilities. - TypeScript SDK — Provides an programmatic interface (@openai/codex-security) for integrating security sandboxes into Node.js and TypeScript agent harnesses. - Docker Compose orchestration — Ships with declarative compose manifests (compose.yaml) for standardized setup across development and automated environments. - Permissive open-source licensing — Released under the Apache-2.0 license for integration into commercial and private agent platforms.Codex Security is intended for AI platform engineers, security teams, and developers building autonomous agent harnesses that execute model-generated code. It is not designed as a turnkey interactive CLI coding assistant for end-user developers.
bash npm install @openai/codex-security Alternatively, clone the repository to use the Docker Compose setups directly: bash git clone https://github.com/openai/codex-security.git cd codex-securitybash docker compose -f compose.yaml up -d On Linux systems supporting AppArmor profiles, launch the hardened container: bash docker compose -f compose.apparmor.yaml up -dtypescript import { createSandbox } from "@openai/codex-security"; const sandbox = await createSandbox({ timeoutMs: 30000, }); const result = await sandbox.exec(["npm", "test"]); console.log(`Exit code: ${result.exitCode}`); console.log(result.stdout); await sandbox.destroy();Part of CLI Coding Agents
Categories: AI Coding Agents, Code Assistants, Developer Tools