OpenAI Codex preview made sandbox evidence part of code review
OpenAI launched its cloud-based Codex research preview in May 2025. Its sandboxed task model shows why generated code, command evidence and merge authority must remain separate.
Historical retrospective: OpenAI launched Codex as a research preview on May 16, 2025, and published a same-day system-card addendum. This article does not claim current Codex product behavior, sandbox settings or availability.
Key takeaways
- A sandbox can bound a task environment, but it does not approve a generated change for merge or deployment.
- Command logs and file citations make an agent result inspectable only when they identify the task environment.
- Review should test the proposed diff and the evidence behind it as separate artifacts.
Codex launched as a cloud software-engineering preview[source 1][source 2]
On May 16, 2025, OpenAI launched Codex as a research preview of a cloud-based software engineering agent powered by codex-1. The launch post said tasks ran in separate cloud sandbox environments preloaded with a repository and described work such as feature implementation, codebase questions, bug fixes and pull-request proposals. A same-day system-card addendum described the container boundary, including a user-defined development environment and disabled internet access after setup. Those are historical provider statements about that preview configuration.
The release did not turn an agent-produced patch into an approved production change. Its own framing placed inspection and refinement after task completion, and its system-card material distinguished the container environment from the user's larger software-delivery process. This distinction is the useful historical lesson: a constrained work area can improve reviewability without replacing code ownership or release judgment.
The task receipt needs a boundary as well as a diff
A meaningful agent receipt identifies more than changed files. It should capture repository revision, task text, workspace setup, dependency state, command history, test output, generated diff and any network or credential boundary in force. With this material, a reviewer can ask a concrete question: did the evidence come from the same environment that produced the patch? A transcript without a pinned source revision or an unqualified test log leaves that question unresolved.
The receipt should also list what did not run and why. A sandbox may lack a service, test secret, integration target or operating-system dependency needed for full validation. Hiding such gaps behind a successful unit test makes a change look more complete than its evidence supports. Marking them keeps the handoff honest and gives the repository owner a precise next check.
Sources
- OpenAI: Introducing Codex (May 16, 2025)
- OpenAI: Addendum to o3 and o4-mini system card, Codex (May 16, 2025)
Continue reading
