OpenAIが社内でCodexを安全に運用する方法 Running Codex safely at OpenAI

OpenAI has published an account of how it deploys Codex, its AI coding agent, inside its own engineering organization, detailing the layered controls it relies on to let the agent write and run code without exposing systems to undue risk. The disclosure matters because autonomous coding agents are moving quickly from experimental tools to everyday parts of developer workflows, and the security questions they raise — what an agent can execute, what it can reach, and how its actions are recorded — remain largely unsettled across the industry.

At the center of OpenAI's approach is sandboxing. Rather than allowing the agent to operate directly against production systems or a developer's full machine, Codex runs within isolated environments where its file access, processes, and system calls are constrained. This containment limits the blast radius if the agent behaves unexpectedly, whether because of a flawed instruction, a subtle bug in generated code, or a prompt injection attempt embedded in data the agent processes. Sandboxing is a well-established principle in software security, but applying it to agents is notable because these systems generate and execute code dynamically, making their behavior harder to predict than that of conventional automated pipelines.

Network policy forms a second layer. By default, the agent's outbound connectivity appears to be tightly restricted, so it cannot freely reach external services, exfiltrate data, or pull arbitrary dependencies. Limiting network egress is a recognized defense against both accidental data leakage and deliberate misuse, and it is particularly relevant for agents that might be steered by malicious content into contacting attacker-controlled endpoints. Combined with sandboxing, restrictive network rules mean that even a compromised or misguided agent has limited avenues to cause harm.

Approvals and permission controls add a human checkpoint to sensitive operations. According to the account, certain actions require explicit authorization rather than proceeding automatically, keeping a person in the loop for steps that carry elevated risk. This reflects a broader design philosophy in agentic systems, where the degree of autonomy is calibrated to the potential consequences of an action. Low-risk tasks can run unattended to preserve the productivity gains that make coding agents attractive, while higher-stakes changes are gated. Codex's output also flows into established code review processes, meaning generated changes are subject to the same scrutiny as human-written code before being merged.

OpenAI also highlights what it describes as agent-native telemetry. Because agents take many small, automated steps, traditional logging designed for human activity can be insufficient for understanding what an agent actually did. Telemetry tailored to agent behavior is intended to give security and engineering teams visibility into the agent's decisions and actions, supporting auditing, incident investigation, and compliance requirements. This emphasis on observability aligns with the wider DevSecOps movement, which seeks to embed security monitoring and controls throughout the software development lifecycle rather than bolting them on at the end.

The publication fits into a growing body of work on securing AI agents. Prompt injection, in which untrusted input manipulates a model into taking unintended actions, has been widely documented as a leading risk for tools that read external data and then act on it. Industry groups and security researchers have increasingly called for least-privilege designs, strong isolation, and detailed logging as baseline mitigations, and several of those ideas are visible in OpenAI's described setup. Other vendors offering coding agents and assistants, including those integrated into popular development environments, face comparable challenges, so OpenAI's account is likely to be read as one reference point among several emerging practices rather than a definitive standard.

For organizations weighing similar deployments, the broader message appears to be that coding agents can be adopted productively only when paired with deliberate guardrails. Sandboxing, network restrictions, human approvals, code review, and agent-aware telemetry are presented not as optional extras but as prerequisites for safe and compliant use. It is worth noting that this is a company describing its own internal practices, so the controls reflect OpenAI's particular environment and risk tolerance, and results may differ elsewhere. Even so, the framework offers a concrete illustration of how defense-in-depth principles, long familiar in conventional security engineering, are being adapted to the distinctive behavior of autonomous coding agents as they become a more common part of professional software development.