8961`decision = "prompt"`, or configure sensitive MCP tools to require approval,8961`decision = "prompt"`, or configure sensitive MCP tools to require approval,
8962when actions inside the sandbox must still reach the reviewer.8962when actions inside the sandbox must still reach the reviewer.
8963 8963
8964See [Cyber Safety](https://learn.chatgpt.com/docs/cyber-safety) for model access, engagement setup, and8964See [Models and Trusted Access](https://learn.chatgpt.com/docs/cyber-safety) and [recommended
8965custom agent workflows, and [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy)8965configuration](https://learn.chatgpt.com/docs/cyber-safety/recommended-configuration) for model access,
8966engagement setup, and custom agent workflows. See [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy)
8966for enterprise precedence and supported client versions. For custom API or8967for enterprise precedence and supported client versions. For custom API or
8967Agents SDK harnesses, use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution).8968Agents SDK harnesses, use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution).
8968 8969
8999For the research rationale and published evaluation results, see the9000For the research rationale and published evaluation results, see the
9000[Alignment Research post on Auto-review](https://alignment.openai.com/auto-review/).9001[Alignment Research post on Auto-review](https://alignment.openai.com/auto-review/).
9001 9002
9002### Cyber Safety9003### Models and Trusted Access
9003 9004
9004Source: [Cyber Safety](https://learn.chatgpt.com/docs/cyber-safety.md)9005Source: [Models and Trusted Access](https://learn.chatgpt.com/docs/cyber-safety.md)
9005 9006
9006Daybreak Blue and Daybreak Red help approved users move from findings to validated fixes during authorized defensive cybersecurity work. Combine the right model with a controlled environment, a written engagement scope, least-privilege permissions, and automatic review before sensitive actions run.9007OpenAI Daybreak helps approved users perform authorized defensive cybersecurity work. Daybreak Blue provides access to frontier models with reduced refusals for authorized defensive workflows. Daybreak Red provides separately approved access to specialist cyber models for more advanced security research.
9007 9008
9008#### Choose the right access tier9009Combine your approved model with a controlled environment, clear limits on approved systems and actions, least-privilege permissions, and automatic review before sensitive actions run. Use the model only with the approved identity, workspace or API organization and project, and product surface.
9009 9010
9010Start with **Daybreak Blue**, which provides access to frontier models such as GPT-5.6 Sol, for most authorized defensive work, including:9011#### Choose the right model
9012
9013Start with **GPT-Daybreak-Blue** for most authorized defensive work. This model provides access to frontier capabilities with reduced refusals for defensive security workflows, including:
9011 9014
9012- Vulnerability discovery and triage.9015- Vulnerability discovery and triage.
9013- Secure code review and threat modeling.9016- Secure code review and threat modeling.
9015- Malware analysis in a controlled environment.9018- Malware analysis in a controlled environment.
9016- Remediation and patch validation.9019- Remediation and patch validation.
9017 9020
9018**Daybreak Red** provides separately approved access to purpose-trained cybersecurity models such as GPT-5.6 Cyber for explicitly authorized specialist workflows, including controlled vulnerability reproduction, proof-of-concept or exploit validation, penetration testing, red teaming, and complex system analysis. It isn't the default choice for routine security work, and access isn't available automatically or on every surface.9021**GPT-Daybreak-Red** is a specialist cyber model for separately approved, explicitly authorized workflows, such as controlled vulnerability reproduction, proof-of-concept or exploit validation, penetration testing, red teaming, and complex system analysis. It isn't the default choice for routine security work, and access isn't available automatically or on every surface.
9019 9022
9020These advanced workflows can resemble malicious activity without the authorized engagement context. Use the approved model and surface only for systems you own or are explicitly authorized to assess, and keep appropriate human oversight in place.9023These advanced workflows can resemble malicious activity without clear authorization. Use the approved model and surface only for systems you own or are explicitly authorized to assess, and keep appropriate human oversight in place.
9021 9024
9022For example:9025For example:
9023 9026
9024- **Daybreak Blue:** Review the approved lab repository for authentication weaknesses, rank findings by evidence and impact, and propose patches without accessing external systems.9027- **GPT-Daybreak-Blue:** Review the approved lab repository for authentication weaknesses, rank findings by evidence and impact, and propose patches without accessing external systems.
9025- **Daybreak Red:** Within the approved lab and engagement window, reproduce the documented authentication flaw, validate a minimal proof of concept, and stop before credential access, persistence, or production changes.9028- **GPT-Daybreak-Red:** Within the approved lab and testing window, reproduce the documented authentication flaw, validate a minimal proof of concept, and stop before credential access, persistence, or production changes.
9026 9029
9027#### Trusted Access for Cyber9030#### Trusted Access for Cyber
9028 9031
9029[Trusted Access for Cyber](https://openai.com/index/trusted-access-for-cyber/) is the reviewed access program; Daybreak Blue and Daybreak Red are access tiers for approved models. Access depends on approval and provisioning for your specific identity or service, ChatGPT workspace or API organization and project, authorized model, and allowed product surface.9032Request **Daybreak access** through [Trusted Access for Cyber](https://help.openai.com/en/articles/20001258-trusted-access-for-cyber). Access depends on approval and provisioning for your specific identity or service, ChatGPT workspace or API organization and project, authorized offering and model, and allowed product surface.
9030 9033
9031- Individuals can request access through the [individual Trusted Access application](https://chatgpt.com/cyber).9034- Individuals can request access through the [individual Trusted Access application](https://chatgpt.com/cyber).
9032- Organizations can submit the [enterprise Trusted Access request form](https://openai.com/form/enterprise-trusted-access-for-cyber/) and coordinate with their OpenAI representative.9035- Organizations can submit the [enterprise Trusted Access request form](https://openai.com/form/enterprise-trusted-access-for-cyber/) and coordinate with their OpenAI representative.
9034Submitting an application or completing identity verification doesn't guarantee approval.9037Submitting an application or completing identity verification doesn't guarantee approval.
9035 9038
9036Applying, verifying your identity, or receiving approval for Daybreak Blue9039Applying, verifying your identity, or receiving approval for Daybreak Blue
9037doesn't grant access to Daybreak Red. Specialist access requires separate9040doesn't grant access to Daybreak Red or GPT-Daybreak-Red. The specialist
9038approval and provisioning.9041offering requires separate approval and provisioning.
9039 9042
9040For enterprise access, use the approved workspace, API organization, or project only for your organization's authorized internal work. Don't extend it to external users, third-party customers, externally offered services, downstream product features, or systems outside the approved engagement. If the approved identity, workspace, API organization, project, model, or surface is unclear, stop and confirm it with your OpenAI representative.9043For enterprise access, use the approved workspace, API organization, or project only for your organization's authorized internal work. Don't extend it to external users, third-party customers, externally offered services, downstream product features, or systems outside the approved work. If the approved identity, workspace, API organization, project, model, or surface is unclear, stop and confirm it with your OpenAI representative.
9041 9044
9042Trusted Access doesn't automatically grant [Zero Data Retention](https://developers.openai.com/api/docs/guides/your-data#data-retention-controls-for-abuse-monitoring). Confirm any separately approved retention controls for the exact API organization and applicable endpoint before you begin.9045Trusted Access doesn't automatically grant [Zero Data Retention](https://developers.openai.com/api/docs/guides/your-data#data-retention-controls-for-abuse-monitoring). Confirm any separately approved retention controls for the exact API organization and applicable endpoint before you begin.
9043 9046
9044#### Configure a controlled cybersecurity engagement9047#### False positives
9045
9046Trusted Access governs approved model access, but it doesn't configure your environment or enforce your engagement scope. Your team must set up the following isolation, permission, review, and human-oversight controls.
9047
9048#### Isolate the environment
9049
9050Run the engagement in a controlled lab or sandbox. Start without unrestricted internet access, access to sensitive production systems, or access to unrelated infrastructure. Keep secrets, credentials, persistent access, and durable system changes out of reach unless the written engagement explicitly requires and authorizes them.
9051
9052Test filesystem and network boundaries before beginning higher-risk work. Keep the host environment isolated even when the model or reviewer approves an individual action.
9053
9054#### Define and enforce the engagement scope
9055
9056Document the rules of engagement before the model starts. Include:
9057
9058- Approved target systems, hosts, and environments.
9059- Excluded systems, including production and unrelated infrastructure.
9060- Approved and prohibited actions.
9061- The engagement window and data-handling requirements.
9062- Vulnerability disclosure, patch approval, and maintainer coordination.
9063- Stop conditions and actions that require explicit human approval.
9064
9065Give the agent the relevant scope as task context. This written scope doesn't enforce itself: apply independent filesystem, network, identity, and tool controls to make unauthorized actions impossible whenever practical.
9066
9067Use Codex [permission profiles](https://learn.chatgpt.com/docs/permissions) to create a least-privilege boundary. Choose `:read-only` when the task doesn't require changes, or extend `:workspace` when the engagement needs workspace edits. For example:
9068
9069```toml
9070approval_policy = "on-request"
9071approvals_reviewer = "auto_review"
9072default_permissions = "cyber-lab"
9073
9074[permissions.cyber-lab]
9075description = "Limit security testing to the approved lab and workspace."
9076extends = ":workspace"
9077
9078[permissions.cyber-lab.filesystem]
9079glob_scan_max_depth = 3
9080
9081[permissions.cyber-lab.filesystem.":workspace_roots"]
9082"**/.env*" = "deny"
9083"**/*.pem" = "deny"
9084
9085[permissions.cyber-lab.network]
9086enabled = true
9087# Uncomment only for an approved host that resolves to a private address.
9088# allow_local_binding = true
9089
9090[permissions.cyber-lab.network.domains]
9091"lab.example.com" = "allow"
9092```
9093
9094Replace `lab.example.com` with an approved target. The bounded filesystem scan avoids searching the entire workspace on Linux, WSL, and Windows; increase the depth or use exact deny paths if sensitive files appear deeper. Don't combine permission profiles with legacy `sandbox_mode` settings; follow the [permission-profile configuration guidance](https://learn.chatgpt.com/docs/permissions#define-and-select-a-profile).
9095
9096If the approved lab host resolves to a private address, Codex blocks it by default even when the host is on the allowlist. Set `allow_local_binding = true` only for an explicitly approved private-network engagement, keep the destination allowlist narrow, and review the [local and private network guidance](https://learn.chatgpt.com/docs/permissions#local-and-private-networks). You can also allowlist the exact approved private IP address.
9097
9098Avoid `:danger-full-access` and `--yolo` for cybersecurity engagements. Full Access removes the enforceable sandbox boundary that automatic review depends on. Managed organizations can exclude `:danger-full-access`, limit allowed approval policies, and require automatic review through [enterprise-managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).
9099
9100Before enabling **Full Access** for an approved security model, the
9101ChatGPT desktop app shows a model-specific warning about dangerous actions. The
9102warning recommends **Approve for me** instead and links to
9103[reviewer-policy configuration](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration).
9104The warning doesn't restore the sandbox boundary or override organization
9105policy.
9106
9107#### Review sensitive actions before execution
9108
9109[Auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review) routes eligible sandbox-boundary approval requests to a separate reviewer before the proposed action runs. The reviewer considers the proposed action, bounded task context, and applicable policy, then allows or denies the request. Organizations can customize that policy for their approved targets, prohibited actions, and required human-review conditions.
9110
9111In the ChatGPT desktop app, selecting an approved Daybreak model
9112automatically switches the permissions control to **Approve for me** when that
9113mode is available for your account and allowed by organization policy. This
9114also applies when you use the desktop app's `/model` command. If that mode
9115isn't available, the current permission mode stays unchanged. Model selection
9116never overrides managed organization requirements.
9117
9118For automatic review to run, keep all three controls in place:
9119
91201. Use an interactive approval policy such as `approval_policy = "on-request"`.
91212. Set `approvals_reviewer = "auto_review"`.
91223. Keep an enforceable sandbox or permission-profile boundary.
9123
9124Requests to a target on the network allowlist stay inside the network boundary and don't automatically trigger Auto-review. To review a sensitive command even when its destination is on the allowlist, create an explicit [command rule](https://learn.chatgpt.com/docs/agent-configuration/rules) under `~/.codex/rules/`:
9125
9126```python
9127prefix_rule(
9128 pattern = ["curl"],
9129 decision = "prompt",
9130 justification = "Review requests to the approved cybersecurity target.",
9131)
9132```
9133
9134Restart Codex after adding the rule. With `approvals_reviewer = "auto_review"`, matching commands go to the reviewer before execution. Add corresponding prompt rules for every sensitive command, or use `approval_mode = "prompt"` for individual [MCP tools](https://learn.chatgpt.com/docs/extend/mcp). Actions that require a person's decision still need explicit human approval.
9135
9136Auto-review doesn't inspect routine actions that are already permitted inside the sandbox. With `approval_policy = "never"` or Full Access, a sensitive action might not create a reviewable approval request. Automatic review can make mistakes and doesn't replace isolation, written scope, monitoring, or explicit human oversight.
9137
9138For a scoped policy and organization-wide enforcement, see [Configure an authorized cybersecurity engagement](https://learn.chatgpt.com/docs/sandboxing/auto-review#configure-an-authorized-cybersecurity-engagement).
9139
9140#### Apply the same controls in custom agent workflows
9141 9048
9142If you build with the Responses API, the Agents SDK, or another harness, add review at the tool-execution boundary. Check sensitive proposed actions against the approved engagement scope before execution, route ambiguous or high-risk actions to a person, enforce independent filesystem and network restrictions, keep audit logs, and fail closed if the reviewer or policy is unavailable.9049Legitimate cybersecurity or unrelated activity can still trigger a safeguard. If a safeguard blocks, reroutes, or limits a request, inspect the available client notice and request logs. Review [Common Issues and Troubleshooting](https://help.openai.com/en/articles/20001259) for details to collect and next steps. Report suspected Codex false positives through `/feedback` when available. For API access restrictions and appeals, follow the [API cybersecurity checks guidance](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity#appeals).
9143 9050
9144Codex Auto-review doesn't automatically protect custom tools or external harnesses. Use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution) for the Agents SDK pattern and the [open-source reviewer policy](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md) as a reference.9051All users remain subject to the [Usage Policies](https://openai.com/policies/usage-policies/) and [Terms of Use](https://openai.com/policies/row-terms-of-use/).
9145
9146Codex product-side sandboxing and review are separate from [API cybersecurity checks](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity). API safeguards can return `cyber_policy` errors, and per-user `safety_identifier` values can help limit the impact of a safeguard action.
9147 9052
9148#### False positives9053#### Configure your security workflow
9149 9054
9150Legitimate cybersecurity or unrelated activity can still trigger a safeguard. If a safeguard blocks, reroutes, or limits a request, inspect the available client notice and request logs. Report suspected Codex false positives through `/feedback` when available. For API access restrictions and appeals, follow the [API cybersecurity checks guidance](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity#appeals).9055Trusted Access governs approved model access, but it doesn't configure your environment, enforce limits on approved systems and actions, or review proposed actions.
9151 9056
9152All users remain subject to the [Usage Policies](https://openai.com/policies/usage-policies/) and [Terms of Use](https://openai.com/policies/row-terms-of-use/).9057- [Use the recommended configuration](https://learn.chatgpt.com/docs/cyber-safety/recommended-configuration) for isolation, least-privilege permissions, clearly defined boundaries, and guardrails for sensitive actions.
9153 9058
9154### Permissions9059### Permissions
9155 9060
9746Use the global `"*"` allow rule only when you intend to allow public network9651Use the global `"*"` allow rule only when you intend to allow public network
9747access. Deny rules can narrow a broad allowlist.9652access. Deny rules can narrow a broad allowlist.
9748 9653
9654### Recommended configuration
9655
9656Source: [Recommended configuration](https://learn.chatgpt.com/docs/cyber-safety/recommended-configuration.md)
9657
9658The security controls appropriate for a cybersecurity workflow depend on the model, the actions it can take, the systems it can access, and the sensitivity of the data involved.
9659
9660For most Daybreak Blue workflows, your organization's existing security practices—such as access controls, credential protection, and review of sensitive actions—may be sufficient.
9661
9662Daybreak Red workflows, autonomous security testing, and activities involving production systems, sensitive data, or external tools may require stronger safeguards. The recommendations below are intended primarily for these higher-risk scenarios.
9663
9664You are responsible for assessing the risks of your particular workflow and
9665implementing appropriate security controls. Model safeguards and Trusted
9666Access do not replace your organization's own security, monitoring, and
9667oversight practices.
9668
9669Trusted Access governs approved model access, but it doesn't configure your environment or enforce limits on approved systems and actions. Your team must set up appropriate isolation, permission, review, monitoring, and human-oversight controls. Assume the model, its tools, and every connected system could be compromised, then configure the environment so they still can't reach unauthorized systems, expose credentials, disable safeguards, or persist after the work ends.
9670
9671#### Isolate the environment
9672
9673Run offensive security work in a dedicated lab or sandbox. Start without unrestricted internet access, access to sensitive production systems, corporate networks, unrelated workloads, or host-management interfaces. Keep secrets, credentials, persistent access, and durable system changes out of reach unless your approved work explicitly requires and authorizes them.
9674
9675For higher-risk or reduced-safeguard work, use a fresh, strongly isolated environment for each attempt. Separate compute, storage, networking, and identities, and destroy the environment afterward instead of resetting or reusing it.
9676
9677Test filesystem and network boundaries before beginning higher-risk work. Include every reachable host, connected tool, delegated agent, and downstream service. Keep the host environment isolated even when the model or reviewer approves an individual action.
9678
9679#### Define and enforce approved boundaries
9680
9681Before the model starts, document the systems, tools, actions, and time limits approved for your work. Include:
9682
9683- Approved target systems, hosts, and environments.
9684- Excluded systems, including production and unrelated infrastructure.
9685- Approved tools and connected services.
9686- Approved and prohibited actions.
9687- Approved start and end times and data-handling requirements.
9688- Vulnerability disclosure, patch approval, and maintainer coordination.
9689- Stop conditions and actions that require explicit human approval.
9690
9691Give the agent these approved boundaries as task context. Documentation alone doesn't enforce them: apply independent filesystem, network, identity, and tool controls to make unauthorized actions impossible whenever practical.
9692
9693Use Codex [permission profiles](https://learn.chatgpt.com/docs/permissions) to create a least-privilege boundary. Choose `:read-only` when the task doesn't require changes, or extend `:workspace` when the work requires workspace edits. For example:
9694
9695```toml
9696approval_policy = "on-request"
9697approvals_reviewer = "auto_review"
9698default_permissions = "cyber-lab"
9699
9700[permissions.cyber-lab]
9701description = "Limit security testing to the approved lab and workspace."
9702extends = ":workspace"
9703
9704[permissions.cyber-lab.filesystem]
9705glob_scan_max_depth = 3
9706
9707[permissions.cyber-lab.filesystem.":workspace_roots"]
9708"**/.env*" = "deny"
9709"**/*.pem" = "deny"
9710
9711[permissions.cyber-lab.network]
9712enabled = true
9713# Uncomment only for an approved host that resolves to a private address.
9714# allow_local_binding = true
9715
9716[permissions.cyber-lab.network.domains]
9717"lab.example.com" = "allow"
9718```
9719
9720Replace `lab.example.com` with an approved target. The bounded filesystem scan is designed to avoid searching the entire workspace on Linux, WSL, and Windows; increase the depth or use exact deny paths if sensitive files appear deeper. Don't combine permission profiles with legacy `sandbox_mode` settings; follow the [permission-profile configuration guidance](https://learn.chatgpt.com/docs/permissions#define-and-select-a-profile).
9721
9722If the approved lab host resolves to a private address, Codex blocks it by default even when the host is on the allowlist. Set `allow_local_binding = true` only for explicitly approved private-network work, keep the destination allowlist narrow, and review the [local and private network guidance](https://learn.chatgpt.com/docs/permissions#local-and-private-networks). You can also allowlist the exact approved private IP address.
9723
9724Block open-internet and production-network access by default. If external access is necessary, route it through an independently enforced gateway or proxy with narrow allowlists, request inspection, and logging. Apply the same restrictions to indirect connections through package managers, webhooks, URL-fetching services, redirects, cloud APIs, and connected tools. Load dependencies before the run or use dependencies that an administrator approves.
9725
9726#### Protect credentials and sensitive data
9727
9728Keep reusable API keys, cloud credentials, passwords, and service-account tokens out of prompts, repositories, environment variables, shared filesystems, and model-accessible logs. When authentication is required, use a separate broker or gateway to provide short-lived credentials scoped to the exact target and permitted action without exposing the credential to the model.
9729
9730Provide only the data required for the approved task. Remove unnecessary sensitive information, block access to cloud metadata and credential endpoints, and treat model-generated files as untrusted.
9731
9732Avoid `:danger-full-access` and `--yolo` for cybersecurity workflows. Full Access removes the enforceable sandbox boundary that automatic review depends on. Managed organizations can exclude `:danger-full-access` and `--yolo`, limit allowed approval policies, and require automatic review through [enterprise-managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).
9733
9734Before enabling **Full Access** for an approved security model, the ChatGPT desktop app shows a model-specific warning about dangerous actions. The warning recommends **Approve for me** instead and links to [reviewer-policy configuration](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration). The warning doesn't restore the sandbox boundary or override organization policy.
9735
9736Guardrails add policy-based review to a controlled cybersecurity workflow. They don't replace environment isolation, least-privilege permissions, clearly defined boundaries, monitoring, or human oversight.
9737
9738#### Review sensitive Codex actions
9739
9740[Auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review) routes eligible sandbox-boundary approval requests to a separate reviewer before the proposed action runs. The reviewer considers the proposed action, bounded task context, and applicable policy, then allows or denies the request. Organizations can customize that policy for their approved targets, prohibited actions, and required human-review conditions.
9741
9742Require explicit human approval for actions that affect production, external systems, sensitive data, privilege escalation, persistent access, or irreversible changes. Treat instructions embedded in websites, repositories, documents, and tool outputs as untrusted; they can't expand the authorized scope or override access controls.
9743
9744In the ChatGPT desktop app, selecting an approved Daybreak model automatically switches the permissions control to **Approve for me** when that mode is available for your account and allowed by organization policy. This also applies when you use the desktop app's `/model` command. If that mode isn't available, the current permission mode stays unchanged. Model selection never overrides managed organization requirements.
9745
9746For automatic review to run, keep all three controls in place:
9747
97481. Use an interactive approval policy such as `approval_policy = "on-request"`.
97492. Set `approvals_reviewer = "auto_review"`.
97503. Keep an enforceable sandbox or permission-profile boundary.
9751
9752Requests to a target on the network allowlist stay inside the network boundary and don't automatically trigger Auto-review. To review a sensitive command even when its destination is on the allowlist, create an explicit [command rule](https://learn.chatgpt.com/docs/agent-configuration/rules) under `~/.codex/rules/`:
9753
9754```python
9755prefix_rule(
9756 pattern = ["curl"],
9757 decision = "prompt",
9758 justification = "Review requests to the approved cybersecurity target.",
9759)
9760```
9761
9762Restart Codex after adding the rule. With `approvals_reviewer = "auto_review"`, matching commands go to the reviewer before execution. Add corresponding prompt rules for every sensitive command, or use `approval_mode = "prompt"` for individual [MCP tools](https://learn.chatgpt.com/docs/extend/mcp). Actions that require a person's decision still need explicit human approval.
9763
9764Auto-review doesn't inspect routine actions that are already permitted inside the sandbox. With `approval_policy = "never"` or Full Access, a sensitive action might not create a reviewable approval request. Automatic review can make mistakes and doesn't replace isolation, clearly defined boundaries, monitoring, or explicit human oversight.
9765
9766For a scoped policy and organization-wide enforcement, see [Configure an authorized cybersecurity workflow](https://learn.chatgpt.com/docs/sandboxing/auto-review#configure-an-authorized-cybersecurity-engagement).
9767
9768#### Monitor independently and fail closed
9769
9770Log model requests, tool calls, network activity, credential use, and security-relevant changes. Keep logs and monitoring systems outside the model-controlled environment. Alert on unauthorized targets, unexpected network requests, exposed credentials, policy changes, missing logs, and attempts to bypass safeguards.
9771
9772Keep policy enforcement, credential brokers, review systems, and emergency shutdown controls independent of the agent. Stop the workflow if an essential control or monitoring system fails.
9773
9774#### Add guardrails to custom agent workflows
9775
9776If you build with the Responses API, the Agents SDK, or another harness, add review at the tool-execution boundary. Check sensitive proposed actions against the approved systems, actions, and time limits before execution, route ambiguous or high-risk actions to a person, enforce independent filesystem and network restrictions, keep audit logs, and fail closed if the reviewer or policy is unavailable.
9777
9778Codex Auto-review doesn't automatically protect custom tools or external harnesses. Use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution) for the Agents SDK pattern and the [open-source reviewer policy](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md) as a reference.
9779
9780Codex product-side sandboxing and review are separate from [API cybersecurity checks](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity). API safeguards can return `cyber_policy` errors, and per-user `safety_identifier` values can help limit the impact of a safeguard action.
9781
9782#### Clean up and validate the results
9783
9784After the work ends, revoke temporary credentials, terminate background processes, remove persistent access, and destroy higher-risk environments. Verify that no callbacks, exposed artifacts, shared state, or cross-run access remain, and keep separate users, sessions, and evaluations isolated.
9785
9786Validate findings before acting on them, follow coordinated disclosure practices, and keep people accountable for remediation and changes.
9787
9788#### Before you start
9789
9790Confirm the approved systems and actions, appropriate model, isolated environment, least-privilege permissions, restricted network access, protected credentials, action review, independent monitoring, emergency stop, and cleanup plan. Model safeguards, isolation, scoped permissions, action review, monitoring, and human oversight are complementary; none should be the only control.
9791
9749### Sandbox9792### Sandbox
9750 9793
9751Source: [Sandbox](https://learn.chatgpt.com/docs/sandboxing.md)9794Source: [Sandbox](https://learn.chatgpt.com/docs/sandboxing.md)
10180 10223
10181- [Codex Security cloud FAQ](https://learn.chatgpt.com/docs/security/faq): Get answers about cloud scans, findings, privacy, and access.10224- [Codex Security cloud FAQ](https://learn.chatgpt.com/docs/security/faq): Get answers about cloud scans, findings, privacy, and access.
10182 10225
10183#### Safety10226#### Cyber safety
10184 10227
10185Review policy and safeguards for cybersecurity tasks.10228Choose approved models and configure safe engagements.
10186 10229
10187- [Cyber safety](https://learn.chatgpt.com/docs/cyber-safety): Understand how Codex handles security-sensitive requests.10230- [Models & Trusted Access](https://learn.chatgpt.com/docs/cyber-safety): Choose a cybersecurity model and request Trusted Access.
10231
10232- [Recommended configuration](https://learn.chatgpt.com/docs/cyber-safety/recommended-configuration): Isolate the environment, enforce scope, and review sensitive actions.
10188 10233
10189## Configuration, Authentication, and Models10234## Configuration, Authentication, and Models
10190 10235
10315| `hooks.` | `array` | | Matcher groups for hook events such as `PreToolUse`, `PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`, `SessionStart`, `SessionEnd`, `SubagentStart`, `SubagentStop`, `UserPromptSubmit`, or `Stop`. |10360| `hooks.` | `array` | | Matcher groups for hook events such as `PreToolUse`, `PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`, `SessionStart`, `SessionEnd`, `SubagentStart`, `SubagentStop`, `UserPromptSubmit`, or `Stop`. |
10316| `hooks.[].hooks` | `array` | | Hook handlers for a matcher group. Command hooks are currently supported; prompt and agent hook handlers are parsed but skipped. |10361| `hooks.[].hooks` | `array` | | Hook handlers for a matcher group. Command hooks are currently supported; prompt and agent hook handlers are parsed but skipped. |
10317| `hooks.[].hooks[].additionalContextLimit` | `integer` | | Approximate per-handler token threshold for saving oversized `additionalContext` to disk and showing the model a shorter preview. Defaults to `2500`; `0` passes the full context directly to the model. See [Large hook output](https://learn.chatgpt.com/docs/hooks#large-hook-output). |10362| `hooks.[].hooks[].additionalContextLimit` | `integer` | | Approximate per-handler token threshold for saving oversized `additionalContext` to disk and showing the model a shorter preview. Defaults to `2500`; `0` passes the full context directly to the model. See [Large hook output](https://learn.chatgpt.com/docs/hooks#large-hook-output). |
10363| `hooks.[].hooks[].async` | `boolean` | | Run a command hook in the background without delaying the triggering operation. Defaults to `false`; `SessionEnd` always runs synchronously. See [Run hooks in the background](https://learn.chatgpt.com/docs/hooks#run-hooks-in-the-background). |
10318| `hooks.[].hooks[].commandWindows` | `string` | | Windows-only command override for command hooks. The TOML alias `command_windows` is also accepted. |10364| `hooks.[].hooks[].commandWindows` | `string` | | Windows-only command override for command hooks. The TOML alias `command_windows` is also accepted. |
10319| `instructions` | `string` | | Reserved for future use; prefer `model_instructions_file` or `AGENTS.md`. |10365| `instructions` | `string` | | Reserved for future use; prefer `model_instructions_file` or `AGENTS.md`. |
10320| `log_dir` | `string (path)` | | Directory where Codex writes log files; defaults to `$CODEX_HOME/log`. Setting this explicitly also enables the opt-in plaintext TUI log, `codex-tui.log`, in that directory. |10366| `log_dir` | `string (path)` | | Directory where Codex writes log files; defaults to `$CODEX_HOME/log`. Setting this explicitly also enables the opt-in plaintext TUI log, `codex-tui.log`, in that directory. |
10590| `hooks.` | `array` | | Matcher groups for a hook event such as `PreToolUse`, `PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`, `SessionStart`, `SessionEnd`, `SubagentStart`, `SubagentStop`, `UserPromptSubmit`, or `Stop`. |10636| `hooks.` | `array` | | Matcher groups for a hook event such as `PreToolUse`, `PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`, `SessionStart`, `SessionEnd`, `SubagentStart`, `SubagentStop`, `UserPromptSubmit`, or `Stop`. |
10591| `hooks.[].hooks` | `array` | | Hook handlers for a matcher group. Command hooks are currently supported; prompt and agent hook handlers are parsed but skipped. |10637| `hooks.[].hooks` | `array` | | Hook handlers for a matcher group. Command hooks are currently supported; prompt and agent hook handlers are parsed but skipped. |
10592| `hooks.[].hooks[].additionalContextLimit` | `integer` | | Approximate per-handler token threshold for saving oversized `additionalContext` to disk and showing the model a shorter preview. Defaults to `2500`; `0` passes the full context directly to the model. See [Large hook output](https://learn.chatgpt.com/docs/hooks#large-hook-output). |10638| `hooks.[].hooks[].additionalContextLimit` | `integer` | | Approximate per-handler token threshold for saving oversized `additionalContext` to disk and showing the model a shorter preview. Defaults to `2500`; `0` passes the full context directly to the model. See [Large hook output](https://learn.chatgpt.com/docs/hooks#large-hook-output). |
10639| `hooks.[].hooks[].async` | `boolean` | | Run a command hook in the background without delaying the triggering operation. Defaults to `false`; `SessionEnd` always runs synchronously. See [Run hooks in the background](https://learn.chatgpt.com/docs/hooks#run-hooks-in-the-background). |
10593| `hooks.[].hooks[].commandWindows` | `string` | | Windows-only command override for command hooks. The TOML alias `command_windows` is also accepted. |10640| `hooks.[].hooks[].commandWindows` | `string` | | Windows-only command override for command hooks. The TOML alias `command_windows` is also accepted. |
10594| `hooks.managed_dir` | `string (absolute path)` | | Directory containing managed hook scripts on macOS and Linux. Codex validates that it is absolute and exists before loading managed hooks. |10641| `hooks.managed_dir` | `string (absolute path)` | | Directory containing managed hook scripts on macOS and Linux. Codex validates that it is absolute and exists before loading managed hooks. |
10595| `hooks.windows_managed_dir` | `string (absolute path)` | | Directory containing managed hook scripts on Windows. Codex validates that it is absolute and exists before loading managed hooks. |10642| `hooks.windows_managed_dir` | `string (absolute path)` | | Directory containing managed hook scripts on Windows. Codex validates that it is absolute and exists before loading managed hooks. |
21845 preview instead. See [Large hook output](#large-hook-output).21892 preview instead. See [Large hook output](#large-hook-output).
21846- `commandWindows` is an optional Windows-only command override. In TOML, use21893- `commandWindows` is an optional Windows-only command override. In TOML, use
21847 `command_windows` or `commandWindows`.21894 `command_windows` or `commandWindows`.
21848- The `async` option is parsed, but asynchronous command hooks aren't supported21895- Set `async` to `true` to [run a command hook in the
21849 yet.21896 background](#run-hooks-in-the-background).
21850- Only `type: "command"` handlers run today. `prompt` and `agent` handlers are21897- Only `type: "command"` handlers run today. `prompt` and `agent` handlers are
21851 parsed but skipped.21898 parsed but skipped.
21852- Commands run with the session `cwd` as their working directory.21899- Commands run with the session `cwd` as their working directory.
22132Because oversized output can be written to disk, avoid returning secrets or22179Because oversized output can be written to disk, avoid returning secrets or
22133other sensitive data in hook output.22180other sensitive data in hook output.
22134 22181
22182#### Run hooks in the background
22183
22184By default, Codex waits for a command hook to finish before continuing the
22185operation that triggered it. Set `async` to `true` to run a command hook in the
22186background while Codex continues.
22187
22188#### Configure a background hook
22189
22190Add `"async": true` to a command handler in `hooks.json`:
22191
22192```json
22193{
22194 "hooks": {
22195 "PostToolUse": [
22196 {
22197 "matcher": "Bash",
22198 "hooks": [
22199 {
22200 "type": "command",
22201 "command": "python3 ~/.codex/hooks/post_tool_use.py",
22202 "async": true,
22203 "timeout": 120
22204 }
22205 ]
22206 }
22207 ]
22208 }
22209}
22210```
22211
22212For an inline hook in `config.toml`, set `async = true`:
22213
22214```toml
22215[[hooks.PostToolUse]]
22216matcher = "Bash"
22217
22218[[hooks.PostToolUse.hooks]]
22219type = "command"
22220command = "python3 ~/.codex/hooks/post_tool_use.py"
22221async = true
22222timeout = 120
22223```
22224
22225Background hooks use the same input, matcher, trust review, timeout, and
22226[large-output handling](#large-hook-output) as synchronous command hooks. As
22227with other command hooks, `timeout` is measured in seconds and defaults to
22228`600`.
22229
22230#### How background hooks run
22231
22232When a background hook finishes, Codex delivers supported informational output
22233at the next safe point in the conversation:
22234
22235- If a turn is active, Codex waits for the current model request and tool calls
22236 to finish, then makes the output available to the next model request in that
22237 turn.
22238- If no turn is active, Codex waits until the next user turn. Finishing a
22239 background hook doesn't start a new turn.
22240
22241Use the same event-specific JSON output as a synchronous hook. Codex adds
22242`additionalContext` to the model's context and surfaces `systemMessage` as a
22243warning.
22244
22245Background hooks can't block, approve, rewrite, or otherwise control the
22246operation that triggered them. Use synchronous hooks for tool policies,
22247permission decisions, prompt rejection, or turn continuation.
22248
22249#### Limitations
22250
22251- Codex runs up to eight background hooks concurrently per session. Additional
22252 hooks wait until a running hook finishes.
22253- Each matching invocation runs independently, and background hooks can finish
22254 in a different order than they started.
22255- When the session ends, Codex cancels unfinished background hooks and discards
22256 output that hasn't been delivered.
22257- `SessionEnd` hooks always run synchronously.
22258
22135#### SessionStart22259#### SessionStart
22136 22260
22137`matcher` is applied to `source` for this event.22261`matcher` is applied to `source` for this event.
22198}22322}
22199```22323```
22200 22324
22201`SessionEnd` hooks are advisory. Their output won't steer Codex or keep the22325`SessionEnd` hooks always run synchronously, even when `async` is `true`. They
22202thread open. If a command times out or exits with an error, Codex reports it as22326are advisory, so their output won't steer Codex or keep the thread open. If a
22203a hook failure.22327command times out or exits with an error, Codex reports it as a hook failure.
22204 22328
22205#### SubagentStart22329#### SubagentStart
22206 22330
27643 27767
27644Use the import flow to bring instructions, settings, skills, plugins, projects,27768Use the import flow to bring instructions, settings, skills, plugins, projects,
27645and recent work from another agent into the ChatGPT desktop app or Codex CLI.27769and recent work from another agent into the ChatGPT desktop app or Codex CLI.
27646Codex CLI and the desktop app can import from **Claude Code**.27770The desktop app can import from supported agents, including **Claude Code** and
27771**Cursor**. Codex CLI can import from **Claude Code**.
27647 27772
27648The desktop app imports supported items directly and lets you finish setup for27773The desktop app imports supported items directly and lets you finish setup for
27649imported plugins or connections that need authorization.27774imported plugins or connections that need authorization. You can also keep
27775imported work in sync with automatic updates.
27650 27776
27651Importing doesn't change or delete your existing agent setup.27777Importing doesn't change or delete your existing agent setup.
27652 27778
276624. On **Select items to import**, choose what to bring over, then select **Continue**.277884. On **Select items to import**, choose what to bring over, then select **Continue**.
276635. After the import finishes, open an imported project or chat to continue working.277895. After the import finishes, open an imported project or chat to continue working.
27664 27790
27791#### Keep imported work in sync
27792
27793In the ChatGPT desktop app, open **Settings > Import** and turn on automatic
27794updates to keep imported work in sync with the original agent. You can also
27795review your import history from the same settings section.
27796
27665#### Import in Codex CLI27797#### Import in Codex CLI
27666 27798
276671. Start a local Codex CLI session and type `/import`.277991. Start a local Codex CLI session and type `/import`.
29323- `turn/completed` - `{ turn }` where `turn.status` is `completed`, `interrupted`, or `failed`; failures carry `{ error: { message, codexErrorInfo?, additionalDetails? } }`.29455- `turn/completed` - `{ turn }` where `turn.status` is `completed`, `interrupted`, or `failed`; failures carry `{ error: { message, codexErrorInfo?, additionalDetails? } }`.
29324- `turn/diff/updated` - `{ threadId, turnId, diff }` with the latest aggregated unified diff across every file change in the turn.29456- `turn/diff/updated` - `{ threadId, turnId, diff }` with the latest aggregated unified diff across every file change in the turn.
29325- `turn/plan/updated` - `{ turnId, explanation?, plan }` whenever the agent shares or changes its plan; each `plan` entry is `{ step, status }` with `status` in `pending`, `inProgress`, or `completed`.29457- `turn/plan/updated` - `{ turnId, explanation?, plan }` whenever the agent shares or changes its plan; each `plan` entry is `{ step, status }` with `status` in `pending`, `inProgress`, or `completed`.
29326- `hook/started` and `hook/completed` - `{ threadId, turnId?, run }` when a lifecycle hook starts and when its final run summary is available.29458- `hook/started` and `hook/completed` - `{ threadId, turnId?, run }` when a synchronous lifecycle hook starts and when its final run summary is available. These notifications aren't emitted for asynchronous hooks.
29327- `model/safetyBuffering/updated` - `{ threadId, turnId, model, useCases, reasons, showBufferingUi, fasterModel }` when a response enters transient safety buffering.29459- `model/safetyBuffering/updated` - `{ threadId, turnId, model, useCases, reasons, showBufferingUi, fasterModel }` when a response enters transient safety buffering.
29328- `model/rerouted` - `{ threadId, turnId, fromModel, toModel, reason }` when the service routes a request to another model.29460- `model/rerouted` - `{ threadId, turnId, fromModel, toModel, reason }` when the service routes a request to another model.
29329- `model/verification` - `{ threadId, turnId, verifications }` when the service requires additional account verification.29461- `model/verification` - `{ threadId, turnId, verifications }` when the service requires additional account verification.
30563 30695
30564Published SDK builds automatically use their pinned runtime. Pass `CodexConfig(codex_bin=...)` only when you intentionally want to run against a specific local Codex executable.30696Published SDK builds automatically use their pinned runtime. Pass `CodexConfig(codex_bin=...)` only when you intentionally want to run against a specific local Codex executable.
30565 30697
30566While the Python SDK is in beta, `pip install openai-codex` selects the latest30698The Python SDK is available as a stable release. `pip install openai-codex`
30567published beta build. After a stable SDK release exists, use30699installs the latest stable release. Use `pip install --pre openai-codex` to opt
30568`pip install --pre openai-codex` to opt in to newer prerelease builds.30700in to newer prerelease builds.
30569 30701
30570#### Usage30702#### Usage
30571 30703
