A merged commit in Codex’s repository does one focused, important thing: it preserves parent sandbox enforcement for memory consolidation. If you run Codex on untrusted or semi-trusted tasks, this is the kind of fix worth knowing about.
The shape of the bug
Memory consolidation is the process where an agent summarizes and stores what it learned so a later session can pick up where it left off. The commit implies that, during that consolidation step, the parent session’s sandbox boundaries were not being carried through to the work doing the consolidation. In practice that means a sub-process spawned to tidy up memory could operate outside the restrictions you set on the parent — wider file access, weaker network rules, looser execution scope.
The subtlety is that the dangerous moment is also the invisible one. Consolidation runs as housekeeping, after the real task is done, when nobody is watching the session. A boundary that holds during active work but drops during cleanup is exactly the kind of gap that survives review.
Why it matters
Sandbox enforcement is the control that keeps an agent from reading files it should not, or writing where it must not. When a background housekeeping task silently drops those boundaries, you lose the guarantee at exactly the moment you are not watching. Memory consolidation is the kind of thing that runs quietly after the fact, so a boundary escape there is hard to notice and easy to exploit.
The principle at stake is least privilege: a child task should never be more capable than the session that spawned it. When the child inherits more privilege than the parent — even briefly, even for “cleanup” — the sandbox stops being a boundary and becomes a suggestion.
The fix
The change keeps the parent’s sandbox policy in force during consolidation. That is the correct default: a child task should never be more privileged than the session that spawned it. The PR is already closed/merged, which suggests the maintainers treated it as a real hardening gap rather than a nice-to-have.
The broader pattern
This isn’t isolated to Codex. Sandbox inheritance is a recurring weak spot across agents: a background task, subagent, or post-task step quietly runs with looser rules than the interactive session. If your threat model includes running agents against repos you do not fully trust, audit those boundary transitions specifically — they’re where the escapes hide.
How to check your own agents
You don’t have to wait for an upstream fix to find this gap. A quick local test:
- Set a tight boundary — e.g. deny network egress or restrict the working directory in the parent session config.
- Trigger a background step — let the agent consolidate memory, run a subagent, or fire a post-task hook.
- Probe from inside — have that step attempt the denied action (a network call, a write outside the allowed path).
- Compare results — if the step succeeds where the interactive session would fail, the child inherited more privilege than the parent.
That test takes minutes and catches the whole class of inheritance bugs, not just this one Codex commit. Make it part of your setup checklist whenever you wire an agent into a repo you don’t fully control.
If your threat model includes running Codex against repos you do not fully trust, track this class of fix. It is the same territory the Hermes credential-guards writeup covers from the other side — provider isolation and least privilege. And the local-first architecture piece is worth a read if you want to be the one auditing these boundaries instead of hoping upstream got them right.
For the same failure class in other agents, see beware: coding agent sandbox leaks its own credentials and beware: Claude Code disallowedTools not inherited by subagents — both show what happens when a child process doesn’t inherit the parent’s restrictions.
Related articles
- Coding Agents in 2026: Three Hard Lessons HN Developers Learned the Expensive Way
- Your AI Agents Config Directory Is Now the Most Dangerous Place on Your Machine
- What Developers Think About Coding Agents — The Skill Atrophy Crisis, Interface Wars, and Trust Divide From 500 HN Comments
Ever wonder if Claude gives a better answer than GPT for a specific coding problem? aiFiesta lets you compare 9+ premium models side-by-side in one chat. No more juggling tabs.