Codex adds a Microsoft Execution Containers sandbox on compatible Windows 11 devices, enforcing file and network permissions without administrator setup; CLI users must opt in.