Codex 0.143 Alpha Makes Agent Safety a Runtime Proof, Not a Promise
Codex 0.143 alpha is not a flashy release. Good. The useful story this morning is not a new model name or a prettier terminal pane; it is OpenAI tightening the places where coding agents usually lie to themselves: sandbox permissions, PowerShell command safety, and remote MCP path handling.
That sounds like plumbing because it is plumbing. But plumbing is where agent trust either holds or floods the basement. The difference between a coding assistant that can safely automate work and one that needs a human hovering over every shell command is rarely a grand alignment breakthrough. It is whether the runtime can prove that “safe enough to auto-run” actually means something on Windows, inside a sandbox, through an MCP server, and across machines that disagree about what an absolute path looks like.
OpenAI published Codex rust-v0.143.0-alpha.5 at 08:23 UTC on June 23. The release note itself is nearly empty, but the compare trail is not. Against rust-v0.142.0, this alpha line is 30 commits ahead, touches 223 files, and shows 6,274 additions against 2,229 deletions in the returned diff. The interesting commits cluster around a single theme: stop letting the host, shell parser, or tool bridge infer authority it cannot actually verify.
Safety is becoming a proof obligation
The cleanest example is PR #24092, merged at 03:09 UTC. It fixes a class of Windows PowerShell approval bugs that should make every agent-builder slightly uncomfortable. Codex had a safe-command classifier that lowered EndBlock.Statements into argv-like command words, checked those words against a safelist, and then decided whether a command could be auto-approved. That is reasonable until you remember PowerShell can execute code outside the statement list: parameter defaults, dynamic parameter blocks, named blocks, using preambles, and top-level trap handlers can all carry behavior the lowered command words do not represent.
The fix is not to pretend the classifier got smarter than PowerShell. It is to fail closed. Codex now returns unsupported for parameter, dynamic-parameter, begin, process, and clean blocks; for using module and using assembly preambles; and for non-empty EndBlock.Traps. In Codex terms, unsupported means the runtime cannot prove the command is safe, so it routes through the normal approval path instead of silently treating the script as read-only.
That is the posture production agents need. A parser that sometimes says “I don’t know” is better than one that auto-approves because the dangerous part lived in a region it did not inspect. For teams evaluating coding agents, this is not trivia. If your approval model depends on command classification, your test suite should include shell-specific edge cases: PowerShell traps, parameter defaults, bash process substitution, shell aliases, environment-variable expansion, and anything else your “safe command” detector is tempted to flatten into comforting strings.
The sandbox change makes the same argument at a different boundary. PR #29358, merged at 08:17 UTC, lets codex sandbox consume MCP sandbox-state metadata. The important detail is that the payload must include a permissionProfile; Codex no longer gets to fall back to ambient permissions if explicit sandbox state is missing. External sandbox state is also treated conservatively as read-only, while opaque forwarders can add runtime read roots and disable direct network access without requiring Codex to decode every part of the payload.
That is exactly the right instinct. MCP is where an agent inherits tools, filesystems, network reachability, and organizational policy from the developer environment. If the sandbox launch path can shrug and borrow ambient authority when metadata is malformed, the sandbox boundary becomes a suggestion. Requiring explicit permission state is less convenient, but convenience is usually how agent runtimes accidentally acquire powers nobody meant to grant.
Remote tools should not inherit the host’s filesystem assumptions
The third piece is PR #29493, merged at 01:33 UTC, which fixes remote stdio MCP current-working-directory handling. The bug is easy to understand and easy to miss: a Windows cwd such as C:\Users\openai\share is absolute for the executor, but a POSIX orchestrator may reject it because it validates the path using host rules. Codex now deserializes MCP cwd values as LegacyAppPathString, interprets that spelling as host-native only for local launches, converts it to PathUri at executor launch, and skips host filesystem and command-resolution checks for remote stdio in codex doctor.
That split matters. The environment that owns the filesystem should validate the filesystem. The host should not reject a Windows executor path because it does not look absolute on Linux; it also should not pretend every foreign path is locally meaningful. Remote execution forces agent runtimes to carry path provenance, not just path strings.
OpenAI’s MCP documentation already makes the broader threat model visible: Codex supports STDIO servers, streamable HTTP servers, bearer-token auth, OAuth via codex mcp login, server instructions, trusted per-project config, cwd, remote stdio via experimental_environment = "remote", tool allow/deny lists, and default approval modes. Once that much power travels through MCP, cwd semantics are not configuration trivia. They decide which files a tool sees and where commands execute.
PR #29493 came with serious validation: 408 passing tests for path-uri, config, MCP, and rmcp-client packages; 372 passing tests for CLI and rmcp-client; cargo check --workspace --tests; and a broader just test run reporting 11,311 passing tests with 43 unrelated environment or timing failures. PR #29358 listed focused sandbox and MCP tests plus formatting. PR #24092 added 113 lines across three files and targeted the exact AST edge class. None of that guarantees perfection, but it is the right kind of evidence: tests around the boundary, not a blog post saying “secure by design” and hoping nobody asks what PowerShell did.
The practical takeaway is blunt: if you operate coding agents, build a trust-boundary regression suite. Run safe-looking PowerShell that hides behavior in parameter blocks and traps. Launch remote MCP servers with executor-native absolute paths that are foreign to the orchestrator OS. Verify sandbox launches fail when permission profiles are absent rather than inheriting ambient authority. Confirm opaque forwarded sandbox state is treated conservatively. These tests are cheaper than explaining why an agent ran a command it had confidently misclassified.
The larger trend is that agent security is leaving the slogan phase. “Human in the loop” is not enough if the loop is triggered by a parser that cannot see the executable code. “Sandboxed” is not enough if missing metadata quietly falls back to local permissions. “Remote MCP” is not enough if the host validates executor paths as if the world is one filesystem.
Codex 0.143 alpha is a small release in public packaging and a useful one in engineering posture. The agent should be allowed to move fast only where the runtime can explain the authority it is using. Everywhere else, it should stop, ask, and leave a trail. That is not anti-autonomy. That is how autonomy survives contact with real developer machines.
Sources: OpenAI Codex release rust-v0.143.0-alpha.5, PR #29358, PR #24092, PR #29493, OpenAI Codex MCP docs, Microsoft PowerShell language specification