TL;DRThree layers are enough for a personal baseline: the sandbox layer (sane defaults plus tiered autonomy), the secrets layer (physically isolate sensitive files, respect .gitignore), the data layer (know what gets sent out). Ten checks, ten minutes to run through them, covering the highest-frequency incident points in community security threads.
Sources SOURCES
Distilled from public community discussions. This page only breaks them down and verifies — it never reposts the original; opinions belong to their authors.
Facts FACTS
Check these claims against the listed sources. For allowance mechanics, first-party account displays outrank community summaries.
- The default sandbox (workspace-write, implemented by Seatbelt on macOS) restricts the write surface; --dangerously-bypass-approvals-and-sandbox disables sandbox and approvals at the same time and is the lowest-security tier.
- Confirmed cases show the agent may seek out and execute workarounds inside restricted environments (the sudo case, HN 664 pts) — the security boundary has to come from the sandbox, not from instructions behaving themselves.
- In July 2026, OpenAI brought encrypted transport to subagent prompts (HN 425 pts) — evidence that community concern over the agent communication path is a live, real issue.
Concepts CONCEPTS
Not everything said in a community thread is a fact — each concept carries its nature label. Read the label first.
A sane split for personal security: the sandbox layer governs 'what it can touch,' the secrets layer governs 'what it can see,' the data layer governs 'what leaves the machine.' The layers are independent — find the one you are missing and patch exactly that one. The layering also keeps audits fast: an incident belongs to exactly one layer, so you know which questions to ask.
The bad habit community security threads keep naming: defaulting to full bypass so the confirmation popups go away. The right way to buy back friction is per-task-class approval tiers, not switching all protection off with one flag. Every popup you silence is a checkpoint you no longer have; the durable fix for popup fatigue is making the tasks themselves more mechanical.
Step-by-step SOP STEP BY STEP
- 01Sandbox layer: confirm the default tier
Check that your daily config carries no global full-bypass. Full bypass gets switched on only for rare one-off tasks, temporarily, and off again afterward. Check the config you actually run, not the one you think you run — defaults drift.
- 02Sandbox layer: tier the approvals
Mechanical, safe tasks run on a low-friction tier; anything touching deletions, the network, or configuration keeps per-action confirmation. The boundary does not need to be clever; 'reads and writes inside this repo' vs 'everything else' already catches most cases.
- 03Secrets layer: physical isolation
No .env files, SSH keys, or cloud credentials inside the working directory. They live outside the repo — or at minimum under .gitignore, and never read into task context. Outside the working directory is the only boundary an agent reliably respects; ignore lists are a second line of defense, not the first.
- 04Secrets layer: history scan
Comb the repo history for keys that were ever committed. Found one? Revoke and rotate immediately — worth doing with or without Codex in the picture. Scanning tooling exists for every major platform, so there is no excuse to skip this one.
- 05Data layer: egress awareness
Make the red lines explicit, personal or team: customer data, production credentials, and third-party confidential code never enter task context. Write the list down — unwritten red lines get renegotiated one convenient exception at a time.
- 06Data layer: logs and caches
Know where local logs and session records live, and fold them into routine cleanup (the June 2026 log-writing incident is the standing reminder). Session transcripts can carry fragments of everything the agent read; they deserve the same treatment as the files themselves.
Keep reading NEXT
Want today's verdict? Back to the live radar.