---
title: 'In the News: September 22, 2026 (Extra 4)'
description: 'Codex CLI 0.156.0 closes three sandbox gaps and now requires bubblewrap for filesystem-restricted commands on Linux.'
canonical_url: 'https://darkfactory.dev/news/2026-09-22-extra-4'
markdown_url: 'https://darkfactory.dev/news/2026-09-22-extra-4.md'
collection: news
date_published: '2026-09-22T23:06:00-04:00'
date_modified: '2026-09-22T23:06:00-04:00'
---

# In the News: September 22, 2026 (Extra 4)


OpenAI shipped Codex CLI 0.156.0 on September 22. Most of the release is interface work. Three fixes tighten the sandbox on Windows, Linux and macOS, and one of them changes what a Linux machine needs before Codex will run filesystem-restricted commands.

## 1. Codex CLI 0.156.0 closes sandbox gaps on three platforms

**[Codex changelog: Codex CLI 0.156.0](https://developers.openai.com/codex/changelog)** · OpenAI · developers.openai.com, September 22, 2026

The release notes give the sandbox work one line: the release closes "sandbox isolation gaps involving inbound Windows connections, privileged Linux/macOS sockets, and writes through read-only macOS file handles." The linked pull requests say what each gap was. On Windows, the offline sandbox's firewall block "covered only outbound traffic"; [#44639](https://github.com/openai/codex/pull/44639) adds a matching inbound block. On macOS, two file-control operations "can mutate files through read-only descriptors, bypassing `file-write*` and `file-ioctl` restrictions"; [#46500](https://github.com/openai/codex/pull/46500) denies both whenever the policy lacks full disk write access. [#45984](https://github.com/openai/codex/pull/45984) stops commands under filesystem restrictions from reaching the privileged app-server's Unix sockets, including when network access or socket allowlists grant broader access. Each pull request describes regression tests added with the fix. GitHub shows the release published at 19:51 UTC.

The socket fix comes with a configuration change. Per #45984, Codex now requires bubblewrap for filesystem-restricted execution on Linux, and "Users with `features.use_legacy_landlock` enabled must disable it for these policies." The same release also turns worktree support on by default and adds a `/usage` dashboard showing token totals and plugin and skill activity.

**Why it matters:** OpenAI's own pull requests say that before this release, a macOS command under a read-only or workspace-write policy could still modify files through two operations, and the Windows offline sandbox's firewall rule did not cover inbound traffic. If you run Codex unattended under those policies, upgrade. On Linux, confirm bubblewrap is available and legacy Landlock is off, because this release makes the first a requirement and the second incompatible with restricted policies.