A way to exclude sensitive files issue still open for OpenAI Codex

https://github.com/openai/codex/issues/2847

by pikseladam • 25 days ago

227 143 25 days ago

github.com

pikseladam• 25 days ago

it has been a year and still it is not resolved

pamcake3• 24 days ago

It's not their problem to solve. Don't give it access to sensitive files on the first place.

pohl• 24 days ago

This should be an open standard like AGENTS.md or skills. What do other harnesses do?

ampersandwhich• 24 days ago

I believe JetBrains products like Junie use the neutral term .aiignore for this funtionality.

TheDong3• 24 days ago

You can do this now: change the file permissions such that the user you run codex as can't read them, or run codex in a container without those files mounted.

If you don't do that, the agent will be able to incidentally upload them. What if the model runs "rg foo", and one of those files contains the string "foo"? It uploads the tool output, which includes the file contents.

And so, the only solution is to make it so the codex process is unable to access those files, hence using a container, or unix permissions, or deleting the files. Which you can already do.

I imagine this isn't resolved primarily because people expect it to apply to bash tool use, not just the "read" and "edit" tools, and people also expect those files to still be accessible i.e. if the agent invokes "make", which makes it impossible to solve perfectly.

FergusArgyll• 24 days ago

Yes, this was solved decades ago. How do you stop a human from reading one of your files?

  chmod 600

re-thc• 24 days ago

How do you stop a human from reading one of your files?

Call the police!

lelandfe3• 24 days ago

Just be aware that AI agents will explore alternate means of accessing said files: https://news.ycombinator.com/item?id=48348578

cowsandmilk2• 24 days ago

If you’re already running codex as a different user to limit its file permissions, why would you add it to the docker group?

amelius3• 24 days ago

Yes. Any sane IT department would not allow external AI services, only local ones. It is just too easy for your company's data to end up on the wrong servers. If not through faulty file permissions, then through employees who simply post company ideas.

martylamb2• 24 days ago

Yes. I found this quickly after wrapping codex in a launcher that uses bubblewrap to exclude certain files and directories based on a config file at the project root. My best solution so far is to also include instructions for the agent that explain that it is not allowed to see certain files, and that their inaccessibility is not an error, and that it must not attempt to access them through other means (e.g. via git history, etc.).

This has been a major improvement, but it's not foolproof.

nicce• 24 days ago

I imagine this isn't resolved primarily because people expect it to apply to bash tool use, not just the "read" and "edit" tools, and people also expect those files to still be accessible i.e. if the agent invokes "make", which makes it impossible to solve perfectly.

Also, why would they add a feature to prevent data collection, if the data makes the company even more valuable and you might even get good deals from the current government if you provide the access for this data?

cowsandmilk2• 24 days ago

100% this. The idea that Codex should enforce this is putting the security boundary at the wrong layer. If you don’t want codes to access something, make it so it doesn’t have access.

londons_explore• 24 days ago

I could imagine perhaps some system which rather than denying access might instead replace the key material from your .env key with "** redacted. This key material can be used via make, but can never be exfoltrated directly **" whenever that key is seen heading out towards the network...

MattDamonSpace• 24 days ago

Not sure I agree?

It’s not like gitignore should be independent from git

jgalt212• 24 days ago

I'm a fan of belt and suspenders.

embedding-shape• 24 days ago

The Codex bug tracker is a great insight into how wide the knowledge gap seem to be between users. The issue where people ask them to add back /undo or whatever it is instead of just learning to use git, probably reached 100 comments at least by now. People seemingly don't really understand the computers they use on a daily basis, and refuse to learn too.

throwatdem123113• 24 days ago

You expect Joe Blow vibe coder running Codex on his Dell to understand this?

kstenerud5• 24 days ago

If you're not sandboxing your agent, everything on your computer is waiting to be exposed.

Assuming that file permissions will save you is naively dangerous.

nativeit• 24 days ago

It seems insane to me that so many people are OK with this. Why is it necessary for an agent to upload every bit of data it sees to OpenAI at all? Particularly if my agents can’t remember anything beyond a single session, why should the data exist permanently anywhere but in its original location?

efxhoy• 24 days ago

How could an agent bypass file permissions?

SubiculumCode3• 24 days ago

What is your sandbox approach? Any good guides? Something about asking a LLM for advice on how to sandbox LLMs.....

jrvarela56• 24 days ago

Sandboxing is a solved problem, there are dozens of providers of firecracker instances to run your agent in.

The problem to be solved is how do you define task-specific least privilege versions of your coding agent.

sheremetyev• 24 days ago

I'm running Codex/Claude in native macOS sandbox with access just to the project folder (plus read-only access to Git repo), and expand to other folders if necessary - https://github.com/sheremetyev/sandfence

niyikiza• 24 days ago

We've been using Tenuo which for task-scoped authorization.

Its integration for Claude Code: https://github.com/tenuo-ai/claude-governance

chriddyp• 24 days ago

While this is true, there is also a layer in the harness between the output of _any_ tool output (eg stdout or hand-rolled tools) and the LLM. A tool could read the file but then the agentic harness could redact the output before returning it back to the llm if any of the contents matched the file contents. We do something similar in Plotly Studio where we check the entropy of strings in the user input and flag & redact any high entropy strings to the user as “potential credentials” thay the user might have inadvertently copied and pasted into the prompt before sending to the llm.

There are ways around this - the llm can always be clever by invoking tools to read the file contents in a different way than the direct file contents - but this is all to say that the agentic harness layer _does_ allow for deterministic logic in between tool output and the LLM requests.

quotemstr4• 24 days ago

You can do this now: change the file permissions such that the user you run codex as can't read them, or run codex in a container without those files mounted.

That's quite inconvenient. I want to run my coding agent in a restricted version of my regular user context, not something that drives like a separate machine.

What if the model runs "rg foo", and one of those files contains the string "foo"? It uploads the tool output, which includes the file contents.

You have codex run rg in the sandbox, and the sandbox can't read foo. Why is this model so difficult to understand? Codex already runs a variety of commands under a bwrap/seatbelt/etc. sandbox. I've merely extended Codex to run everything in a sandbox. Escalation isn't a matter of whether to run a command in a sandbox or not: it's a matter of which sandbox policy to apply to whatever it is the model asked to do.

the only solution is to make it so the codex process is unable to access those files

That's not true. Restrictions need apply only to the tools the model runs, not the Codex process itself. You can always insert a process-and-sandbox boundary between the harness and its tools. Codex inserts this boundary most of the time anyway. I've extended my Codex to do it all the time, even for things like the read-a-file tool.

Works fine.

I imagine this isn't resolved primarily because people expect it to apply to bash tool use,

Yeah? Applying it to the shell tool [1] is trivial. It's actually harder to apply the sandbox to non-shell tools. It just isn't hard conceptually: you define a sandbox policy, writing down what's allowed and not, and just filter everything the model does through this policy via OS-level lightweight sandboxing tools.

Seriously. It's not that hard. And you don't have to sandbox the Codex process itself. I honestly have no idea why people think it's necessary to do so. The model has no ability to make Codex-the-POSIX-process do arbitrary things.

[1] I refuse to call it the "bash tool" when most users are running zsh in it. Name things appropriately.

wavemode• 24 days ago

people also expect those files to still be accessible i.e. if the agent invokes "make", which makes it impossible to solve perfectly

You could always use setuid to allow the agent to run designated commands whose operation depends on the files, without the agent itself being able to access the files.

planb• 24 days ago

Sound like snake oil. How would this work? The app that the agent is developing needs access to the file, so access to it cannot be blocked. Just because read_file can not access it (I think current harnesses prevent reading .env files already), does not mean the contents will never be seen by the model.

petcat• 24 days ago

Hopefully they never actually implement this pointless feature because it will only give people a false sense of security given the unpredictable nature of LLMs. How could something like this even be enforced?

People just need to learn how to use the tools their system already provides them. i.e., chmod

wodenokoto• 24 days ago

The whole point of using an agent is that I don't want to learn everything. I fully expected the harness to read the .agentignore file and do what is needed to hide it from the LLM.

But apparently, even if implemented, that's not how it works!

KHRZ• 24 days ago

How would it prevent an agent from writing a script that discovers the secret file? It's not magic.

quotemstr4• 24 days ago

Hopefully they never actually implement this pointless feature because it will only give people a false sense of security given the unpredictable nature of LLMs. How could something like this even be enforced?

You run everything the model wants to do inside an OS-enforced sandbox of the sort browsers have used for decades to isolate tabs. It's already implemented and works fine. Codex just needs a few minor tweaks to make it apply its already-implemented sandboxing policy to a few situations it misses today.

People just need to learn how to use the tools their system already provides them. i.e., chmod

I'm not running my agent as a separate POSIX user. Fortunately, my OS provides all the tools I need to free my having to do so.

I love when I do something in a few hours and people later call it impossible.

kstenerud5• 24 days ago

.agentsignore is NOT a security tool.

It's a good idea as a hint to agents about what files it should ignore (because they'd be of no value and only chew up tokens).

However, using it to prevent exposure of secrets would be a BIG mistake. There's simply no way to guarantee that an agent will ignore things in the ignore file. And even a harness-enforced restriction would still be in-process, which a rogue agent could trivially compromise. For security, use a sandbox. Nothing else will do.

I do AI sandboxes (FOSS, free forever, no rug pull): https://github.com/kstenerud/yoloai

agentdev001• 24 days ago

Sounds like user error to me. Codex gives an llm a tool to allow it to use shell in the context of the host and user in which it is running. If a resource is sensitive, and accessible in that context, then the user is doing something wrong. Would you change your practices if you treated your coding agent as an untrusted human ssh'd under the identity you use for it?

In any case. There are solutions in the comments on the issue, as well as this hn thread.

cowpig• 24 days ago

I don't think we should ask the agent runtime to police itself.

I contributed to a tool for this problem that is lower-friction than traditional sandboxing:

greywall.io

But you should use something to contain an agent runtime. The idea that people run things like codex on their machines with regular user permissions is baffling to me.

ZiiS• 24 days ago

However clever/stupid you believe LLMs are they are extremely capable of working around these sorts of restrictions. The ask is for .env files for whatever code you are writing so if the code it writes dosn't have access (i.e. filesystem/container) what is the point, if the code under development reads the env how dose codex debug it without accedentally reading the values from memory? Adding a security setting that dosn't work is much worse then not having one.

bob10292• 24 days ago

The only thing close to a guarantee is to give the agent exclusive access to a clean VM with precisely the information and permissions you want it to have.

I've been looking into a "workspace" concept that involves an entire cloud VM being spun up as part of an agent conversation such that code changes can be iterated without touching the user's local machine or other trusted contexts. All the agent's tools only have effect when supplied with a specific workspace guid. CLI tools like git are not authorized to talk to the remotes in this arrangement. The machine is initialized with a clone and no way to talk to origin. There are dedicated methods in the harness that can reach into the VM and pull out a change set for deterministic PR generation in the secure contexts (e.g. when the agent calls "ReadyForReview" or similar).

TZubiri4• 24 days ago

Sounds overkill, how about giving the agent its own user?

cozzyd• 24 days ago

That's what I do in part because I went it to use the same system libraries etc. installed on my laptop, but I worry it will try to use privesc exploits...

bob10292• 24 days ago

It's really not overkill if you have good tools to work with. Hyper-V is quite capable of providing ephemeral workspaces on timescales measured in minutes. Especially with nested virtualization. One big machine with fast local disks can provide very short cold start times for a golden image stored on the same.

binsquare3• 24 days ago

I made a lightweight vm specifically for this use case: https://github.com/smol-machines/smolvm

Sanzig2• 24 days ago

Thanks so much for building smolvm! I liked it so much that I vibe coded a little bash wrapper around it to handle creating ephemeral VMs for Pi: https://github.com/neuroblaze/smol-pi

Consists of two scripts, one to build an OCI image (customizable by editing the Dockerfile that comes with it) and another to handle smolvm invocation. The invocation script mounts the current working directory under /workspace in the VM and the user's ~/.pi directory under /root/pi, and handles any other setup (eg: I have some convenience flags set up to specify a block all/block local/block internet/allow all for network access).

One issue I ran into, it doesn't seem like smolvm cleans up disk images from ephemeral VMs, so my script has to do that itself. Is this a known bug or intended behaviour?

hoppp3• 24 days ago

Do not store secrets in the repository in files, but inject them during runtime. Then the agents have no way to access them.

tiew9Vii• 24 days ago

A lot of people have secrets/config files in the projects working directory but ignored by git i.e. `.env.local`

So they're following best practice, not committing secrets but agents running locally can still see them even if sandboxing to the working directory.

I've taken to storing configs using XDG_CONFIG_HOME and have the app auto resolve them by convention or take a cli arg to specify the config path. All secrets are in files, not env vars.

That way when using sandboxing the agent can never see the configs or secrets as outside the working directory.

hoppp3• 24 days ago

Sounds like a good way to do it.

Makes me think of docker secret where the secrets are exposed as files and accessable only from inside the container.

If the development environment uses docker then thats a solution too I guess

Lucasoato• 24 days ago

There should be a standard around .agentignore file similarly to what happens with .gitignore file. Of course this could still be workarounded by agent bash command tools, but at least basic operations like reading and so on should be checked and prevented.

mbid2• 24 days ago

I recently got the tool I use to orchestrate agents in (remote/secure) devcontainers open-sourced at work to solve this properly: https://github.com/nvidia/rumpelpod

As others here have pointed out, it's exceedingly unlikely that a blocklist like proposed in the issue would ever be complete. You shouldn't allow agents direct yolo-access to your machine if it has sensitive data.

Codex works particularly well as a remote agent harness because of its client-server architecture: The server component runs in the container, which might be remote, while the client runs locally. So, in contrast to e.g. the claude cli where the frontend also runs remotely, there's no lag when you write/edit prompts.

jofzar• 24 days ago

Neat tool! Will have to check it out

Edit: would love a couple of pictures/video of how you use it. I kind of get the idea, but it seems like more hassle then it would be worth?

Your comment of codex makes it seem like I might be missing something tho.

mbid2• 24 days ago

Yeah I should add a video to the README.

Have you tried running `rumpel codex foo123` in one of your repositories, asking it to commit something, then `rumpel merge foo123` to get the changes back to your local checkout? Use a different terminal for the merge command, or detach from the codex session with `ctrl-a d`. You can also look at the commit first with `rumpel review foo123`, or get a shell inside the agent environment via `rumpel enter foo123`.

noveltyaccount• 24 days ago

I agree a block list won't work. And unix file permissions may not be enough; I once saw Codex 5.4 use docker to execute a command as root since it couldn't run sudo. Running in a container may be the only solution:

sudo needs an interactive password here, so I'll use Docker itself to prepare the bind-mount directory as root and hand ownership back to UID/GID 1000. That keeps the compose file's non-root runtime intact.
Ran `docker run --rm -v /shares:/shares alpine:3.20 sh -c 'mkdir -p /shares/local-llm/models && chown 1000:1000 /shar...`

quotemstr4• 24 days ago

Huh? Blocking sudo works just fine.

I don't know why everyone is acting like sandboxing tool uses is contrary to the laws of God and man and therefore we must adopt devcontainers and VMs and such to run agents.

... Sandboxes work JUST FINE. Seatbelt on macOS is okay. Namespaces/seccomp/etc. work on Linux even better. We already have all the technology we need to do the isolation people are talking about here, and Codex in particular has 99% of the code needed to solve the bug TFA talks about. I have a local patch that solves 100% of it.

      >_ OpenAI Codex (v0.0.0)                     
                                                   
      model:     gpt-5.5 xhigh   /model to change  
      directory: ...

      Ran sudo whoami
        sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
        sudo: If sudo is running in a container, you may need to adjust the container configuration to
        disable the flag.

mixedbit• 24 days ago

I work on a Linux sandbox that makes it easy to hide sensitive files from AI agents while keeping the files they need accessible. Check it out: https://github.com/wrr/drop

edg50002• 24 days ago

Bind mounts can work fine. Setting them up does require root though. Easiest would be if the harness offered to enable containment. Awkwardly, it would require root.

ptspts• 24 days ago

In fact, it's possible to set up bind mounts without root on a modern Linux system, using a user namespace and a mount namespace.

apitman• 24 days ago

podman is my favorite tool for this.

edg50002• 24 days ago

You also need setuid, that's were I hit the root requirement, the bind mount itself can indeed be created.

nikhilsimha• 24 days ago

Files that codex and any other coding agent has access to, should be opt-in NOT opt-out. I think codex is not the right layer to solve this if you want a sane(one-click) UX. We built our own internal sandboxing-terminal around claude and codex. Where a user-configured base-folder with low-risk code and creds is COPIED into the sandbox BEFORE new session creation. There were many other UX related reasons to build our own terminal. Can share more if anyone is interested.

schipperai• 24 days ago

Do I understand correctly that you scope least-privilege creds/tokens and pass those to the sandbox? I'd be curious to learn more

kardos• 24 days ago

A solution to this is apptainer: you configure it to not see any of the host files by default, and mount the repo you want to work on at runtime.

TZubiri4• 24 days ago

Question, out of curiosity, do you know how User and Permissions work?

TZubiri4• 24 days ago

Out of scope, learn cybersecurity. A simple concept such as users and permissions solves this problem.

Regardless of what technique you use, you need a deputy, you wouldn't ask an employee not to go into the vault, right? You would lock the vault. Well you can ask the employee not to go into the vault, and you can also ask codex not to use certain files, but if you need more certainty, you need to it outside.

The issue seems to be that people want to ask their agent to do everything, they want the agent to lock themselves out of some system, they want the agent to install itself, they want the agent to write their prompts so they don't have to write them. At some point there's some things YOU have to do, and you have to DO them.

eduction• 24 days ago

Great example of why operating systems should be stealing more ideas from Qubes, the OS where everything runs in a vm.

Qubes is not practical for mobile laptop use and non expert users.

BUT it would be very practical for other OSes to offer the option of VM-style isolated containers as first class objects that are easy to make and configure boundaries on, and for which first class interop facilities are provided (eg “send this file to this container” “send the clipboard to this container’s clipboard).

SubiculumCode3• 24 days ago

So how might I restrict the read paths if I am running codex as a plugin in vscode?

kennethops• 24 days ago

These tools are data collection mechanisms to help train these better models. I'm working with some folks to figure out a way to put a layer between the harness and the models to have better control of what data gets sent to and from the model itself and the harness.

skybrian• 24 days ago

To avoid the risk of exfiltration, we need to stop using .env for security. API keys needed when working in a repo should be handled by a proxy like ssh-agent, and we need something better than bearer auth.

pamcake3• 24 days ago

Yes you should. It will come naturally if you go down the road of separating code from data and properly isolating dev and prod environments, applying principle of least privilege as you do.

.env files for creds are a convenience for dev and testing. They were never supposed to be used for security or carried around with sensitive stuff inside. None of this is new.

tomjakubowski• 24 days ago

The desire not to leak valuable secrets is a strong argument for supporting local-first developer workflows. If an AI agent exfiltrates the credentials to connect to my local dev Postgres database which stores synthetic data, that's pretty low impact.

davidcann• 24 days ago

You can block file access on macOS by running codex in a sandbox with my app: https://multitui.com

quotemstr4• 24 days ago

I have a local patch that reads a new config section that looks like this:

    [sandbox.always.filesystem]                                      
     "~/.config" = "none"   
     "~/.config/git" = "read"

(In other words, "other configuration notwithstanding, disallow reads under ~/.config, but do allow reads under ~/.config/git")

I then force-merge the restrictions in this sandbox profile into all other sandbox profiles. I also added a new tiered sandboxing mode: now escalated commands, like regular commands, also run in a sandbox: just a more liberal one still subject to sandbox.always.filesystem rules. I added a new menu option to escalate (manually, one-shot) to truly-outside-sandbox mode for those few commands that aren't happy under any bwrap user namespace.

For simplicity, I also rewrote the built-in tools to just work through executing commands in the sandbox. Why is ReadFile something separate from cat-in-sandbox? why do we have two rule-enforcement systems, one for shell commands and one for tools? Well, now we don't.

Took me a few hours while I was doing other stuff. I love free software. I don't understand why you'd run Codex and not customize it locally.

I feel a bit guilty about not sending the patch upstream. It's just so much easier to fix software locally than get improvements landed upstream, especially now that LLMs make carrying patches forward easy.

cush• 24 days ago

Wouldn’t implementing this just give a false sense of security? As long as an agent can execute arbitrary code it can access anything it has access to. Adding a dont-access-my-secrets-pretty-please.yml file isn’t going to help any

nullbio• 24 days ago

Look at agent-vault and 1password. There's not really any reason to be storing sensitive keys in plaintext on your local disk that the agent can access.

anuramat• 24 days ago

just use bwrap?

NamlchakKhandro• 24 days ago

should be using pi-mono tbh. all vendor provided harnesses are complete trash

nicoty• 24 days ago

I've contributed to https://github.com/0xferrous/agent-box which allows you to bind-mount git repositories into containers that agents operate in, preventing the agents from accessing files that aren't bind-mounted. Your usual .gitignore can then be used to also ignore files within the repo to be bind-mounted, which prevents agents from accessing them at all, essentially working as a sandbox.

I also maintain https://github.com/nothingnesses/agent-images which allows you to use Nix to reproducibly spin up OCI containers containing agents and any other tools you need and use these with agent-box.

I use both at the moment to work on some personal projects with agents, where I set up multiple separate git worktrees for the agents to work in, preventing them from accessing anything outside of the worktrees and from trampling over each other's work.

kgeist• 24 days ago

never read or send .env, .env.*, .pem, id_, .aws/, .ssh/.

A think a better practice is to not store those things in the repository folder in the first place.

datsci_est_20152• 23 days ago

The fact that pretty much every comment in this thread suggests a different solution means there’s still plenty of innovation and consolidation to occur on this problem.

My take is that Unix already solved all of these user access problems (what can a user read or execute), so the solution will probably be around containers or virtual machines. But the UX around booting up a container or virtual machine for agentic workflows needs to be simplified to the point where vibe coders who don’t know the first thing about Unix, VMs, or containers can still take advantage of the solutions.

bolinfest• 23 days ago

We have had a solution for this built into Codex for several months now. It is marked "Beta" in the docs because we have been tweaking the config API here and there, but a number of folks have been using it for quite awhile and I would recommend switching to it and reporting any issues you find:

https://developers.openai.com/codex/permissions

With permission profiles in Codex, you can:

- Mark a path, glob, or meta variable (like `:workspace_roots`) readable, writable, or unreadable. - Amend an existing profile using ordinary `config.toml` layering rules. - Create a new profile by extending an existing one (`extends = ":workspace"` is generally what you want to do).

Note that permission profiles also allow you to configure the network proxy for the sandbox in a fine-grained way. (Previously, the network options for the Codex sandbox were all or nothing.)

Finally, you can also test running a command under a permission profile using:

codex sandbox -P PROFILE_NAME -- PROGRAM ARGS...

Our goal has been to provide something powerful and flexible out of the box so you do not need to bolt on other solutions like the ones mentioned on this thread.

A way to exclude sensitive files issue still open for OpenAI Codex

Related Stories