[Windows][Computer Use] No working sandbox mode: elevated capture fails 0x80070424, unelevated helper startup fails with spawn EPERM

What version of the Codex App are you using (From “About Codex” dialog)?

26.803.5235.0

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Computer Use has no working Windows sandbox mode on this machine.

• In windows_elevated, the Computer Use runtime starts, real desktop windows are enumerated, named-app authorization succeeds, and the target window can be attached. Screenshot capture then fails with:

IGraphicsCaptureItemInterop.CreateForMonitor failed:
The specified service does not exist as an installed service (0x80070424)

A separate text-only state request returns accessibility = null and zero screenshots.

• In windows_sandbox / unelevated mode, ordinary PowerShell commands work, but the first @oai/sky startup/window-list request fails before enumeration with:

spawn EPERM

The sandboxed Node process cannot start the bundled codex-computer-use.exe helper.

As a result, one mode can start the helper but cannot capture application state, while the other mode cannot start the helper at all.

What steps can reproduce the bug?

A. Elevated sandbox

Use:

[windows]
sandbox = "elevated"
sandbox_private_desktop = false

1. Fully restart the ChatGPT/Codex app.
2. Attach the Computer Use plugin to a task.
3. Authorize a named desktop application.
4. Call sky.list_windows(); real interactive-desktop windows are returned.
5. Attach to the authorized window.
6. Request screenshot state with sky.get_window_state(...).
7. Observe IGraphicsCaptureItemInterop.CreateForMonitor failed ... (0x80070424).
8. A text-only request returns accessibility = null.

B. Unelevated sandbox

Use:

[windows]
sandbox = "unelevated"
sandbox_private_desktop = false

1. Fully restart the app.
2. Verify the turn resolves to windows_sandbox.
3. Attach Computer Use and run the first same-call @oai/sky startup/window-list request.
4. Observe spawn EPERM before window enumeration, authorization, or capture.

What is the expected behavior?

At least one supported Windows sandbox mode should allow the same Computer Use session to:

1. Start the bundled Computer Use helper.
2. Enumerate and attach to an authorized desktop application.
3. Read accessibility state and capture screenshots.
4. Activate and interact with the application.

Additional information

Component versions

• Windows 11 x64, version 25H2, build 10.0.26200.8875
• ChatGPT/Codex app: 26.803.5235.0 x64
• Computer Use bundled plugin: 26.803.41515
• @oai/sky: 0.6.2
• Codex command runner: 0.147.0-alpha.6.5
• approval_policy: on-request

Windows control test

An independent real UAC-elevated PowerShell process reports:

Windows.Graphics.Capture.GraphicsCaptureSession.IsSupported() = True

Starting the per-user Windows CaptureService did not change the elevated Codex sandbox error. Windows Graphics Capture is therefore available globally; the failure appears specific to the Codex sandbox identity/context.

Already attempted

• Full PC restarts
• Computer Use uninstall/reinstall
• Codex workspace dependency reinstall
• Windows app Repair
• Full ChatGPT/Codex uninstall and reinstall
• Computer Use runtime reset and complete SHA-256-verified restoration
• App authorization reset and re-approval
• Elevated/unelevated sandbox A/B testing with a full app restart between modes

The configuration was restored to the less-regressive elevated mode after testing.

Related issues

• #21470 - Windows Codex Desktop sandbox blocks Node child processes with spawn EPERM
• #25178 - Windows Computer Use screenshot/capture failure
• #9062 - Windows sandbox process creation / ACL setup failure

This report is sanitized and contains no credentials, tokens, cookies, business data, application content, or personal file paths.

Start with the Windows sandbox configuration for windows_elevated and windows_sandbox, then trace the @oai/sky startup, sky.list_windows(), and sky.get_window_state(...) paths. Reproduce both spawn EPERM and IGraphicsCaptureItemInterop.CreateForMonitor failures and determine whether a supported mode can start the helper, enumerate windows, read accessibility state, and capture screenshots.