Windows app setup fails with helper_failed / Access Denied on codex-windows-sandbox-setup.exe (26.818.8289.0)

Summary

The Codex Windows app cannot complete its one-time Windows setup. The UI repeatedly shows:

Windows setup didn’t finish • helper_failed

The installed Codex package is OpenAI.Codex 26.818.8289.0 and Windows reports the package status as Ok.

Environment

• Windows 11
• ChatGPT Plus account
• Codex package: OpenAI.Codex_26.818.8289.0_x64__2p2nqsd0c76g0
• Package location: C:\Program Files\WindowsApps\OpenAI.Codex_26.818.8289.0_x64__2p2nqsd0c76g0

What happens

Opening the new ChatGPT/Codex Windows app reaches Finish Windows setup. Clicking Try Windows setup again, approving the UAC prompt, still returns:

helper_failed

The sandbox helper exists at:

app\resources\codex-windows-sandbox-setup.exe

Diagnostics already performed

1. Get-AppxPackage OpenAI.Codex | Select Name,Version,Status

Result:

Name          Version        Status
OpenAI.Codex  26.818.8289.0  Ok

2. Verified the helper exists:

codex-windows-sandbox-setup.exe

3. Verified its Authenticode signature:

Status  StatusMessage
Valid   Signature verified.

4. Attempted to invoke the helper directly from an elevated Administrator PowerShell session. Result:

Program 'codex-windows-sandbox-setup.exe' failed to run: Access is denied
CategoryInfo          : ResourceUnavailable
FullyQualifiedErrorId : NativeCommandFailed

5. Microsoft Defender real-time protection was not active. Third-party security protections were also temporarily disabled for testing, with no change. The helper still returned Access is denied.

6. Microsoft-Windows-CodeIntegrity/Operational showed no matching block event during the failure.

7. A temporary .codex\config.toml test using an unelevated Windows sandbox did not fix the issue. The original config was restored afterward.

8. ChatGPT and Codex Start-menu registrations are present:

ChatGPT          OpenAI.Codex_2p2nqsd0c76g0!App
ChatGPT Classic  OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0!ChatGPT

Expected behavior

Approving the UAC prompt should allow the one-time Windows helper setup to complete and permit normal local Codex use.

Actual behavior

The app remains stuck at Finish Windows setup with helper_failed, and the signed helper returns Access is denied when tested from elevated PowerShell.

Notes

The issue does not appear to be caused by account entitlement, missing installation, an invalid package, an invalid signature, or enabled antivirus/security protection. The failure appears specific to the Windows sandbox/helper setup path in this Codex build.

Reproduce the failure by invoking app\resources\codex-windows-sandbox-setup.exe from an elevated PowerShell session and compare it with the app's Finish Windows setup flow. Review Microsoft-Windows-CodeIntegrity/Operational during the attempt, along with the reported package and signature checks. Done means the helper completes successfully and the app no longer shows helper_failed.