Codex Desktop (Windows) closes silently a few seconds after launch (no Application Error / WER), sandbox log truncated

What version of the Codex App are you using (From “About Codex” dialog)?

OpenAI.Codex 26.818.8289.0 (Windows)

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.19045.0 x64

What issue are you seeing?

After logging in, you start a chat or open an existing one, and after a while the system disconnects you. This happens all the time.

What steps can reproduce the bug?

1.- Open the desktop app.
2.- Click on an old chat.
3.- After 3 to 5 seconds, the application will disconnect your session.

What is the expected behavior?

The application is not expected to disconnect you every time.

Additional information

On Windows 10 (19045) on a corporate-managed machine, Codex Desktop closes unexpectedly a few seconds after opening. There is no error dialog, and Windows Reliability Monitor / Event Viewer does not show an “Application Error” or Windows Error Reporting entry. sandbox.log is extremely short and ends after a successful command, suggesting the process is terminated before the sandbox finishes startup.

Environment

OS: Windows 10 build 19045

Device: Corporate-managed PC

App: OpenAI.Codex 26.818.8289.0 (Windows)

Sandbox setting: unelevated

Security: Cortex XDR Advanced Endpoint Protection + Windows Defender registered

Timezone: America/Lima (UTC-5)

Repro steps

Launch Codex Desktop on Windows.

Interact for a few seconds (sometimes start a local task; in prior cases it occurred during document/PDF/DOCX-related local work).

App closes abruptly without warning.

Expected
App remains open and continues the task, or shows an error message if it fails.

Actual
App closes silently after ~4–7 seconds (varies). No Windows crash telemetry visible in Reliability Monitor / Event Viewer.

What I tried

Reinstalling: app works temporarily (hours) then the issue returns.

Changed sandbox from elevated to unelevated (permissions errors improved earlier, but silent closes persist).

Disabled notify in config.toml: app stayed open slightly longer, then still closed.

Session / IDs

Feedback ID shown in UI: no-active-thread-01a043d0-54e2-7d33-afa2-ef76bd4928a8

Session meta in transcript JSON: session_id = 01a043cf-55ae-7673-8ae7-52523f661136

Turn: 01a043d0-b8db-70b3-999a-f44ab22c16b1

Logs / attachments (reviewed for sensitive info; excluding secrets)

CODEX_HOME/.sandbox/sandbox.log (complete file; only contains:)

[2026-08-27 09:34:55.024 codex.exe] START: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command try { [Console]::OutputEncoding=[System.Text.Encoding]::UTF8 } catch {}
Get-Content -LiteralPath 'C:\Users\gcoronado.codex\skills.s
[2026-08-27 09:34:56.189 codex.exe] SUCCESS: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command try { [Console]::OutputEncoding=[System.Text.Encoding]::UTF8 } catch {}
Get-Content -LiteralPath 'C:\Users\gcoronado.codex\skills.s
Session transcript JSON excerpt available on request (contains the above session_id).

Additional context / hypothesis
Given the lack of Windows crash events and the abrupt truncation of sandbox.log, this may be external termination by EDR/policy (Cortex XDR / WDAC / AppLocker) affecting Codex child processes/runtimes.

Request
Please advise what additional diagnostic logging (Windows-side or Codex-side) to enable, and/or which process paths should be allowlisted in common EDR setups for Codex Desktop on Windows.

Start by reproducing the silent close on Windows 10 and compare the short CODEX_HOME/.sandbox/sandbox.log with Windows Reliability Monitor and Event Viewer. Review the reported config.toml sandbox and notify settings, along with the Cortex XDR and Windows Defender context. Done means identifying a useful diagnostic path or confirming the external termination and required process paths.