Windows sandbox fails with “apply deny-read ACLs”, blocking Computer Use and CLI commands

What version of the Codex App are you using (From “About Codex” dialog)?

26.901.41600 (About dialog); Windows package: 26.901.5280.0; bundled CLI: 0.153.4

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Windows 10 Pro 22H2, build 19045.6466, x64; Intel Core i5-2390T; 16 GB RAM; NTFS drives

What issue are you seeing?

Computer Use and local sandboxed commands fail before the requested action runs.

Error:
windows sandbox failed: helper_unknown_error: apply deny-read ACLs

Computer Use additionally reports:
node_repl kernel exited unexpectedly (code=1)

The same sandbox error is reproducible directly with the desktop app's bundled Codex CLI, outside the project and without using Chrome or Computer Use. The CLI exits with code 1.

The user config.toml contains:
approval_policy = "on-request"
sandbox_mode = "workspace-write"

[windows]
sandbox = "elevated"

Repeated Computer Use connection attempts, including a session reset, failed with the same error.

The standard ~/.codex/.sandbox/sandbox.log was last modified on June 2, 2026 and did not update after the CLI reproduction. Exact error strings were not found in the eight most recently modified non-empty codex-desktop logs checked.

A separate Codex extension also runs inside Devin. A conflict between the clients has not been established.

Diagnostic feedback was successfully uploaded from the desktop app.
Feedback ID: no-active-thread-01a07085-152d-7811-8d6f-d9e09a423d80

Please advise how to locate the current sandbox helper diagnostics and repair the native sandbox in this version.

What steps can reproduce the bug?

Feedback ID: no-active-thread-01a07085-152d-7811-8d6f-d9e09a423d80

What is the expected behavior?

The sandbox should initialize and execute the command, printing TM_SANDBOX_OK with exit code 0.

Computer Use should initialize successfully and allow interaction with the approved browser.

Additional information

No response

Start with the desktop app’s bundled Codex CLI on Windows using the reported config.toml, especially windows.sandbox = "elevated", and reproduce the apply deny-read ACLs failure. Check the current native helper diagnostics alongside ~/.codex/.sandbox/sandbox.log, then verify that the sandbox prints TM_SANDBOX_OK with exit code 0 and that Computer Use initializes.