Windows: Codex-created .agents ownership breaks sandbox setup and in-app browser control

What version of the Codex App are you using?

Codex Desktop on Windows, observed September 8, 2026. Bundled runtime verified with codex.exe --version: codex-cli 0.153.4. The separate desktop About-dialog version was not captured.

What subscription do you have?

Pro; this report concerns a local Windows filesystem/sandbox failure.

What platform is your computer?

Windows 10 Pro 22H2, build 19045.7663, x64. Local project on M:. Configuration: sandbox_mode = "workspace-write" and [windows] sandbox = "elevated".

What issue are you seeing?

After Codex created a project's .agents directory while adding a project-local skill, subsequent local commands and in-app browser control failed during sandbox initialization. The user had not manually created the directory or changed its ownership.

The directory was owned by <MACHINE>\CodexSandboxOffline, while the parent project directory was owned by the interactive Windows user. Both directories were ordinary directories, not reparse points. The child inherited its access rules and the normal user's broad group access was Modify, rather than permission to change the ACL.

Sanitized sandbox log:

deny ACE failed on M:\Codex\<PROJECT>\.agents:
SetNamedSecurityInfoW failed for M:\Codex\<PROJECT>\.agents: 5
setup refresh completed with errors
setup error: setup refresh had errors

Local command error:

Failed to create unified exec process:
helper_unknown_error: setup refresh had errors

Browser tool error from cua.getState():

trusted Node process exited unexpectedly; kernel reset, rerun your request

The user could manually use the in-app browser tabs, but the agent could not even enumerate them. Repeated tool calls and a browser-kernel reset reproduced the failure.

What steps can reproduce the bug?

This is the observed incident sequence, not a separate clean-room reproduction:

1. A user-owned Windows project was working with the elevated sandbox.
2. Codex used its file-editing workflow to add project-local skill files beneath a new .agents directory.
3. The directory's creation time was 2026-09-08 00:49:43 PDT. Sandbox setup was still succeeding immediately before creation.
4. At 00:49:51 PDT, the next local command failed while applying a deny ACE to that directory.
5. Later attempts from a task in the same project failed for both local commands and browser initialization.
6. Inspection found the ownership mismatch described above.

What is the expected behavior?

Creating a supported project-local skill through Codex should leave the project usable. The creation/setup workflow should handle ownership and protected-directory ACLs consistently.

If setup cannot apply an ACL, the agent-facing error should identify the affected path and Windows error. Browser control should expose the underlying setup failure rather than only a generic Node-process crash.

Users should not have to anticipate which folders Codex will create, pre-create them manually, or diagnose NTFS ownership.

Additional information

A narrowly scoped repair was verified:

• Backed up the affected directory's security descriptor.
• With Windows administrator approval, changed only the .agents directory's owner to the interactive user using icacls <directory> /setowner <interactive-user>, without recursion.
• Did not reset the directory's ACL, grant Everyone access, disable the sandbox, change firewall rules, or delete/recreate the directory.
• On the next attempt, Codex successfully applied its deny ACEs and sandbox setup reported errors=[].
• In the original affected task, a local README read completed with exit code 0 and cua.getState() successfully enumerated both existing in-app browser tabs on the first attempt. No app restart or kernel reset was needed after the ownership repair.

This strongly points to an ownership/ACL setup interaction triggered by Codex's own directory creation. The exact internal code defect has not been isolated.

Related reports: #31414 concerns a different folder-owner case; #39933 describes the generic setup-refresh failure. This report adds the agent-created .agents trigger, correlated browser-control failure, and verified single-directory ownership repair.

The assistant initially recommended restarting, then suggested that the user manually pre-create the folders. That guidance misplaced the prevention burden: Codex created the directory. Please address both the setup behavior and the diagnostic guidance.

Project names, personal account/machine names, browser destinations, and full transcripts are omitted.

Start by tracing the Windows sandbox setup path that applies deny ACEs and the project-local skill creation workflow that creates .agents. Reproduce the ownership mismatch and the SetNamedSecurityInfoW error, then check how local-command and browser initialization errors surface setup-refresh failures. Done means supported Codex-created directories remain usable and failures identify the affected path and Windows error.