Codex on Windows: install the app or the CLI, then choose the sandbox or WSL2

Which Codex to install on Windows

• The ChatGPT desktop app, if you want a window. Codex has its own coding view next to Chat and Work, with worktrees, scheduled tasks, Git, a built-in browser, file previews, plugins and skills. The app is available on every ChatGPT plan, including Free.
• The Codex CLI, if you work in a terminal. It installs natively with a PowerShell script, or with npm.
• The IDE extension, if you work in an editor. OpenAI lists it next to the app and the CLI as a way to use Codex natively on Windows.
• Windows 11 is recommended. A recent, fully updated Windows 10 is supported without guarantees and needs version 1809 or newer, for ConPTY; older Windows 10 isn't recommended. winget should be available.

How to download and install Codex on Windows

1. Download the ChatGPT desktop app

   Get it from the Microsoft Store link on OpenAI's Windows app page, or install it with winget from PowerShell. Open ChatGPT, sign in and select Codex.

   winget install --id 9PLM9XGG6VKS -s msstore

2. Or install the Codex CLI

   Open a new PowerShell window and run OpenAI's installer; running it again updates Codex. With Node.js installed you can use npm instead. From the CLI, codex app opens the desktop app, installing it if needed, and /app moves the current session into it.

   # Native Windows installer (run it in a new PowerShell window)
   powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"
   
   # Or with npm, if Node.js is installed
   npm install -g @openai/codex
   
   # Start Codex and sign in
   codex

3. Sign in

   On first run, choose Sign in with ChatGPT to use your plan, or sign in with an API key, which is billed at standard API rates. Codex cloud needs the ChatGPT sign-in. codex login status exits with 0 once you're signed in.

4. Install the tools Codex will call

   Codex uses what's installed on the PC. OpenAI suggests Git, Node.js, Python, the .NET SDK and the GitHub CLI, all from winget, then signing in to GitHub.

   winget install --id Git.Git
   winget install --id OpenJS.NodeJS.LTS
   winget install --id Python.Python.3.14
   winget install --id Microsoft.DotNet.SDK.10
   winget install --id GitHub.cli
   gh auth login

5. Choose where the agent runs

   By default the agent runs natively in PowerShell under the Windows sandbox. To run it in WSL2 instead, open Settings, switch the agent from Windows native to WSL and restart the app. In either mode, select Ask for approval beneath the composer to get sandbox protection. For commands that need administrator rights, start the app with Run as administrator; the agent inherits it. The integrated terminal can be PowerShell, Command Prompt, Git Bash or WSL.

Source: OpenAI's Codex docs, Windows app

Native PowerShell or WSL2?

OpenAI's advice is to use the native sandbox by default, and to pick WSL2 when you need Linux-native tools, already work in WSL2, or the native options don't fit your setup. WSL1 isn't supported any more: it worked up to Codex 0.114, and from 0.115 the Linux sandbox uses bubblewrap and WSL1 support ended.

How to run Codex in WSL2

1. Install WSL2 and Codex inside it

   From an elevated PowerShell, run wsl --install, then wsl to open the Linux shell. Inside it, install bubblewrap for the sandbox (sudo apt install bubblewrap or sudo dnf install bubblewrap), run the Linux install script and start codex.

   # In PowerShell, run as administrator
   wsl --install
   wsl
   
   # Inside WSL: the sandbox needs bubblewrap (apt or dnf), then install Codex
   sudo apt install bubblewrap
   curl -fsSL https://chatgpt.com/codex/install.sh | sh
   codex

2. Keep repositories in the Linux home

   Clone into a folder such as ~/code rather than under /mnt/c, which is slower. If VS Code in WSL can't find Codex, check where it is with which codex.

3. Share settings with the Windows app

   The Windows app keeps its Codex home in %USERPROFILE%\.codex, while a CLI inside WSL uses the Linux home. To share one, set CODEX_HOME in WSL to the Windows folder.

   export CODEX_HOME=/mnt/c/Users/<windows-user>/.codex

4. Open WSL projects in the desktop app

   Choose Add new project (or press Ctrl+O) and type \\wsl$\. If the agent stays native, it's more reliable to keep projects on the Windows drive and reach them from WSL through /mnt/<drive>/....

Source: OpenAI's Codex docs, Windows and WSL

The Codex Windows sandbox: MXC, elevated and unelevated

The Windows sandbox lets Codex run natively in PowerShell, without WSL or a virtual machine, while limiting what its commands and their child processes can touch on disk and on the network. It comes in three implementations. The desktop app picks MXC automatically for consumer accounts on devices that support it.

Codex Windows sandbox setup

1. Check whether MXC works on your PC

   With Codex CLI 0.162.0 or later, run this test. It should print MXC_OK and exit with code 0.

   codex -c windows.sandbox=mxc sandbox --include-managed-config --permission-profile :workspace -- cmd.exe /d /c echo MXC_OK

2. Prefer MXC in the CLI

   The desktop app already prefers MXC for consumer accounts. For the CLI, or in an enterprise setup, turn it on in config.toml in your Codex home.

   # config.toml in your Codex home (%USERPROFILE%\.codex)
   [features]
   prefer_mxc = true

3. Or choose a legacy sandbox

   Where MXC isn't available, set elevated, or unelevated as the last fallback. The elevated sandbox needs an admin to approve its setup. In the CLI, the /setup-default-sandbox command runs that setup; it appears only on Windows, when Codex is on the degraded restricted-token sandbox.

   # config.toml in your Codex home (%USERPROFILE%\.codex)
   [windows]
   sandbox = "elevated"   # or "unelevated"

4. Or let IT set it up ahead of time

   An administrator can provision the elevated sandbox for another user. To remove the legacy sandbox later, run codex sandbox uninstall as administrator.

   codex sandbox setup --elevated --user 'DOMAIN\alice' --codex-home 'C:\Users\alice\.codex'

Source: OpenAI's Codex docs, Windows sandbox

Codex Windows sandbox setup failed? The documented fixes

OpenAI's Windows sandbox page has a troubleshooting list. Here is what it covers, under the docs' own headings.

• “My legacy sandbox setup failed”: the usual causes are a declined UAC or admin prompt, a policy that blocks creating local users and groups, changing the firewall or giving the sandbox user logon rights, or some other policy. Retry and approve the prompt, ask IT, or use the unelevated sandbox in the meantime.
• “I see Windows error 1385”: Windows denies the sandbox user the logon type it needs. Logon rights for the sandbox user are among the things a policy can block, so on a managed PC, ask IT. MXC creates no extra Windows accounts, so on Windows 11 24H2 or 25H2 it doesn't depend on a sandbox user.
• “Codex switched me to the unelevated sandbox”, “Codex warns that some folders are writable by Everyone”, “Sandboxed commands cannot reach the network” and “Sandboxing worked before and then stopped” each have their own entry on that page.
• For diagnostics, read CODEX_HOME/.sandbox/sandbox.log. Never send anyone the CODEX_HOME/.sandbox-secrets/ folder.
• Searching for “setup didn't finish”? OpenAI's docs have no entry with that wording. The closest documented case is “My legacy sandbox setup failed”.
• If PowerShell won't run npm and says npm.ps1 cannot be loaded because running scripts is disabled on this system., the common fix is Set-ExecutionPolicy -ExecutionPolicy RemoteSigned.

Computer Use on Windows takes over the screen

Computer Use lets Codex operate desktop apps by moving the pointer and typing. In the desktop app it's available on macOS and Windows, with ChatGPT Work and Codex, in supported regions. To turn it on, open Settings > Computer use, find Any App under Control, and select Install or turn the switch on.

• It runs on the active desktop and can't work in the background. While a task runs it moves the pointer, types and brings windows to the front, so you can't use the PC at the same time.
• To let it work while you're away, keep the PC unlocked and online and check in from your phone with remote control, or run the desktop app inside a Windows virtual machine so Computer Use takes over the VM instead of your screen.
• Locked use, which lets a task keep going after the computer locks, is macOS only.
• To save app approvals, list the apps in $CODEX_HOME/config.toml under [computer_use.windows], for example always_allowed_app_ids = ["mspaint.exe"].
• On every system, Computer Use can't automate terminal apps or ChatGPT itself, sign in as an administrator, or approve security and privacy prompts.

Control Codex on your Windows PC from your phone

A Windows PC can be a remote-control host, like a Mac. The ChatGPT app on your phone sends prompts and approvals; the PC runs the commands with its own projects, files, credentials and tools. The full setup and fixes are in Codex remote control.

• On the PC, open the ChatGPT desktop app and go to Settings > Connections > Control this Mac or PC, then select Set up or Add. Scan the QR code with your phone (iOS or Android).
• The PC then appears under Codex in the ChatGPT app. Older app versions call it Remote.
• Keep the PC awake, online, signed in and running the desktop app; if it sleeps or loses its network, remote access stops until it's back. For tasks that use Computer Use, keep the Windows session unlocked.
• OpenAI's plan table lists mobile remote control for Plus, Pro, Business and Enterprise, not for API-key sign-in. In a ChatGPT workspace, an admin may need to turn on Remote Control access first.
• The PC can also open projects on a Linux server as an SSH host, so your phone drives Codex on the server through the PC. See Codex on a VPS and Codex on Linux. For an always-on Mac instead, see Codex on a Mac mini.

Give Codex on your PC a standing job

Remote control and Computer Use still wait for you to start each task. Crewmark turns a Codex chat on your Windows PC into an AI employee with a role, goals, working hours and a heartbeat: during its hours the crewmark CLI, which runs on Windows as well as macOS and Linux, wakes it to take the next issue from a shared board. The PC has to stay on for that.

1. Hire an employee

   Pick a role from the AI employee roles, such as software engineer, and write its goals and KPIs.

2. Connect a Codex chat on the PC

   Link a Codex chat on the PC to the employee through the crewmark CLI. That conversation becomes the employee. Claude Code works too.

3. Set working hours and a heartbeat

   Weekdays only or every day, in your time zone, with hours that can run past midnight. During them the CLI wakes the employee every 15, 30, 60, 120 or 240 minutes. See Codex long-running tasks.

4. Assign issues from anywhere

   Create and assign issues on the board at crewmark.ai from any browser; assigning one wakes the employee. When it needs a review or a decision, it sets the issue to Needs action and asks you there. Jobs to give it are in Codex use cases.

FAQ