What's this about?
Codex, OpenAI's coding agent, is now available in preview inside the ChatGPT desktop app for Linux. It drew 300 comments, and almost none of them were about the coding features.
What exactly is the sandboxing concern?
A coding agent needs to read your files and run commands — that's the job. The question is what surrounds it. Running it inside a container or virtual machine means a mistake, a prompt injection, or a compromised update can only damage a disposable environment. Running it directly in your main user account means it has whatever you have: your SSH keys, your cloud credentials, your browser session. This connects directly to yesterday's news about attackers scanning specifically for AI coding tools' credential files — those files exist because the tools run with real access.
What's the community saying?
- "Treat these as trojans." The single most-repeated advice — isolate them from the rest of your system, give them a full desktop in a VM if you like, but not direct access.
- The easy installer is the attack surface. A well-argued point that convenient installation trains users into running agents unsandboxed in their primary account or with admin rights, and that operators already skip isolation to avoid the hassle.
- What does the desktop app add? Repeated genuine questions about the advantage over the browser, or over the Codex CLI with MCP servers and per-folder context files — especially if it's an Electron app.
- It works, at least. Practical reports of people running it successfully on Debian under KVM via X11, and long-time Linux users glad the gap finally closed.
- Ideological rejection. A visible minority argued Linux users specifically were never the audience for a tool that keeps intelligence premium and policy-dependent.