Is Codex full-auto safe? --full-auto vs --yolo explained
The Auto preset (workspace-write sandbox + on-request approvals) is reasonably safe for a version-controlled repo: Codex can edit and run commands only inside the workspace, the network is off by default, and it asks before going further. --yolo (--dangerously-bypass-approvals-and-sandbox) is not: it removes both the sandbox and the prompts.
Stats from the 2026-10-20 snapshot of public GitHub configs (methodology). Behavior checked against the official docs linked below.
The two settings that matter
sandbox_mode decides what Codex can technically do (read-only, workspace-write, danger-full-access). approval_policy decides when it stops to ask (on-request or never; the old untrusted value is retired and can stop Codex from starting).
Common combinations
# Auto preset (recommended for repos)
sandbox_mode = "workspace-write"
approval_policy = "on-request"
# Read-only CI
sandbox_mode = "read-only"
approval_policy = "never"
# Full bypass (what --yolo does). Use only in a disposable container
sandbox_mode = "danger-full-access"
approval_policy = "never"What public configs do
Of 1,200 unique public Codex configs that set either key, 18% use danger-full-access, 22.2% set approval_policy = "never", and 12.9% combine both (full bypass).
Safer alternatives to full access
Keep workspace-write and enable network only if you need it ([sandbox_workspace_write] network_access = true). Workspace-write still protects .git, .codex and .agents as read-only. If the host can't run the sandbox, run Codex in a dev container and use danger-full-access only inside it, with trusted repos.
FAQ
Does never always mean unsafe?
No. approval_policy = "never" with a read-only sandbox is a documented CI setup. The risk comes from combining never with danger-full-access.