the short answer
On ChatGPT Business, Enterprise and Edu, workspace data is not used to train OpenAI models by default, and API data has not been used for training since March 2023. Locally, Codex defaults to a workspace-write sandbox with network off and asks before going further. The risks are bypass flags, and the two published CVEs, which let a model-chosen path or repository-supplied config escape the workspace. Lock approval and sandbox modes with requirements.toml and gate actions with hooks.
- Training
- Not by default on Business, Enterprise, Edu; not on the API since March 1, 2023
- Default sandbox
workspace-writewith network off; approvalon-request- Bypass flag
--dangerously-bypass-approvals-and-sandbox(--yolo)- Retired
approval_policy = "untrusted"- Admin enforcement
requirements.toml, cloud requirements, MDM
What Happens to Your Code
OpenAI notes that API zero data retention “doesn’t define retention for ChatGPT Work”, and advises organizations that require ZDR not to enable local computer access with Work Cloud.
| Plan | Training | Notes |
|---|---|---|
| ChatGPT Business, Enterprise, Edu | Not used to train OpenAI models by default | Encrypted in transit and at rest; local computer access with Work Cloud is not strict zero data retention |
| API | Not used for training since March 1, 2023 | Abuse-monitoring logs up to 30 days; ZDR by approval |
| ChatGPT Free, Plus, Pro | Content may be used for training unless the “Improve the model for everyone” setting is off | Confirmed only via OpenAI’s help-center summary |
What the Local Agent Can Do by Default
| Area | Default (as of October 2026) |
|---|---|
| Sandbox | workspace-write; folders not under version control default to read-only |
| Network | Off by default |
| Approvals | on-request: asks before editing outside the workspace or using the network |
| Protected paths | .git, .codex, .agents and .aws inside writable roots are read-only |
| Bypass | --yolo means no sandbox and no approvals; web search switches to live |
| Sandbox technology | macOS Seatbelt; Linux bwrap plus seccomp |
Codex Vulnerabilities
One let a model-chosen working directory escape the workspace; the other let repository-supplied configuration run commands at startup. Keep Codex updated, and treat repositories from outside your organization as untrusted.
| ID | Disclosed | Impact | Fixed |
|---|---|---|---|
| CVE-2025-59532 | Sep 2025 | Sandbox bypass: a model-generated cwd was treated as the writable root, allowing writes and commands outside the workspace (high) | CLI 0.39.0, IDE extension 0.4.12 |
| CVE-2025-61260 | Reported Aug 2025; advisory Apr 2026 | A repository .env sets CODEX_HOME to a local folder whose config.toml starts MCP servers with no approval (critical) | Sources conflict: Check Point reports a fix in 0.23.0, while NVD and the advisory describe 0.23.0 and before as vulnerable; run the latest release |
Admin Controls
Deliver them in /etc/codex/requirements.toml, the Admin Console’s Agent security page, or macOS MDM. Login restrictions are the exception: they must go in the local file or MDM. See the Codex requirements.toml example.
| Control | Effect |
|---|---|
allowed_approval_policies | Limit approval modes, for example ["on-request"] |
allowed_permission_profiles (0.138.0+) or allowed_sandbox_modes | Rule out danger-full-access |
[rules] prefix_rules | Mark commands prompt or forbidden |
[permissions.filesystem] deny_read | Keep .env files and credentials unreadable |
[mcp_servers.<name>] identity | MCP allowlist by name and command or URL |
allowed_login_methods = ["chatgpt"], allowed_chatgpt_workspaces | Keep sign-in on your workspace (local requirements.toml or MDM only; ignored in cloud requirements) |
FAQ
Does OpenAI train on Codex usage from ChatGPT Enterprise?
Not by default. OpenAI states Business, Enterprise and Edu workspace data is not used to train its models by default.
Does Codex have network access by default?
No. The agent runs with network access off unless you enable it for workspace-write.
Can admins stop --yolo?
Yes. Restrict allowed_approval_policies and the sandbox or permission profiles in requirements.toml.
Sources
Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.
- OpenAI docs: ChatGPT Work cloud security
- OpenAI docs: ChatGPT Work local security
- OpenAI API docs: Your data
- OpenAI Codex docs: Agent approvals and security
- OpenAI Codex docs: Managed configuration
- GitHub advisory GHSA-w5fx-fh39-j5rw (CVE-2025-59532)
- GitHub advisory GHSA-xrxf-jgv3-qmrm (CVE-2025-61260)
- Check Point Research: OpenAI Codex CLI command injection