We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
OpenAI Blog·May 8·5 min read
Running Codex safely at OpenAI
TL;DR
Codex, OpenAI's code-generation AI model, posed security and compliance risks when deployed in production environments where it could access sensitive systems. OpenAI implemented a multi-layered defense strategy combining sandboxing (isolated execution environments), approval workflows, network policies (traffic filtering), and agent-native telemetry (built-in monitoring).
✦ Why It Matters
Engineers can adopt code-generation AI safely by implementing layered controls: sandboxing, approvals, network restrictions, and native telemetry.
Key Takeaways
- Implement sandboxing to isolate code execution in restricted environments separate from production systems.
- Require human approval workflows before agents execute sensitive operations or access protected resources.
- Enforce network policies to block unauthorized outbound connections and data exfiltration attempts.
- Embed monitoring and telemetry directly into agent logic for real-time visibility and audit trails.
Full Summary
Codex is a large language model trained to generate and understand code, but deploying it as an autonomous agent—software that can independently execute actions—created security vulnerabilities. Without safeguards, agents could run malicious or unintended code, access sensitive systems, or exfiltrate data.
OpenAI built a comprehensive safety framework combining four mechanisms: sandboxing isolates code execution in restricted environments; approval workflows require human review before sensitive operations; network policies block unauthorized outbound connections; and agent-native telemetry embeds monitoring directly into agent logic rather than relying on external systems. This approach reduced attack surface while preserving functionality.
The result was a production-ready system enabling safe coding agent adoption with compliance support and measurable security posture improvements.