OpenAI built a Windows sandbox for Codex from scratch

OpenAI rejected AppContainer, Windows Sandbox and MIC, then built a two-user elevated sandbox for Codex on Windows — because firewall-backed network suppression required a separate Windows principal.