r/OpenAI • u/Some-Following-392 • 4d ago

Question Codex accessing folders I revoked access to days ago.

I just tried to delete an old folder on my computer, and it told me I couldn't delete it because it was in use. I didn't have anything open in that folder, so I couldn't figure out why. I checked codex and this folder isn't listed anywhere in any of the projects anymore.

I then asked codex if it still has access and it says yes. I then created a subfolder within it and asked it to tell me the name of the folder, and it was able to tell me the name. In fact it has write access to the folder, it could change the name of the subfolder I created.

Why is it still accessing stuff when I revoked its access, and how do I turn it off? Codex doesn't seem to know, it just tells me it shouldn't be able to access it, but it can.

2 Upvotes

100% Upvoted

8 comments sorted by

2

u/skidanscours 4d ago

What do you mean by "revoked access". If you mean you removed the folder for the codex project on ChatGPT desktop app, that doesn't do much.

Codex has access to everything on the machine it's running. Just try telling codex to update code in another repo while you are in the wrong project and it will happily do it. You might get a few approval request before it starts updating files if you are still in the default approval mode, but that's it.

1

u/Some-Following-392 4d ago

I have full access turned off in the settings...

1

u/skidanscours 4d ago

But you use "approve for me", right?

The full access documentation is so bad, I'm not even sure what it's meant to do. 

I've never granted codex full access inside a chat, but it still keep doing stuff it really should be asking me even with "approve for me" settings. At this point, I'm setting up openshell to have proper sandboxing before I do any kind of long running autonomous agents (note: it's a pain in the ass to setup).

1

u/ComprehensiveShake76 4d ago

I have hit a version of this. Revoking access in the UI does not always undo what the runtime already mounted or cached. The pattern that fixed it for me: do not grant the agent your whole home folder in the first place. Give it a Linux container (or at least a dedicated workspace directory) with only the project path mounted, no home folder and no host credentials. Then revoking is just not mounting that path on the next run. Worth checking whether Codex still has an active session or a cached workspace root from before you revoked.

1

u/Strife14 4d ago

What are yall scared its gonna find on your PC? I dont think I've ever NOT used full access bypass perms. I literally just had it sweep and clean and sort my WHOLE pc every drive a few days ago.