What is the CodexSandboxUser account on Windows 11? Should you delete it?

CodexSandboxUser, CodexSandboxOffline, and CodexSandboxOnline are legitimate local accounts created by OpenAI Codex.
The accounts isolate AI-generated commands from your primary Windows account to improve security.
Keep the accounts if you still use Codex, as deleting them may affect sandbox functionality.
If you’ve uninstalled Codex, you can safely remove the sandbox accounts from Windows 11.

If you recently installed OpenAI Codex on Windows 11, you may notice a new local user account called CodexSandboxUser, CodexSandboxOffline, or CodexSandboxOnline. Since Windows 11 doesn’t usually create extra user accounts on its own, it’s natural to wonder whether the account is legitimate, whether your computer has been compromised, and whether it’s safe to remove it.

The short answer is that these accounts are legitimate. They are created by Codex to provide an isolated environment for AI-generated commands, helping protect your main account from unintended changes or potentially unsafe code. If you still use Codex, you should leave the account in place. If you’ve removed Codex and no longer plan to use it, you can safely delete the account.

In this guide, I’ll explain what the CodexSandboxUser account is, why it appears on Windows 11, and when it’s appropriate to remove it.

What is the CodexSandboxUser account?

The CodexSandboxUser account is a local Windows user account automatically created by OpenAI Codex when you enable its sandbox.

Instead of executing AI-generated commands under your own account for Windows 11, Codex runs them inside a separate user account with limited privileges. This isolation reduces the risk of accidental system changes and helps prevent AI-generated code from accessing files or settings outside the sandbox.

Depending on the version of Codex you install, you may notice one of three accounts, including CodexSandboxUser, CodexSandboxOffline, or CodexSandboxOnline.

Although the names differ, they all serve to provide a dedicated account for sandboxed AI tasks.

Why does Codex create these accounts?

OpenAI designed the sandbox for Windows 11 to improve security. When Codex performs actions such as running PowerShell or Command Prompt commands, editing files, compiling or testing code, or installing project dependencies, those operations occur under the sandbox account instead of your personal profile.

Newer versions create separate accounts for different scenarios. For instance, CodexSandboxOffline runs without internet access, and CodexSandboxOnline allows network connectivity when a task requires it.

This separation lets Codex apply different security restrictions depending on the type of work being performed.

Is CodexSandboxUser safe?

Yes. If you’ve installed Codex or another OpenAI tool that uses the sandbox, this account behavior is expected.

The account is created locally on your computer, used only for sandboxed tasks, not part of the operating system, and not an indication of malware or unauthorized access.

If you never installed Codex but suddenly notice one of these accounts, it’s worth checking whether another user or application installed the software.

Should you delete the account?

It depends on whether you still use Codex.

You can keep it if you actively use Codex, use it through Visual Studio Code, or use another supported client.

You can delete it if you’ve already uninstalled Codex or you’re cleaning up unused local accounts. However, if Codex remains installed, it may automatically recreate the account the next time the sandbox is needed.

How to check whether the account exists

You can verify whether Windows 11 contains the sandbox account in several ways, but the easiest way is to use the Settings app.

Open Settings > Accounts > Other users and look for CodexSandboxUser, CodexSandboxOffline, or CodexSandboxOnline.

How to delete the Codex sandbox account

If you’ve already removed Codex and the accounts are still available on your setup, you can delete the sandbox account just like any other local user account.

Open Settings > Accounts > Other users, select the CodexSandboxUser, CodexSandboxOffline, or CodexSandboxOnline account, click “Remove,” and confirm.

If you have a new version of Codex, you may need to remove both the CodexSandboxOffline and CodexSandboxOnline accounts.

Pureinfotech’s Take

Finding an unfamiliar user account on Windows 11 is enough to make most people think something is wrong, especially since the operating system rarely creates new local users without telling you.

In this case, however, the account is actually a security feature rather than a security problem. I prefer to see AI tools execute commands in an isolated environment rather than under my own account, because it limits what those commands can access if something goes wrong.

That said, I think OpenAI could make the experience less confusing by explaining during setup that Codex will create dedicated sandbox accounts. A simple notification would likely eliminate many of the questions users are now asking.

FAQs about CodexSandboxUser account

Here’s a list of frequently asked questions (FAQs) and answers about the Codex-generated user accounts.

Is CodexSandboxUser a virus?

No. It’s a legitimate local Windows account created by OpenAI Codex to isolate AI-generated commands.

Does Windows 11 create this account?

No. Windows 11 doesn’t create the Codex sandbox account. It’s created by the Codex application when the Windows sandbox is configured.

Why does the account come back after I delete it?

If Codex is still installed and requires the Windows sandbox, it can automatically recreate the account.

Can I disable the sandbox instead?

Yes. If you don’t want Codex to create sandbox accounts, you’ll need to disable or stop using the Windows sandbox feature within Codex. Keep in mind that doing so reduces the isolation that protects your system while AI-generated commands run.