Enabling Network Access for Codex Extension in VS Code

Want to use OpenAI's Codex as a full-fledged coding agent in VS Code? By default, it's sandboxed without internet access. Here's how to enable network connectivity for Codex on Windows with WSL so it can install packages, fetch documentation, and test your TypeScript projects.

Contents

• The Sandbox Problem
• Enabling Codex in WSL
• Disabling Sandbox Mode

The Sandbox Problem

When you install Codex – OpenAI's coding agent in VS Code, it runs in a restricted sandbox environment for security. This means it can't access the internet by default. You'll see error messages like this when Codex tries to install packages or run tests:

The sandbox can't reach registry.yarnpkg.com (getaddrinfo EAI_AGAIN). With network restricted, I can't install the missing packages, so I can't run the Node tests here.

The EAI_AGAIN error code stands for "Error Address Info - Try Again" and indicates a temporary DNS resolution failure. In this context, it means the sandbox environment cannot resolve domain names to IP addresses because network access is blocked. This is a Node.js error that occurs when getaddrinfo() fails to look up a hostname.

This limitation prevents Codex from performing many useful tasks. It can't install npm packages, fetch API documentation, or access external resources that would make it a truly powerful coding assistant. For TypeScript development, this is particularly limiting since package management is essential. Luckily, you can enable network access with a few configuration changes.

Enabling Codex in WSL

Before enabling network access for Codex, you'll need to tell Codex to run inside WSL rather than directly on Windows. This is a crucial step that enables the security features needed for network access.

Open VS Code settings and search for @ext:openai.chatgpt. Look for the setting called Run Codex In Windows Subsystem For Linux. The description reads:

Windows only: when Windows Subsystem for Linux (WSL) is installed, automatically run Codex inside WSL. Recommended for improved sandbox security and better performance. Agent mode on Windows currently requires WSL. Changing this setting reloads VS Code to take effect.

Enable this setting. VS Code will reload to apply the changes. After the reload, Codex will run inside your WSL environment instead of directly on Windows.

Disabling Sandbox Mode

Even after enabling WSL integration, Codex still runs in a restricted sandbox. You'll see this message when you try to use network features:

Network is currently restricted for this session. To change it, you'd need to start a session with network access enabled (or grant network permission for specific commands).

To enable network access permanently, you need to modify Codex's configuration file. Open your Codex settings by accessing the config.toml file.

Add or update the following settings:

model = "gpt-5.1-codex-max"
model_reasoning_effort = "high"
sandbox_mode = "danger-full-access"
 
[sandbox_workspace_write]
network_access = true

The critical setting is sandbox_mode = "danger-full-access". This disables the security sandbox and gives Codex full access to your system. The name isn't joking about the danger as it allows Codex to execute any command and access any file. Only enable this if you understand the risks.

Finally, network_access = true under the [sandbox_workspace_write] section explicitly enables internet connectivity for the sandbox.

For more details about available configuration options, check the official Codex local configuration documentation.