EAP 1.2.0 ¶

• Stronger Codex sandbox protection

  Codex now runs with conversation-scoped permissions. Project files remain read-only, while only the current conversation's artifact and temporary folders can be modified. This helps prevent accidental changes, cross-conversation access, and credential exposure.

• Safer local MCP execution

  Local MCP servers run in isolated sandboxes with restricted filesystem, process, and network access. Sensitive gateway, Registry, and customer credentials are not inherited.

• Fine-grained MCP tool control

  Teams can define which tools each MCP server is allowed to expose and apply approval requirements to individual tools. Agent projects may further narrow access, but cannot expand the approved tool list. These controls are enforced at runtime to prevent unauthorized tool calls.

• More reliable conversations

  Codex session data and rollout files are persisted more reliably, including background retries after temporary failures. Conversations are better protected against runtime restarts, pod movement, and service interruptions.

• Graceful shutdown and recovery

  In-progress requests are given time to complete during service shutdown. Interrupted conversations receive clearer recovery guidance, and pending session data is persisted before the runtime stops.

• Emergency runtime control

  Operators can stop an individual project runtime immediately and disable it persistently when necessary, without affecting other project runtimes. Disabled runtimes can be re-enabled through the deployment workflow.

• Improved artifact handling

  Generated files now use consistent, secure download links and clearer paths. Artifacts remain scoped to the conversation that created them.

• Better prompt-injection protection

  Agent API and ACP requests now share the same protection pipeline, with optional model-based detection for jailbreak and multi-turn attacks.

• Improved administration and troubleshooting

  Administrators can filter conversations, open a conversation directly by ID, and inspect it in read-only mode. Gateway and Codex activity can also be correlated through distributed traces.

• Runtime and compatibility updates

  The packaged Codex CLI was updated, and additional Codex integration and UI test coverage was added.