相信大部分人都会为了效率设置 Codex 的 "Approve for me" 或 Claude 的 Auto 模式。遥想曾经，我最开始使用 Claude Code 时真的会审查它的几乎每一条命令，顶多开 "Accept edits" 模式。但长时间如此效率实在太低，而且不适合多任务场景。

沙箱本为隔离环境而使用，但是 "Approve for me" 模式和不使用沙箱几乎没区别了。目前沙箱最大的作用也许只是听起来安全一些：用一扇门关住 Agent 但把钥匙交给了他，用户能做的只能是期望 AI 不要抽风。更加意料之外的是，今天让 Claude 搜索沙箱配置的信息，却得知 "Claude Code 的沙箱在原生 Windows 上不运行"，而 Codex 自己实现了 Windows 沙箱（elevated 和 MXC）。

有什么办法能严格意义上实现自动化的同时保证数据安全呢？似乎最稳妥的办法只有单独设置一台机器或者虚拟机来跑这些 Agent，但又多少有些不方便。不过好消息是，Codex 和 Claude 都能给负责 approve 的分类器模型配置自定义 prompt，一定程度上阻止访问敏感文件。

Codex Desktop

对于 Codex，当使用 approvals_reviewer = "auto_review" （即 "Approve for me" 模式）时，extra_policy 只在需要审批时才起作用，沙箱中原本就允许的操作不会交给 AI 审核。

# ~\.codex\config.toml

default_permissions = "safe"
approval_policy = "on-request"
approvals_reviewer = "auto_review"

[windows]
sandbox = "elevated"

[features]
# Disable MXC because it rejects the config when FUSE drives (e.g. rclone mounts) are present alongside deny rules.
prefer_mxc = false

[permissions.safe]
extends = ":workspace"

[permissions.safe.filesystem]
glob_scan_max_depth = 4
'~\.ssh'                        = "deny"
'~\DeniedPath'                  = "deny"

[permissions.safe.filesystem.":workspace_roots"]
"**/.env*" = "deny"

[auto_review]
extra_policy = """
## Protected directories (always deny)
Deny any escalation request that would read, list, copy, move, modify, or delete
contents of the following directories, regardless of the stated justification,
and regardless of whether access is direct or indirect (via scripts, wildcards,
environment variables, path aliases, or child processes):
- C:\\Users\\<user>\\.ssh
- C:\\Users\\<user>\\DeniedPath
## Agent configuration (always deny)
Deny any escalation request that would create, modify, rename, or delete
Codex or Claude configuration, rules, or policy files, including:
- C:\\Users\\<user>\\.codex\\config.toml
- C:\\Users\\<user>\\.codex\\rules\\
- C:\\Users\\<user>\\.claude\\settings.json
- C:\\ProgramData\\OpenAI\\Codex\\requirements.toml
If the user genuinely needs access, the main agent must stop and ask the user
to perform the action themselves.
"""

# %ProgramData%\OpenAI\Codex\requirements.toml
[windows]
# Block MXC entirely, since the desktop app may still pick it despite prefer_mxc = false.
allow_mxc = false

Claude Code Desktop

对于 Claude Code，permissions 中的 deny 只会禁止自带的读写工具，并不会禁止使用 shell 进行读写。但与 Codex 不同，即使 Claude Code 在原生 Windows 下不支持沙箱，auto 模式下的 hard_deny 规则也会生效。

{
  "permissions": {
    "deny": [
      "Read(~/.ssh/**)",        "Edit(~/.ssh/**)",
      "Read(~/DeniedPath/**)",  "Edit(~/DeniedPath/**)",
      "Read(**/.env*)",
      "Edit(~/.claude/settings.json)"
    ],
    "disableBypassPermissionsMode": "disable"
  },
  "autoMode": {
    "hard_deny": [
      "$defaults",
      "Protected directories: never read, list, copy, move, modify, or delete contents of the following directories, regardless of the stated justification or user request, and regardless of whether access is direct or indirect (via scripts, wildcards, environment variables, path aliases, or child processes): C:\\Users\\<user>\\.ssh, C:\\Users\\<user>\\DeniedPath. Also never create, modify, rename, or delete Claude Code's own settings files (C:\\Users\\<user>\\.claude\\settings.json and C:\\Users\\<user>\\.claude\\settings.local.json), though reading them is allowed. If the user genuinely needs access, stop and ask the user to perform the action themselves."
    ]
  }
}