I run Codex in a sandbox locked to the directory it is working in.