OpenAI’s November 13, 2026 release of Codex CLI changes a permission rule for unattended coding jobs. Allowing Codex to edit project files no longer lets it load settings and tool connections from an untrusted repository. The change ships in version 0.169.0.
For software teams running scheduled coding or review tasks, the practical question is whether a job depends on settings stored inside the project’s code folder. Jobs that previously relied on file-write access to activate those settings need an explicit trust decision or a different configuration source—not every automated job needs a new flag.
Which jobs need attention?
Repositories can carry a .codex/config.toml file defining settings and MCP connections—links to tools through the Model Context Protocol. The release keeps untrusted project configuration and its MCP servers disabled even with --sandbox workspace-write. OpenAI’s release notes identify that specific change.
According to OpenAI’s configuration guidance, project settings load only when the project is trusted; user and system settings remain separate. That distinction gives operators three cases to check:
Already trusted: confirm that the automated job uses the expected saved trust decision. The implementation leaves an existing trusted decision unchanged.
Not yet trusted, but project settings are needed: review the repository’s settings and tool commands before granting trust. Do not add the flag indiscriminately to every job.
Intentionally untrusted: retain that decision and avoid depending on the repository’s settings. Where appropriate, supply necessary reviewed settings through an operator-controlled user or system configuration instead.
Trust lasts beyond the job
The new --trust option on codex exec and codex review saves a project trust decision for current and future sessions. OpenAI’s implementation description includes MCP commands that run outside the sandbox within that decision. Review what those commands do before authorizing the project; trust is more than permission to edit files.
The grant persists even when an exec run uses --ephemeral. That option suppresses session-file storage, not the saved trust decision, as the shipped flag documentation makes clear. For a machine that retains its user configuration between jobs, the practical implication is that a later run can inherit the earlier authorization.
There are also two deliberate limits: --trust refuses a project explicitly saved as untrusted, and it cannot be combined with --ignore-user-config. The runtime checks saved decisions before granting trust; the new option is not an override for a recorded refusal.
Check tools, not just the exit status
OpenAI’s checked-in integration test specifies a run that succeeds with file-write access while an untrusted project’s MCP configuration is skipped—even though that configuration marks its server as required. The test uses simulated responses and a deliberately non-working tool command; it describes expected software behavior, not a production incident.
The operational lesson is to inspect warnings about disabled project configuration and confirm that the intended tool connections loaded. A successful exit alone does not establish that a job had the tools its operator expected.
For background on the separate roles of tools and execution permissions, see RohitAI’s earlier Codex plugins and remote-execution analysis.