ChatGPT Agent Sandbox: Files, Access and Boundaries

A ChatGPT agent sandbox is a controlled execution environment that separates delegated work from other systems, subject to the access it receives. The former ChatGPT agent is no longer available; OpenAI directs users to ChatGPT Work. For a current task, check whether it runs in the cloud or uses an authorized local computer before making assumptions about isolation.

Tools like fenbs keep approved work rules and checkpoints outside that execution environment. They give the next session a record of what was authorized, without treating the word sandbox as a promise that every action is harmless.

What does the sandbox label actually tell you?

A sandbox limits some ways a program can interact with its surroundings. It does not explain every file permission, network destination, signed-in account or tool available inside it. Those details determine what a particular task can affect. Ask about the specific environment instead of using isolation as a substitute for an access review.

OpenAI's former agent help page↗ (opens in a new tab) now points to Work for longer tasks and finished deliverables. If an older tutorial promises a particular agent terminal or virtual computer, check the current product guidance before following it. A historical screenshot cannot establish the capabilities in your account.

The important distinction is the boundary around the actual work: where the tools run, which inputs reach them and where outputs can go. For the broader experience, see our agent mode guide; this article focuses on checking those boundaries before granting access.

Where does the work run, and can it read local files?

OpenAI's Work and Codex documentation↗ (opens in a new tab) distinguishes cloud Work from local desktop work. Work on web and mobile runs in the cloud; supported desktop Work can use local files and apps with permission. Local execution does not mean that messages and task context remain only on that computer.

Before starting, describe the permitted input folder and intended output. A request to summarize three supplied files does not need an entire department archive. If a task changes location or needs another tool, review the new access rather than assuming your first approval covered every later step.

Does terminal access mean unrestricted access?

A terminal is an interface for running commands in an environment. It does not automatically mean access to your own computer, and it does not prove that commands are harmless. Check the selected product, active environment and tool permissions before interpreting a command log or authorizing a shell operation.

OpenAI treats Work and Codex as distinct experiences, with Codex dedicated to software development. Do not transfer a Codex setup assumption into a Work task merely because both can help produce files. Our ChatGPT and Codex guide covers that broader distinction; agent API work is another separate scope.

Ask for a plain description of a proposed operation: which file changes, whether anything leaves the environment, and how you will check the output. If a command is unfamiliar, have someone qualified review it. A task that only needs to format a report should not quietly acquire permission to alter unrelated systems.

What changes after you sign in to a website?

A remote browser can affect the account you authorize even though it runs on a different computer. OpenAI's cloud browser guide↗ (opens in a new tab) says it has its own browser data and sessions, separate from your device's browser. Review the site and account during sign-in, and use the secure sign-in flow rather than putting credentials in the conversation.

Website access and approval of a consequential action are separate choices. Allowing access to an accounting site does not explain whether you intended a draft, an update or a payment. Specify the allowed action and the point where the assistant must stop for review.

When the task ends, consider whether the signed-in session should remain available. The cloud browser guide explains clearing stored browser data and signing out. Treat that cleanup as part of the job, especially when a one-time task used an account with broader permissions than the task required.

Which checkpoints should you set before delegation?

Choose checkpoints around meaningful consequences. For a hypothetical expense review, the assistant might read a fictional export, draft a discrepancy report and stop before updating any live record. A person checks the report and authorizes a specific next action. That is easier to review than a broad request to handle expenses.

• Inputs: which files and accounts are necessary, and which are excluded?
• Actions: may the assistant read, draft, edit or submit, and where must it pause?
• Outputs: where should the result be saved, and who checks its accuracy?
• Unexpected instructions: stop when external content asks for unrelated access or changes to the task.

For managed workspaces, OpenAI's Agent Security guidance↗ (opens in a new tab) distinguishes mandatory requirements from starting defaults and explains local work sync. Have the administrator verify the controls that actually apply. The AI governance library covers related review questions.

Keep the agreed stop points in fenbs Decisions and rules, then save whether each checkpoint was reached. The useful handoff says the report was drafted and checked, while live updates still await a named person's approval.

How to do this with fenbs

1. Create a free account and add a project for the delegated workflow.
2. Create a task describing the intended result, permitted source locations and review checkpoints. Keep credentials and confidential originals out of the record.
3. Record the person's approved boundaries in Decisions and rules. Keep questions that still need authorization open.
4. Ask your connected assistant to read context before starting. Save progress with the execution location, checks performed and next approved step before it stops.

fenbs does not provide a sandbox or enforce operating-system, browser or network permissions. Use the execution environment's own controls for those boundaries. fenbs fits when you need the work instructions, approval history and handoff to survive a change of tool or session.