Keep network and secrets controlled
Internet access is a separate risk
After this, you'll be able to decide when network access is needed, limit cloud internet access, and keep secrets out of task prompts.
Before you start
Complete Approve commands by risk first.
The idea
Network access changes the threat model. A local test command and a command that reaches the internet are not the same risk, even if both are common in software work.
Here is the before and after: before, Codex is guessing from a loose request. After, you can decide when network access is needed, limit cloud internet access, and keep secrets out of task prompts.
Now try it use the exercise prompt on one real repo task. Keep the output small enough to check before you accept the change.
You are ready when the Codex action, boundary, and proof all match the task.
Try it (12 min)
Watch out for
- Turning on unrestricted internet because one dependency failed.
- Letting Codex follow instructions from an issue, README, or web page without treating them as untrusted.
- Pasting secrets into the chat so the task can move faster.
- Forgetting to inspect logs for leaked tokens.
Paste this into Claude
Decide network and secret access for this Codex task: Task: [describe task] Needs package install: [yes/no/unknown] Needs docs or web: [yes/no/unknown] Needs API credentials: [yes/no/unknown] Environment: [local, app, IDE, cloud] Return: 1. Whether network access is needed. 2. Which domains or methods should be allowed if cloud internet is needed. 3. How secrets should be supplied without pasting them into the prompt. 4. What proof should confirm no secret was exposed.
What a good response looks like
Network is needed only for npm install and OpenAI docs. Allow registry.npmjs.org and developers.openai.com. No API key in prompt. Use local .env already present, and verify git diff plus terminal output does not print the key.
What good looks like
- Network is enabled only when the task needs it
- Allowed domains or methods are named when possible
- Secrets are not pasted into the prompt
- The proof checks logs, diffs, or config for accidental exposure
When this breaks
- Breaks when Codex follows hostile instructions from untrusted web content.
- Breaks when a key appears in terminal output or a committed file because secret handling was not planned.
AI can help with this
Use Codex to help you you can decide when network access is needed, limit cloud internet access, and keep secrets out of task prompts. Start with the exercise prompt and your real input. Ask for one draft, then check it against this proof: Network is enabled only when the task needs it. Accept only the version you can verify yourself.
You can now
You can decide whether network access is needed
- You can limit domains and methods
- You can keep secrets out of prompts
- You can verify no secret leaked
Key takeaways
Network and secrets are separate from normal repo editing. Grant the smallest access that can finish the task.
- Cloud agent internet access is off by default during the agent phase.
- Internet access raises prompt-injection and data-exfiltration risk.
- Domain and method limits reduce blast radius.
- Secrets belong in controlled setup, not chat prompts.