Verdict: The "free server" inside ChatGPT is the Codex cloud sandbox — an isolated Linux environment OpenAI spins up for each coding task, included with every ChatGPT paid plan from $8/month Go up to $200/month Pro. It is real compute (multiple vCPUs, gigabytes of RAM, a persistent filesystem per environment), but it is a sandboxed coding environment, not a general-purpose VPS. There is no public IP, no inbound connections, outbound traffic is proxied and restricted, and you never get a login shell — the AI agent runs commands on your behalf. For coding work (cloning repos, running tests, installing dependencies, opening PRs) it is genuinely powerful and effectively free if you already pay for ChatGPT. For hosting a website, running a background daemon, or anything requiring inbound traffic, it is the wrong tool.
Last verified: 2026-07-30 · Sandbox = isolated Linux environment per task · Included on all paid ChatGPT plans (Go $8, Plus $20, Pro $100/$200) · No public IP, no inbound, restricted+proxied outbound · You access it through the AI, not a direct shell · Pricing/limits change often — re-check before relying on numbers.
What Is the Codex Cloud Sandbox?
The Codex cloud sandbox is an isolated cloud environment OpenAI provisions for coding tasks you delegate to ChatGPT's Codex agent. Each environment is a separate Linux container with its own filesystem, preloaded with the repository and dependencies you configure. The agent — running a GPT-5 family model — reads files, runs shell commands, executes tests, and opens pull requests inside that sandbox, while you watch logs or wait for a notification. (OpenAI Codex cloud documentation)
The key insight: when you ask ChatGPT to "fix the failing tests in my repo," Codex does not run on your laptop. It clones your repo into a fresh cloud environment and does the work there. That environment has real CPU, real memory, and a real Linux filesystem — which is why people call it a "free server." But it is purpose-built for the agent, not for you to SSH into and host things.
What Specs Does the Sandbox Actually Have?
OpenAI does not publish an official spec sheet for the cloud sandbox, because the environment is ephemeral and auto-managed — you do not pick an instance size. However, the sandbox is observable from inside: when the agent runs system-inspection commands (like nproc, free, or df), it reports roughly 9 vCPUs, ~15 GB RAM, and ~60 GB of disk, with no GPU. These are shared (not dedicated) cores, and the compute spins down when no task is active, so it is not a 24/7 machine. (OpenAI Codex cloud documentation; community observations of the sandbox environment.)
For context, here is how that compares to a basic paid VPS:
| Resource | Codex cloud sandbox (observed) | Entry VPS (e.g. DigitalOcean $24/mo) |
|---|---|---|
| vCPUs | ~9 (shared) | 1–2 (dedicated) |
| RAM | ~15 GB | 4–8 GB |
| Disk | ~60 GB | 25–160 GB |
| GPU | None | None |
| Public IP | No | Yes |
| Inbound traffic | Blocked | Allowed |
| Always-on | No (spins down when idle) | Yes |
| Direct shell access | No (agent-mediated only) | Yes (SSH) |
| Monthly cost | $0 extra (included in ChatGPT plan) | $24+ standalone |
The sandbox is beefier in raw specs than a cheap VPS, but it is fundamentally locked down. You are buying coding-agent execution, not a server to host things on.
How Do You Access the Sandbox?
You do not log in directly. There are four surfaces that start work in the sandbox, all agent-mediated:
- ChatGPT web (chatgpt.com/codex) — Pick an environment, describe a task, watch it run. (OpenAI Codex cloud documentation)
- Codex CLI — The open-source terminal agent (
codex) can start cloud tasks withcodex cloud exec. Locally, it also runs in its own OS-level sandbox (Seatbelt on macOS, Landlock + seccomp on Linux). (Codex CLI documentation) - IDE extension — Start tasks from VS Code/Cursor/Windsurf.
- Integrations — GitHub PRs/issues, Linear, and Slack can all hand off work into a cloud environment. (OpenAI Codex cloud documentation)
In every case, the AI agent is the one executing commands inside the sandbox. You describe the outcome; the agent does the work. That is the model — and the constraint.
What Can You Actually Do Inside the Sandbox?
For legitimate coding work, the answer is "quite a lot." Each environment can be configured with dependencies, tools, environment variables, and secrets, so the agent lands in a workspace that already has what your repo needs. (OpenAI Codex cloud documentation)
Practical things the sandbox is good for:
- Cloning a repo and running the full test suite before opening a PR.
- Installing dependencies (npm, pip, cargo) — setup scripts can use the internet even when agent internet is off.
- Running builds, linters, and formatters on real Linux, not a toy sandbox.
- Processing files — converting, transcoding, generating — using tools installed in the environment.
- Opening pull requests directly to GitHub with the changes the agent made.
- Running multiple tasks in parallel in separate environments without tying up your laptop.
For a sense of how Codex fits into a broader agent stack — and when you'd reach for it over a local terminal agent — see our guide on building a free AI agent operating system with Hermes Agent and Obsidian.
What Can't You Do? (The Hard Limits)
This is where the "free server" framing breaks down. The sandbox is a coding environment, not a hosting platform. Three hard restrictions define what you cannot do:
No inbound connections
The sandbox has no public IP. You cannot bind a port and receive connections from the outside world. You can run a web server inside the sandbox for local testing (the agent can hit it), but nobody else can reach it. This rules out hosting a public website, running a webhook receiver, or accepting incoming SSH.
Restricted, proxied outbound traffic
Outbound network access is off by default and, when enabled, is configurable per environment with a domain allowlist and HTTP method restrictions. All outbound traffic flows through OpenAI's proxy. The Codex CLI's network proxy provides both HTTP and SOCKS5 interfaces and uses optional TLS termination (MITM) with internally generated CA certificates to inspect encrypted traffic — a powerful capability with significant trust implications. (Codex Network Proxy documentation; DeepWiki — openai/codex Network Proxy)
In the cloud sandbox, this means: UDP traffic is blocked, arbitrary domains may be blocked, and your HTTPS traffic can be inspected and filtered. You are not getting a raw internet connection.
No direct shell — the agent mediates everything
You never get a login shell on the sandbox. Every command runs through the AI agent. Even installing a tool (like htop or ffmpeg) means asking the agent to do it, and the agent's own guardrails can refuse to execute things it considers arbitrary or unsafe. The agent reviews what you ask it to run and will decline anything it judges to be a blind execution of unreviewed code. That is a deliberate safety design, not a bug — but it means the sandbox is not a box you control.
How Does the Sandbox Stay Isolated?
Codex uses layered isolation. Locally, the CLI leans on the OS: Apple's Seatbelt (sandbox-exec) on macOS, and Landlock (filesystem) + seccomp (syscall filtering) + an optional bubblewrap helper on Linux. The Linux sandbox isolates the network namespace and, in managed-proxy mode, routes all tool traffic through a TCP→UDS→TCP bridge to configured proxy endpoints. (openai/codex linux-sandbox README)
In the cloud, each task runs in an isolated container preloaded with your repo. The agent has three sandbox policy modes — read-only, workspace-write (default), and danger-full-access — controlling file access and network. (Codex CLI reference)
For a deeper look at how Codex's sandbox modes compare to other agent-safety approaches, our writeup on the Humalike Hermes plugin for agent social intelligence covers a complementary angle on how agents are sandboxed for safe interaction.
Which ChatGPT Plans Include the Sandbox?
Codex — and with it the cloud sandbox — is included in every paid ChatGPT plan. As of July 2026:
| Plan | Price | Codex access |
|---|---|---|
| Free | $0 | Limited Codex for quick tasks |
| Go | $8/month | Lightweight tasks, higher limits than Free |
| Plus | $20/month | Full Codex across web, CLI, IDE, iOS |
| Pro (5x) | $100/month | 5x Plus rate limits |
| Pro (20x) | $200/month | 20x Plus rate limits, highest individual usage |
| Business | $25/user/month ($20 annual) | SSO, MFA, no default training, min 2 users |
| Enterprise | Custom | SCIM, EKM, RBAC, audit logs, data residency |
Sources: OpenAI Codex pricing; OpenAI ChatGPT pricing (verified July 2026).
The practical takeaway: if you already pay $20/month for ChatGPT Plus, the sandbox is effectively free — it costs nothing extra. If you don't pay for ChatGPT, the sandbox is not a reason to start; a $5/month VPS from any provider is a better "free server" for hosting and general-purpose compute. For a full breakdown of every free path to using Codex (including the open-source CLI with your own API key), see our guide on how to use OpenAI Codex for free in 2026.
How Is the Sandbox Different From a Real VPS?
| Capability | Codex cloud sandbox | Real VPS |
|---|---|---|
| Run a public web server | No (no inbound) | Yes |
| Host a database for external clients | No | Yes |
| Run a background daemon 24/7 | No (spins down) | Yes |
| Install system packages freely | Agent-mediated, may be refused | Yes (root) |
| SSH in directly | No | Yes |
| Clone a repo and run tests | Yes (excellent) | Yes (manual) |
| Open a PR from completed work | Yes (automated) | No (manual) |
| Pay per use, no idle cost | Yes (included in plan) | No (pay always-on) |
| Inspect/filter outbound traffic | Yes (proxied, MITM-capable) | No (raw internet) |
The sandbox wins for delegated coding work; a VPS wins for hosting and background services. They are different tools for different jobs.
What This Means for You
If you are a developer or small team already on ChatGPT Plus, the Codex cloud sandbox is a genuine productivity unlock hiding in your subscription. Stop spinning up a VPS every time you need to run a heavy build, test a repo against a real Linux environment, or process a batch of files — delegate it to Codex and let the sandbox do the work. The fact that it opens PRs directly to GitHub makes it a coding agent, not just a sandbox.
If you are hoping to use it as a free VPS to host a side project, run a Discord bot, or serve a webhook: stop. The sandbox is not designed for that, and fighting its restrictions (proxied outbound, no inbound, agent-mediated shell, idle spin-down) will cost more time than a $5/month VPS from DigitalOcean, Hetzner, or Fly.io. For background-process use cases, pair a cheap VPS with an AI agent operating system like Hermes Agent for orchestration — that combination gives you a real always-on server plus the agent layer.
If you are thinking about security: the sandbox's MITM-capable proxy, TLS inspection, and restricted egress are features, not obstacles, for most teams. They make Codex safer to hand a production repo than a raw VPS where an agent has unrestricted internet. For enterprises, the Business and Enterprise tiers add SSO, MFA, no-default-training, and audit logs on top. (OpenAI Codex pricing)
FAQ
Q: Is the ChatGPT Codex sandbox really free? A: It is included in every paid ChatGPT plan (from $8/month Go to $200/month Pro) at no extra cost, and is available in limited form on the Free tier. It is "free" in the sense that there is no separate sandbox fee, but you need a paid ChatGPT plan for meaningful use. The open-source Codex CLI can also run locally with your own API key, billing per token. (OpenAI Codex pricing)
Q: Can I SSH into the Codex cloud sandbox? A: No. You never get a direct shell. All commands inside the sandbox are executed by the AI agent on your behalf. You can ask the agent to run any command, but it reviews requests and may decline anything it considers unsafe or arbitrary. (OpenAI Codex cloud documentation)
Q: Can I host a website on the Codex sandbox? A: No. The sandbox has no public IP and does not accept inbound connections. You can run a server inside the sandbox for local testing (the agent can hit it), but no one outside can reach it. For hosting, use a real VPS or a platform like Vercel, Cloudflare Pages, or Fly.io.
Q: Does the sandbox have internet access? A: Internet access is off by default and is configurable per environment with a domain allowlist and HTTP method restrictions. When enabled, all outbound traffic flows through OpenAI's proxy, which can inspect HTTPS traffic via TLS termination. Setup scripts can use the internet to install dependencies even when agent internet is off. (Codex cloud documentation; Codex network proxy documentation)
Q: Is the Codex sandbox safe to give access to my production repo? A: The sandbox is designed for isolation: each task runs in a separate container, network is restricted and proxied, and the Business/Enterprise tiers add SSO, MFA, and no-default-training. It is generally safer than running an agent with root on a raw VPS. However, the proxy's TLS inspection means OpenAI can technically see your traffic — review your org's data-handling requirements before connecting sensitive repos.
Q: How much compute does the sandbox have? A: OpenAI does not publish official specs, but the environment reports roughly 9 shared vCPUs, ~15 GB RAM, and ~60 GB disk, with no GPU. The compute spins down when no task is active, so it is not a 24/7 machine. That is plenty for builds, tests, and file processing, but not for GPU workloads.
Q: What is the difference between the Codex cloud sandbox and the Codex CLI? A: The cloud sandbox runs in OpenAI's cloud (chatgpt.com/codex) — you delegate tasks and review PRs. The Codex CLI is an open-source terminal agent that runs locally on your machine in its own OS-level sandbox (Seatbelt on macOS, Landlock on Linux). The CLI can also start cloud tasks. Both use the same GPT-5 model family. (Codex CLI documentation)
Discussion
0 comments