AIKIDO-2026-604998

TL;DR

In affected builds, the unified-exec zsh-fork path could mishandle user-approved sandbox decisions around permission profiles, and codex sandbox did not always enforce proxy-only networking when a configured sandbox network proxy was active. Together these could weaken intended containment: for example, denied-read restrictions might not be preserved consistently after parent command approval, or sandboxed commands could reach the network outside the configured proxy path. The fix preserves approval semantics for unified exec and enforces proxy-only containment whenever an active sandbox proxy is running.