OpenAI shipped Codex CLI 0.160.0, tagged rust-v0.160.0, on October 1, 2026, with fixes for Windows sandbox behavior involving PowerShell and long file paths. The release also addresses resume behavior for queued messages, a detail that matters to anyone running Codex CLI in automated or long-lived sessions where a dropped or mishandled message queue can silently break a workflow.
The release note groups seven changes together: command-center history, Linux X11 middle-click paste, workspace-default sessions, an opt-in Guardian review context, queued-message resume, provider settings persistence, and the Windows sandbox fixes. That span, from clipboard behavior on Linux to path handling on Windows, suggests a maintenance release addressing accumulated platform-specific friction rather than a single coordinated feature push. No security patch is stated in the release.
Windows users running Codex CLI inside sandboxed environments have reported friction with PowerShell invocation and long paths before, the kind of defect that does not block basic use but does break automation scripts or CI pipelines that depend on consistent path resolution. Fixing both in one release indicates the two issues were related or at least triaged together. Provider settings persistence, listed separately, implies a prior release did not reliably retain configuration across sessions, though the exact scope of what failed or for how long is not disclosed.
For operators running Codex CLI in Windows-based CI or sandboxed developer environments, the practical step is to re-test any scripts or wrappers that previously included workarounds for path length or PowerShell quirks, since those workarounds may now be unnecessary or could conflict with the fix. Teams relying on queued-message resume for long sessions should verify that in-flight queues from before the upgrade resume cleanly rather than assuming continuity. The Guardian review context is opt-in, so its absence by default means no behavior changes unless explicitly enabled, which limits immediate risk but also limits immediate benefit.
What the release does not establish is whether the Windows fixes resolve all known sandbox issues on that platform or only the specific PowerShell and long-path cases named. It also does not disclose whether provider settings persistence failures caused any data loss or just required re-entry of configuration. Absent a stated security patch, there is no indication this release addresses any vulnerability, which means organizations should treat it as a stability and workflow update rather than an urgent security upgrade.
Anyone validating the Windows fixes should script a long-path test case and a PowerShell-invoked sandbox run before rolling the upgrade across a fleet, since release notes describe the fix category but not the exact reproduction conditions OpenAI used to confirm it.