Fouad Matin

Fouad Matin is a software engineer and product designer working on security at OpenAI. His work on Codex and Codex CLI has informed his public guidance on making code-executing agents useful while constraining what they can access and do. At AI Engineer World's Fair 2025, he worked on Agent Robustness and Control within post-training and announced the new team during his security keynote.[3][4][2]

Matin initially thought of code execution as a capability for software-engineering tasks. His view broadened as he saw agents use code for multimodal reasoning: deciphering text with OCR or cropping images to inspect them more closely, without a prompt explicitly requesting code execution. In his 2025 keynote, he predicted that “every agent will become a code-executing agent,” because running code can be the most efficient way to accomplish an objective.[4]

He argued that reasoning models could take over much of the task logic previously handled by elaborate agent orchestration: choosing tools, deciding when to execute code and managing progress. That capability shifts the deployment question toward permissions. An agent able to execute code can also follow injected instructions, leak data, install a malicious package or make an ordinary programming mistake. Matin's recommendations therefore pair model capabilities with enforceable boundaries around execution.[4]

Matin recommends giving an agent its own computer. He described Codex in ChatGPT as running in an isolated container and returning a pull request for review. For local execution, he advocated container, application or operating-system sandboxing that constrains operations even when the model attempts something unsafe. He also presented the open-source Codex CLI as a reference for people building their own agents, explaining that the team's aim included showing how to implement those safeguards.[4]

The sandbox implementations drew on existing systems and collaborators. Matin described macOS Seatbelt policies heavily inspired by Chromium's sandbox design, and a Rust implementation for Linux combining seccomp and Landlock, built with input from OpenAI's security teams. In the CLI version he presented, full-auto mode confined file reads and writes to the starting directory and restricted network calls according to approved commands, allowing tests to run without repeated approvals.[4]

His network-control argument becomes concrete in an illustrative GitHub issue: a user asks the agent to fix the issue, but its user-generated content tells the agent to retrieve the last commit and post it to an unrelated URL. Training can help the model recognize suspicious instructions; a network restriction can block the destination even if the model obeys them. Matin called system-level control the “deterministic and authoritative control” and advocated combining it with model-level defenses.[4]

Matin treats human review as essential, while acknowledging that approving every routine shell command is impractical. His concern extends beyond an agent's immediate execution: an unfamiliar dependency, or a package name differing by one character from the intended one, can enter a codebase and later run in a privileged environment. Automated code review and language-model monitors can assist, but he argues that they do not replace human judgment or provide the certainty of deterministic controls.[4]

Before his Codex work, Matin joined OpenAI's Security team after running a security startup for about six years. By his 2025 keynote, he had moved into Agent Robustness and Control within post-training. That earlier security experience supplies the career context for his work on agent safeguards; his personal website describes his broader practice as software engineering and product design and lists security at OpenAI as his work.[4][3]