title: "OpenAI Codex rust-v0.157.0 Hardens Network and MCP Trust Boundaries (and Quietly Removes the Ultrafast Tier on GPT-5.6 Sol)" slug: openai-codex-v0-157-0-network-mcp-trust-boundaries-ultrafast-removal-sep-2026 date: 2026-09-25 author: Mr. Technology pillar: true published: true status: published publishedAt: 2026-09-25T12:14:00Z cover_image: '' primary_sources:
excerpt: "OpenAI shipped Codex rust-v0.157.0 with network restrictions now enforced across redirects and WebSocket traffic, Unix local MCP servers restricted to stdio-only, and the ultrafast tier removed from GPT-5.6 Sol — three changes that will break silently-working agent setups."
OpenAI published rust-v0.157.0 on September 24–25, 2026 (atom feed updated 2026-09-25T05:09:53Z). The release is a security-hardening and trust-boundary tightening release that also quietly removes a feature — the ultrafast service tier — that was announced less than six weeks ago. The headline items, verbatim from the GitHub release page:
This is a documentation comparison article. All claims are sourced verbatim from the GitHub release notes, PR descriptions, and commit messages. No live Codex invocation was made in this run.
Before v0.157.0, Codex enforced egress allow-list rules on the initial HTTP request only. Redirects that landed outside the allowed list, and ongoing WebSocket traffic after a policy change, were not blocked. v0.157.0 closes that gap: network restrictions are now enforced "across redirects and ongoing HTTP and WebSocket traffic, including cancellation when policy changes revoke access." If your Codex agent runs in a CI environment with a restricted egress policy and a redirect hops outside your allow-list, that redirect will now fail rather than silently succeed. If a policy change revokes access mid-session, active WebSocket streams will be cancelled.
PR #47094 restricts Unix local MCP servers to stdio descriptors. Any MCP server that relies on a Unix socket, pipe, or file descriptor beyond stdin/stdout/stderr will fail in v0.157.0. This is a narrowing of the attack surface: local MCP servers can no longer use ancillary file descriptors to exfiltrate data or receive unexpected input through side channels.
PR #47079 masks daemon socket paths exposed through ancestor bind mounts. This closes a path-confusion vector where a bind-mounted directory could cause Codex to write a socket file to an unintended location, potentially exposing it to processes on the host.
Proxy configuration was previously not honored for realtime WebSocket connections and for standalone web search. v0.157.0 fixes both: "Fixed configured proxy routing for realtime connections and standalone web search, including search redirects." If you run Codex behind an enterprise proxy, voice conversations and web search results should now route through it correctly.
PR #47132 adds support for caller-provided MITM (man-in-the-middle) certificate authorities in the network proxy. This enables inspection of Codex traffic in environments that terminate TLS for security auditing — a common requirement in regulated or high-security deployments.
PR #47130 removes the ultrafast service tier from gpt-5.6-sol. The ultrafast tier was announced on August 13 as a limited-preview option offering "up to 14x faster than Standard processing" for GPT-5.6 Sol. The removal in v0.157.0 means any production call or configuration that pins service_tier: "ultrafast" or speed: "ultrafast" against gpt-5.6-sol will return an error. The standard and fast tiers remain available.
PRs #47332 and #47347 add Amazon Bedrock support for GPT-6 Sol and GPT-6 Luna, including migration prompts for older models. This means Codex can now route GPT-6 Sol and Luna calls through Bedrock credentials and infrastructure, not just the OpenAI API directly.
The ultrafast removal is the highest-urgency operational change. Any team that pinned service_tier: "ultrafast" or speed: "ultrafast" on gpt-5.6-sol calls — whether in a Codex agent config, an API wrapper, or a deployment template — will see errors on first request after upgrading to v0.157.0. This is not a gradual degradation; it is a hard failure. If your cost model or throughput expectation is built on ultrafast performance, that assumption is now stale.
Network restriction enforcement on redirects breaks allow-list assumptions. If your egress policy allows only specific hosts and you have redirects in your agent's web search, file download, or tool-call paths, those redirects may now be blocked. The old behaviour — where redirects were silently followed regardless of policy — was a gap. v0.157.0 closes it, which is the right security move but will break setups that depended on the gap.
Unix MCP stdio restriction is a breaking change for non-compliant servers. Any MCP server implementation that opens Unix domain sockets or uses file descriptors beyond stdin/stdout/stderr will fail in v0.157.0. This is a supply-chain security hardening, not a user-facing feature, but if you run custom MCP servers on Unix systems, audit them before upgrading.
The MITM CA addition is an enterprise unlock, not a breaking change. If you are in a regulated environment that requires TLS inspection, v0.157.0 now supports your CA bundle. If you are not in that situation, this change does not affect you.
Proxy routing for realtime and search is a bug fix with real consequences. If you run Codex in an enterprise environment with a mandatory proxy and you use voice conversations or web search, those were not going through the proxy before. That is now fixed. If you have explicit proxy exceptions for those paths, you may need to revisit them.
All claims are documentation comparisons. No live Codex invocation was executed in this run.
Primary sources, verified verbatim at fetch time:
https://github.com/openai/codex/releases/tag/rust-v0.157.0. All feature and bug fix descriptions in What Actually Changed are verbatim from this page, fetched 2026-09-25T12:09 UTC.https://github.com/openai/codex/releases. Full changelog URL listed as comparing rust-v0.156.0...rust-v0.157.0.Specific verbatim excerpts:
"Enforced network restrictions across redirects and ongoing HTTP and WebSocket traffic, including cancellation when policy changes revoke access." — PRs #47389, #47407.
"Restricted Unix local MCP servers to stdio descriptors." — PR #47094.
"Mask daemon socket paths exposed through ancestor bind mounts." — PR #47079.
"Fixed configured proxy routing for realtime connections and standalone web search, including search redirects." — PRs #47101, #47142, #47204.
"Add a partial index for agent message board root posts." — PR #47063.
"Mask daemon socket paths exposed through ancestor bind mounts." — PR #47079.
"Track cumulative MCP attribution across requests and thread history." — PR #47081.
"Support caller-provided MITM CAs in the network proxy." — PR #47132.
"Remove the ultrafast service tier from gpt-5.6-sol." — PR #47130.
"Added GPT-6 Sol and Luna, including Amazon Bedrock support and migration prompts for older models." — PRs #47332, #47347.
Independent corroboration: the OpenAI changelog at https://developers.openai.com/api/docs/changelog was verified 2026-09-25T12:09 UTC. The August 13, 2026 entry announcing the ultrafast tier reads: "Announced Ultrafast mode, a new API service tier for GPT-5.6 Sol that runs up to 14x faster than Standard processing. Available in limited preview to select customers." The removal in v0.157.0 reverses that announcement. The changelog has not yet been updated to reflect the removal (the latest visible entry is September 22, 2026).
What this article did not independently verify:
Cost. No new OpenAI-side fees are introduced by v0.157.0. The standard, fast, and batch pricing tiers for GPT-5.6 Sol and GPT-6 Sol/Luna are unchanged. The ultrafast tier removal means teams that were using it at no additional per-token cost (limited preview participants) will now use standard or fast pricing — the effective cost per call goes up for those users.
Risk. Three concrete risks for existing Codex v0.156.x stacks:
1. Ultrafast tier removal breaks pinned service_tier configurations. Any config, script, or wrapper that sets service_tier: "ultrafast" or speed: "ultrafast" for gpt-5.6-sol will return an error. Audit your codebase before upgrading. 2. Network restriction enforcement on redirects may break egress-allow-list setups. If your agent uses tools that follow redirects to hosts outside your allow-list, those will now fail. Test your full agent workflow against v0.157.0 in a staging environment before upgrading production. 3. Unix MCP servers using non-stdio descriptors will fail. If you run a custom MCP server on Unix that opens Unix sockets or uses ancillary file descriptors, it will not work in v0.157.0. Migrate to stdio-based communication.
A subtler risk: the MITM CA addition requires certificate chain configuration in the network proxy. If you configure a CA incorrectly, you may create a TLS verification failure that blocks all Codex traffic — test any MITM configuration carefully before rolling it out.
Limitations. The removal of the ultrafast tier from gpt-5.6-sol is documented from the PR description only; the OpenAI API changelog has not yet been updated to reflect the removal. The exact error code and message when a pinned ultrafast call is made is not independently verified. The Bedrock support for GPT-6 Sol/Luna is documented as shipped but no live Bedrock credential test was executed.
This is a security-first release dressed up as a regular update, and that is exactly what you want from a CLI that handles your codebase and CI environment. The network restriction enforcement, MCP stdio restriction, and daemon socket masking are all correct defensive moves. They will break some things — that is the point.
The ultrafast tier removal is the story that will generate support tickets. A feature announced less than six weeks ago as "available in limited preview to select customers" is already gone. If you were one of those customers, your throughput assumptions need to be rebuilt around standard or fast pricing. The "limited preview" framing was always a signal that this was experimental, but "experimental" usually means you get to keep using it while it's in preview, not that it vanishes six weeks later.
For the security hardening: upgrade when you can, test your egress policies and MCP servers first, and remove any ultrafast pinning before you do.
Before upgrading to Codex rust-v0.157.0:
1. Audit ultrafast tier usage. Search your codebase, configs, and deployment templates for service_tier: "ultrafast", speed: "ultrafast", and any reference to ultrafast on gpt-5.6-sol. Remove those references before upgrading. Replace with service_tier: "auto" (the default) or an explicit standard/fast tier.
2. Audit egress allow-lists against redirect behaviour. If your Codex agent makes outbound requests that may redirect (web search, file downloads, MCP tool calls), verify that all possible redirect targets are in your allow-list. Any redirect outside the list will now be blocked.
3. Audit Unix MCP server implementations. If you run custom MCP servers on Unix systems, verify they communicate exclusively over stdio. Any that use Unix sockets, named pipes, or non-stdin/stdout/stderr file descriptors will fail in v0.157.0.
4. Test in staging before production. The network restriction enforcement is a behavioural change with real consequences for CI environments with egress policies. Run your full agent workflow in a staging environment before upgrading the production install.
5. If you use a corporate MITM proxy: review the new MITM CA configuration options in v0.157.0 and test your certificate chain before rolling out. A misconfigured MITM CA will block all traffic.
6. If you use GPT-6 Sol or Luna through Bedrock: the Bedrock support is new in this release. Verify your Bedrock credential configuration works with the new Codex routing before relying on it in production.