Windows Admin-Elevated Processes Are Off-Limits to ChatGPT and Codex Computer Use

In my previous post I worked out a design for handing QA testing to an AI agent driven by OpenAI’s GPT-6 Astra and the Computer Use API. One of the placements I recommended was running Codex alongside the ChatGPT desktop app and Codex on a Windows development machine and letting Computer Use walk through the feature under construction. Right after publishing that, I ran into a wall the design cannot cross. Any window that belongs to an admin-elevated process is completely off-limits to a Computer Use agent that runs as a standard user.

The symptom is straightforward. Aim Computer Use at “Command Prompt (Admin),” “PowerShell (Admin),” Hyper-V Manager, Services, Task Scheduler, the Group Policy Editor, some Docker Desktop admin dialogs, or IIS Manager, and neither clicks nor keystrokes register. No error dialog is raised. The agent believes it clicked, marks the tool call as successful, and moves on to the next reasoning step, while the target window has not moved a pixel.

What the OS Is Actually Doing

The cause sits in two Windows features introduced in Vista: Mandatory Integrity Control (MIC) and User Interface Privilege Isolation (UIPI).

MIC assigns one of four integrity levels (Low, Medium, High, System) to every process and object, and prevents a lower-integrity process from writing to, or controlling, higher-integrity ones. A desktop app started as a standard user runs at Medium integrity. Anything you launch through UAC (User Account Control) elevation, “Run as administrator,” runs at High integrity.

UIPI applies that same idea to the GUI layer. In the Medium → High direction the following operations are blocked:

Sending window messages via SendMessage or PostMessage to a higher-integrity window
Installing hooks on higher-integrity processes with SetWindowsHookEx
Delivering synthetic input via SendInput or keybd_event into a higher-integrity window
Reading or writing memory and handles of a higher-integrity process

Taking screenshots and reading pixel or coordinate data stays on the safe side of that boundary in almost every case, so the agent can still see the screen correctly. That is what produces the confusing failure shape: the agent captures a correct screenshot, its click API returns success, and the target window nevertheless registers nothing. The asymmetry is why the failure is silent.

What Happens Inside Computer Use

Computer Use in the ChatGPT desktop app delivers the model’s chosen clicks and keystrokes through the OS mouse and keyboard APIs. As long as the app itself is launched by a standard user (no UAC elevation), its input is emitted at Medium integrity, and UIPI silently drops it before it reaches a High-integrity target.

“Just right-click the ChatGPT desktop app and Run as administrator” is the first workaround anyone thinks of, but the path is unattractive for two reasons.

First, the ChatGPT desktop app installer places binaries under the user profile (a path like %LocalAppData%\Programs\ChatGPT\), a per-user installer pattern in the Squirrel.Windows family. That layout avoids UAC prompts for auto-update by dropping executables into a user-writable location instead of Program Files. Running it as administrator then means starting a high-integrity process from a directory the standard user can still overwrite, which is exactly the shape corporate EDR and antivirus tools flag as a local privilege-escalation path.

Second, the moment ChatGPT runs elevated, the direction of the isolation flips. Everyday apps (Explorer, browsers, IDEs) still run at Medium integrity, so drag-and-drop, clipboard integration, and some window-focus behaviors between them and the elevated ChatGPT app stop working the way they normally do. If the goal is to let Computer Use walk through the developer’s ordinary work screens, that side effect keeps biting.

The uiAccess Escape Hatch, and Why Nobody Is Using It

UIPI has a deliberate escape hatch for accessibility software: the uiAccess="true" attribute in an application manifest. An app that declares it, meets the requirements below, and asks for its uiAccess privilege at launch is allowed to deliver input to higher-integrity windows.

Signed with a valid publisher certificate
Installed into a secure path that standard users cannot modify (typically Program Files)
Manifested with uiAccess="true"

Well-known examples of software that takes this route include the built-in Narrator screen reader and remote-control tools such as TeamViewer and AnyDesk.

For a Computer Use client to take the same route, it would have to answer the users’ and IT admins’ reasonable follow-up question: what stops any signed binary from claiming uiAccess and driving the entire UAC boundary? The ChatGPT desktop app and the Codex CLI have not taken this path. As a result, a plain install of the commercial client leaves the AI tester unable to reach any High-integrity window.

Where This Bites in Practice

The operations that essentially demand admin elevation on Windows include:

Hyper-V Manager and some management commands for the Windows Subsystem for Linux (WSL)
Services (services.msc), Event Viewer (eventvwr.msc), Task Scheduler (taskschd.msc)
The Group Policy Editor (gpedit.msc) and the Local Security Policy console
IIS Manager and SQL Server Configuration Manager
Any Windows setting whose entry point carries the UAC shield icon
Editing hosts, files under C:\Windows\System32\drivers\etc\, and any write to the HKEY_LOCAL_MACHINE hive of the registry
Running MSI installers and most driver installs
Some admin dialogs in Docker Desktop (Hyper-V integration and networking settings, for instance)

Of the placements I recommended in the previous post (“run Codex alongside ChatGPT Computer Use on the developer’s local machine”), any flow that touches the list above is not something to hand off to the AI tester. Conversely, web-app front ends, dashboards that live entirely in the DOM, and business apps installed under Program Files that run as a standard user still work as before under Computer Use. The line is “does this touch Windows OS administrative surface,” not “is this a business app.”

Workable Detours, and What They Cost

If you still want the AI tester to drive admin-elevated surface, each detour carries a real cost.

The first is running the AI tester and the target application together inside a Windows Sandbox instance or a Hyper-V virtual machine. Inside the VM you can put both processes on the same side of the integrity-level boundary, elevate the AI tester alone, and let it drive the target windows. It also has the useful property of not leaking the agent’s privileges to the host, so registry rewrites and sensitive-data experiments stay contained. The cost is the setup and data seeding for the VM.

The second is running the Computer Use API with a caller-supplied runner that is explicitly elevated (a Windows Server VM, or an agent process you start as administrator on the host), and wiring the model’s tool calls into that runner instead of into the ChatGPT desktop app. Replacing the desktop app’s built-in Computer Use with a caller-side control layer like trycua’s cua-driver lets you pick the integrity level of the host process yourself. It is the API-first design pattern I outlined in the previous post, and it is the more natural fit for anything you want to run inside CI.

The third is reducing the target application’s dependence on admin elevation. Move to the web-based admin console when there is one, push hosts overrides into a development DNS zone instead of editing the file on the Windows machine, and so on. Rewriting production tooling for the AI tester’s sake alone is a poor trade, but the same pressures (local reproducibility, CI automation, audit logs) are already pushing away from admin-only workflows, so if you can bundle the work with those, the cost curve reads reasonably.

The fourth is shipping an in-house host launcher that carries uiAccess="true", signed by your organization and installed under Program Files, and dispatching Computer Use tool calls through it. Technically viable, but it needs a signing workflow, a Program Files deployment policy, and IT’s agreement that “add one more UAC exception on the dev machine” is acceptable. Too heavy for a small R&D loop; reasonable only when you are ready to maintain it as durable QA infrastructure.

How This Reshapes the AI-Tester Placements

Overlaying this boundary on the four placements from the previous post gives:

The developer’s local environment (ChatGPT desktop app running alongside Codex) can still take on screens and business apps that finish inside a standard-user integrity level. Anything that requires admin surface is explicitly not the AI tester’s job in this placement. Either the developer drives it by keyboard, or the scenario moves to placements two or three.

Per-PR exploration and the nightly broad sweep were already designed to run on CI or cloud runners. Carving out one runner that runs elevated on that side is enough to cross the boundary. If you design the API-based Computer Use loop so that each target application picks the integrity level of its runner, you do not get stuck at this step.

Replacing the manual-QA entry point maps cleanly onto this constraint as well. Scenarios that involve admin surface are safer for a human QA to keep, and standard-user scenarios move to the AI tester’s first pass. The general principle “spend human time on what the AI tester is weak at” gains one more concrete item on the human side: Windows admin surface.

What to Remember

Windows Mandatory Integrity Control and UIPI intentionally cut off GUI input from Medium integrity to High integrity; this is an OS feature, not a bug in Computer Use.
Neither the ChatGPT desktop app nor the Codex CLI takes the uiAccess="true" escape hatch, so they stay on the same side of the boundary as any standard-user app.
To let an AI tester drive admin-elevated tools, pick either the VM route or the API-based Computer Use with an admin-elevated runner.
For the local Computer Use loop, scope the AI tester’s job to “screens that finish inside a standard-user integrity level” and put Windows admin surface explicitly outside its remit.

That’s all from mapping where UIPI puts admin-elevated processes out of reach of Computer Use, from the Gemba.

Search

Windows Admin-Elevated Processes Are Off-Limits to ChatGPT and Codex Computer Use — Where UIPI Draws the Line