diff --git a/codex-rs/mxc-sandbox/src/native.rs b/codex-rs/mxc-sandbox/src/native.rs
index 9c61518318..b0657fd3c1 100644
--- a/codex-rs/mxc-sandbox/src/native.rs
+++ b/codex-rs/mxc-sandbox/src/native.rs
@@ -33,8 +33,30 @@ pub(super) fn launch(request: &ExecutionRequest) -> Result<i32> {
     let mut logger = Logger::new(Mode::Buffer);
     let mut child = BaseContainerRunner::new()
         .spawn(request, &mut logger, StdioMode::Inherit)
-        .map_err(|error| anyhow::anyhow!("{}", error.error_message))?;
+        .map_err(|error| match create_process_error(&error.extended_error) {
+            Some(code) => anyhow::anyhow!(
+                "{} (CreateProcessW, Win32 error {code})",
+                error.error_message
+            ),
+            None => anyhow::anyhow!("{}", error.error_message),
+        })?;
     // Do not publish the SDK diagnostic buffer: it may contain command or
     // environment data. This wrapper emits only the resulting launch error.
     child.wait().context("waiting for the MXC command")
 }
+
+// The SDK appends the working directory and other diagnostics to this field.
+// Only the Windows error number is safe to copy into the command result.
+fn create_process_error(detail: &str) -> Option<u32> {
+    let number = detail
+        .strip_prefix(
+            "CreateProcessW(PROC_THREAD_ATTRIBUTE_SECURITY_ENVIRONMENT) failed: WIN32_ERROR(",
+        )?
+        .split_once(')')?
+        .0;
+    number.parse().ok()
+}
+
+#[cfg(test)]
+#[path = "native_tests.rs"]
+mod tests;
diff --git a/codex-rs/mxc-sandbox/src/native_tests.rs b/codex-rs/mxc-sandbox/src/native_tests.rs
new file mode 100644
index 0000000000..0cf300b948
--- /dev/null
+++ b/codex-rs/mxc-sandbox/src/native_tests.rs
@@ -0,0 +1,20 @@
+#![cfg(test)]
+
+use super::create_process_error;
+
+#[test]
+fn returns_only_the_native_create_process_error() {
+    let api = "CreateProcessW(PROC_THREAD_ATTRIBUTE_SECURITY_ENVIRONMENT) failed: ";
+    assert_eq!(
+        create_process_error(&format!("{api}WIN32_ERROR(5) (working directory: private)")),
+        Some(5)
+    );
+    assert_eq!(
+        create_process_error(&format!("{api}WIN32_ERROR(private)")),
+        None
+    );
+    assert_eq!(
+        create_process_error("another API failed: WIN32_ERROR(5)"),
+        None
+    );
+}