OpenAI Codex is OpenAI's expanding "superapp" agent platform — cloud web app, open-source CLI, IDE extension, Desktop app, and GitHub bot — powered by GPT-5.4. As of April 16, 2026 it gained background computer use (Mac), an in-app browser, image generation (gpt-image-1.5), memory, heartbeat automations, 90+ plugins, and multi-terminal tabs. More than 2 million developers use it weekly.
Architecture Deep Dive → OpenAI Codex Architecture Breakdown — three-layer design, agent loop with prompt construction, dual sandbox model (kernel-level CLI vs. air-gapped cloud), AGENTS.md configuration, GitHub integration, and comparison with Claude Code, Copilot, and Devin.
Note: This is not the original Codex from 2021 (the code completion model). This is the 2025 relaunch — a fully agentic product that reuses the Codex name.
Why It's in Trial
OpenAI re-entered the agentic coding space in 2025 with a product that competes directly with Claude Code, GitHub Copilot, and Devin. Usage grew 5x since January 2026 — one of OpenAI's fastest-growing products, now at 2M+ weekly active users.
Key capabilities:
- Parallel cloud tasks: Multiple sandboxed instances work simultaneously on different tasks in your codebase
- GitHub integration: Tag
@codexon any GitHub issue or PR to trigger the agent; opt in to automatic PR reviews on every new PR - AGENTS.md support: Open standard (Linux Foundation / AAIF) for guiding agent behaviour — works across Codex, Cursor, Copilot, Windsurf, Gemini CLI, and others
- Air-gapped sandbox: Cloud containers have no internet access during task execution — only your repo and pre-installed dependencies
- Open-source CLI: Apache-2.0 licensed, written in Rust, 67K+ GitHub stars — the CLI uses OS-level kernel enforcement (Landlock + seccomp on Linux, Seatbelt on macOS), making it the only major coding agent with kernel-level sandboxing enabled by default
- Codex GitHub Action: Run Codex in CI/CD for automated code review, migrations, and quality gates
Trial rather than Adopt because Claude Code leads SWE-bench Verified (80.8% vs Codex's competitive but lower score), the Codex product line is still iterating rapidly (three major capability expansions in April 2026 alone), and the new non-coding surface area (computer use, image gen, browser) is too fresh to evaluate in production.
When Codex is the right choice: Teams already paying for ChatGPT (it's included), multi-tool shops that value AGENTS.md portability, teams that want kernel-level sandboxing by default, and teams building across the full software lifecycle (code + design + docs + monitoring in one agent).
When to look elsewhere: If you need the highest autonomous success rate (Claude Code), if you want an editor-integrated experience (Cursor), or if your team is primarily on GitHub and wants the tightest CI/CD integration (Copilot).
April 16, 2026 — "Codex for Almost Everything" Update
OpenAI's largest Codex release to date expands the platform well beyond coding into what the company is calling its "superapp" strategy. All features roll out to Codex Desktop users signed in with ChatGPT today:
- Background computer use (Mac): Codex can operate desktop apps with its own cursor — seeing the screen, clicking, and typing — in the background without interrupting the user's active session. Supports multiple agents running in parallel. Not yet available in EU or UK.
- In-app browser: Powered by Atlas (OpenAI's internal browser technology), the Codex desktop app now embeds a browser. Users can comment directly on live web pages to give precise instructions. Initially focused on localhost web apps; full browsing planned.
- Image generation: Integrated gpt-image-1.5 for generating product mockups, UI concepts, and design assets within the same workflow.
- Memory: Codex now stores user preferences, tech stacks, and recurring workflows across sessions.
- Heartbeat automations: Thread-level recurring automations that let Codex resume or re-run tasks on a schedule — for monitoring Slack channels, triaging GitHub issues, summarising CI failures, or watching Gmail and Notion. Inside OpenAI these run as near-continuous agents.
- 90+ new plugins: Combine skills, app integrations, and MCP servers for richer context gathering and actions.
- Multiple terminal tabs + file sidebar: UI improvements including rich previews for PDFs and spreadsheets.
- Intel Mac support: First Codex release to support Intel-based Macs.
Sources: MacRumors, 9to5Mac, The New Stack, Engadget, OpenAI announcement
August 2026 CLI Control-Plane Update
Codex CLI 0.146 and 0.147 substantially expanded the extension and session surface. 0.146 added Agent Plugins manifests, workspace plugin publishing, Bedrock and Claude Code plugin marketplaces, remote Code Mode hosts over WebSocket, and discovery of executor-provided skills. The stable 0.147 release then added portable plugin installation and catalog search plus opt-in support for the MCP 2026-07-28 specification, including paginated discovery, multi-round requests, and non-blocking server startup. (0.146.0, 0.147.0)
0.147 also adds persistent, manually ordered conversation sections, Cursor-managed skill imports, and the --approve-for-me automatically reviewed approval mode. Its security changes redact secrets and complete bearer tokens from displayed commands and replayed history, require explicit trust for unfamiliar local projects, enforce managed authentication restrictions before credentials are used, harden plugin isolation, and deny network access when policy updates fail. Trial remains the right ring: the broader plugin catalogs and automated approval path need least-privilege, redaction, failure-handling, and MCP compatibility tests before unattended use. (0.147.0)
The stable 0.148.0 (published August 18) rounds out the session and provider surface. It adds Amazon Bedrock Runtime as a built-in provider (AWS profile, region, and GPT-5.6 routing support), Markdown export of complete TUI conversations via /export, session forking with codex exec fork, and archive/restore from the resume picker. It also lets hooks run commands asynchronously and invoke MCP tools, shows estimated thread credits or cost in /status for eligible workspaces, and makes sandbox restrictions fail closed for denied or unreadable paths across Linux and Windows. Resumed sessions restore their persisted working directory and approval policy, and MCP servers recover after OAuth reauthentication without a Codex restart. These are welcome portability and session-lifecycle gains; the plugin, hook, and approval surfaces they enlarge remain the reason the CLI stays in Trial. (0.148.0)
The stable 0.149.0 (published August 20) adds a session control plane to the TUI and host. codex agents is an interactive dashboard for searching, starting, opening, renaming, and stopping tasks; codex queue sends messages into existing local or remote sessions; and new /cd, /pwd, and /cwd commands manage the working directory in TUI sessions. Vim editing gains character replacement and change motions (cw, c$, cc), codex doctor now diagnoses endpoint protection, network/proxy failures, desktop-app state, and update connectivity, and the SDK can pass exact CLI config overrides and select max or ultra reasoning effort. Resumed and forked threads restore their active permission profile instead of silently falling back to current defaults, queued messages wake idle sessions reliably, and duplicate sub-agent activity is de-duplicated. Separately, early production reports on the native Amazon Bedrock path (rolled out in 0.148) found GPT-5.6 Sol with no explicit prompt-cache controls — cache writes made up roughly 85% of estimated spend in one reported agentic workload — so validate cost baselines before scaling unattended Bedrock use. (0.149.0, codex#37674)
The Bedrock cache-cost tracking issue (codex#37674) was closed as completed on August 21, with 0.149.1 published August 24 as a maintenance patch (no release-note feature deltas). The underlying request for a typed prompt_cache_breakpoint emission point (codex#35300) remained open at last check, so the explicit-cache-control shape the issue asked for is not yet surfaced in release notes; teams on native Bedrock should still confirm their own cache-write baseline after upgrading rather than assuming the cost condition is resolved by the closure alone. (0.149.1, codex#35300)
Through August 26 the CLI series remains in pre-release: rust-v0.150.0 alphas α.8–α.13 landed August 24–26 with no stable 0.150 release yet, and the release-note surface still shows no explicit Bedrock prompt-cache control. codex#35300 (prompt_cache_breakpoint) remains open and now carries detailed author-supplied evidence: on a ~9k-token stable developer prefix with a changing user tail, unmodified Codex produced 0% cache hits while adding only a breakpoint recovered 98.6%; the same report's AWS Cost Explorer sample showed cache writes at 90% of measured GPT-5.6 Sol spend (~$1,978 of a $1,977.58 monthly total). That is a controlled-replay measurement supplied by the issue author rather than an official OpenAI statement, so teams on native Bedrock should keep validating their own cache-write baseline after upgrades — the explicit-control shape the issue requests is still not present in any stable release. Ring remains Trial. (rust-v0.150.0-alpha.13, codex#35300)
A first stable on the 0.150 branch arrived as rust-v0.150.1 (published August 27) — a maintenance backport whose sole change is backporting retained-image token budgeting to remote compaction (older images trimmed to fit the token budget by default, relevant for heavy-screenshot workflows, but not the explicit cache-control knob). The 0.151 branch continues pre-release (v0.151.0-alpha.8 by August 28), and codex#35300 (prompt_cache_breakpoint) remains open on re-check August 28 — so no stable 0.150 release surfaces explicit Bedrock prompt-cache controls yet, and teams on native Bedrock should keep validating cache-write baselines after upgrades rather than assuming the earlier cost condition is resolved by the closed tracking issue. Ring remains Trial. (rust-v0.150.1, codex#35300)
The 0.151 branch reached its first stable as rust-v0.151.0 (published August 29). It adds a configurable grace period for discovering tools from optional MCP servers (#41199), lets extensions inspect or replace MCP tool results before they reach the model (#41202), and makes plugin catalogs honor per-repository configuration while still reporting invalid project marketplaces (#41208). The bug-fix set concentrates on preserving restored permission profiles across TUI turns and preventing /cd from weakening sandbox restrictions, aligning remote-sandbox enforcement with the executor's actual home directory, OS, and path conventions, and counting nested-subagent token usage toward root goal budgets. Release notes again carry no explicit Bedrock prompt-cache control: codex#35300 (prompt_cache_breakpoint, author-updated August 22) remains open on re-check August 31, so the first stable on 0.151 still does not surface the typed cache-breakpoint emission the issue requests. 0.152 alphas began immediately (α.1 August 29, ramping to α.6 by August 31). Ring remains Trial. (rust-v0.151.0, codex#35300)
Key Characteristics
| Property | Value |
|---|---|
| Interface | Cloud web, CLI, IDE extension, Desktop app (Mac), GitHub bot |
| Provider | OpenAI |
| License | CLI: Apache-2.0; Cloud: Proprietary |
| Pricing | Included with ChatGPT Plus ($20/mo), Pro ($200/mo), Team, Business, Enterprise |
| Underlying model | GPT-5.4 (Cloud), GPT-5.4 mini (subagent tasks), gpt-image-1.5 (image gen), configurable (CLI) |
| Computer use | Mac Desktop (background, parallel agents); not yet available in EU/UK |
| Browser | In-app Atlas browser (localhost web apps; full browsing planned) |
| Sandbox | Cloud: air-gapped Docker containers; CLI: Landlock + seccomp (Linux), Seatbelt (macOS) |
| Automations | Heartbeat-style recurring threads; monitors Slack, GitHub, Gmail, Notion |
| Plugins | 90+ (skills + app integrations + MCP servers) |
| CLI | Open-source Rust CLI (Apache-2.0, 67K+ GitHub stars) |
| Weekly active users | 2M+ (as of early 2026) |
| GitHub | openai/codex |
| Website | openai.com/codex |
| Docs | developers.openai.com/codex |
Codex Security (Research Preview)
OpenAI launched Codex Security in March 2026 (formerly known internally as Aardvark) — an AI security agent built into the Codex ecosystem. It runs a three-stage pipeline: identification (scans the repo and generates a project-specific threat model), validation (sandbox-tests findings to filter false positives), and remediation (generates a concrete patch for review).
In its first 30 days of beta, Codex Security scanned more than 1.2 million commits, identifying 792 critical and 10,561 high-severity findings. OpenAI reported an 84% reduction in overall noise and a 50% drop in false-positive rates versus earlier approaches. The tool also discovered 14 CVEs in foundational open-source projects including libssh, PHP, Chromium, OpenSSH, and GnuTLS. (The Hacker News, OpenAI announcement)
Available to ChatGPT Pro, Enterprise, Business, and Edu customers. Comes weeks after Anthropic launched the analogous Claude Code Security.
Further Reading
- OpenAI Codex Architecture Breakdown — full deep dive
- Codex for (almost) everything — April 16, 2026 superapp expansion announcement
- Introducing Codex
- Unrolling the Codex agent loop
- Unlocking the Codex harness: how we built the App Server
- Codex Security: now in research preview
OpenAI Codex (2025 relaunch) is a cloud-based software engineering agent powered by codex-1 (a coding-optimised version of o3/GPT-5) that can handle complex tasks in parallel cloud sandboxes — with deep GitHub integration for issue-to-PR workflows.
Note: This is not the original Codex from 2021 (the code completion model). This is a new agentic product reusing the Codex name.
Why It's in Trial
OpenAI re-entered the agentic coding space seriously in 2025 with a product that competes directly with Claude Code and GitHub Copilot Workspace. Daily usage grew more than 10x since August 2025, and it's one of OpenAI's fastest-growing products.
Key capabilities:
- Parallel tasks: Multiple sandboxed instances can work simultaneously on different tasks in your codebase
- GitHub integration: Tag
@codexon any GitHub issue or PR to trigger the agent - Automatic PR reviews: Opt in to have Codex automatically review every new PR
- AGENTS.md support: Place guidelines in your repo to control how the agent reviews and modifies code
- Air-gapped sandbox: The cloud container has no internet access during task execution — it can only access your repo and pre-installed dependencies (a security feature)
Access Points
- Codex Cloud: Web interface at openai.com/codex
- Codex CLI:
npm install -g @openai/codex— runs locally in your terminal - IDE extension: Available for VS Code, Cursor, and VS Code forks
- SDK: TypeScript SDK for embedding in your own tools
Included With
ChatGPT Plus, Pro, Business, Edu, and Enterprise subscriptions.
Key Characteristics
| Property | Value |
|---|---|
| Interface | Web, CLI, IDE extension |
| Underlying model | codex-1 (o3/GPT-5 variant optimised for coding) |
| Strengths | GitHub integration, parallel execution, PR review |
| Provider | OpenAI |
| Announcement | Introducing Codex |
| Website | openai.com/codex |