Codex

What Codex is: an agent that works through tools

Codex is OpenAI’s agent for software development and related work using AI models and tools. It can investigate a project, change files, execute commands, review changes and present results. Its working unit is a task involving context and actions rather than only a text response or autocomplete suggestion.

Distinguish three layers: the model interpreting and generating, the system coordinating actions and the interface used to interact with it. Changing models does not turn a local session into a cloud session or grant repository access. Usefulness depends on available information and tools as well as model capability.

The CLI is published under Apache 2.0. This permits inspection and adaptation of that component; it does not give models, the desktop application or managed services the same license, nor does it make every agent run free.

Reference documentation: OpenAI — Codex CLI · OpenAI — Codex App Server · OpenAI — Open agent harness · OpenAI — Codex open-source repository.

History: from the 2021 model to the 2025 agent

Codex first named a model announced on 10 August 2021, derived from GPT-3 and designed to generate code; it was part of GitHub Copilot’s origins. The current tool is a later product. Evaluations and limitations of that model should not be presented as current measurements of today’s agent.

Codex CLI appeared on 16 April 2025 as an open-source local agent. The cloud service’s research preview followed on 16 May, initially powered by codex-1, an o3 adaptation for software engineering. Work ran in separate environments containing the repository and returned changes for review.

GPT-5-Codex, introduced in September 2025, advanced longer programming tasks. GPT-5.3-Codex arrived on 5 February 2026, combining coding, reasoning and broader professional work. Spark followed on 12 February as a low-latency variant running on Cerebras hardware. These are historical milestones, not models necessarily available in every current account.

On 19 March 2026, OpenAI announced an agreement to acquire Astral, maker of Python tools including uv, Ruff and ty. The announcement was subject to closing conditions; it does not establish that every capability of those projects has already been integrated into Codex.

Reference documentation: OpenAI — Original Codex model, 2021 · OpenAI — Introducing Codex, May 2025 · OpenAI — GPT-5-Codex and long tasks · OpenAI — GPT-5.3-Codex · OpenAI — Codex-Spark · OpenAI — Astral acquisition announcement.

How Codex works with code and context

Codex is an OpenAI tool for developing, maintaining and reviewing software with AI assistance. Its documentation describes work with code, the terminal, change review and connected tools. A useful request supplies the expected result, relevant files and conditions to preserve; the outcome can include modifications and checks alongside an explanation.

The environment matters. Local work uses the project directory; a worktree isolates changes in another Git working copy; a cloud task has its own workspace. Local files, browser sessions and the computer’s network access do not automatically transfer to the cloud. Check the actual context and permissions available to each task.

Reference documentation: OpenAI — Developers: Codex development workflows · OpenAI — Codex environments.

Desktop evolution, models and current availability

The macOS application appeared in February 2026 and Windows followed in March. On 9 July it merged into the ChatGPT desktop application, retaining the Codex experience alongside Chat and Work. This changed product access rather than removing its coding workflows.

GPT-5.4 joined Codex in March 2026. Options subsequently changed: Spark retired on 14 September and GPT-5.5 ceased being offered through ChatGPT authentication on 14 October. API availability follows different rules. Current documentation includes GPT-6.1 Sol, subject to account, client and workspace administration.

For reproducibility, record the model and task conditions. Model upgrades can change style, cost or behavior, so rerun relevant acceptance cases when updating an important workflow. The model version is only one factor: tools, instructions, dependencies and data also affect results.

Reference documentation: OpenAI — Product updates · OpenAI — Codex changelog · OpenAI — Current workspace model boundaries.

How the working loop operates

The system around the model, called the harness, maintains conversation state, coordinates tools and communicates events and approval requests. Codex App Server exposes that loop to interfaces and integrations through threads, turns and action results. Documentation treats it as experimental; its existence should not be taken as production stability.

A typical repair starts with an objective, file inspection and a hypothesis, followed by changes and checks. Each observation can change the next step. When a test fails, useful evidence consists of the failure message and failing case rather than repeating the instruction more emphatically.

The user defines completion. For an OSH report, “generate a file” is less precise than “produce a report that preserves the planned population, flags duplicates and is reproducible from the same input.” That specification connects the technical loop to an assessable result.

Reference documentation: OpenAI — Codex App Server · OpenAI — Open agent harness.

Terminal, editor, desktop and cloud

• CLI: works from the terminal with local files and tools; noninteractive mode supports bounded scripted tasks.
• Editor and desktop: bring conversation, code context and visual diff review closer to the developer’s workflow.
• Worktree: provides another Git working directory for parallel work without making that work remote.
• Cloud: uses a published environment containing repositories, dependencies and access settings, creating an isolated workspace per task.

Cloud work can continue while the computer is off; local work needs its local environment. Documentation also distinguishes current Codex Cloud environments from legacy workflows that still support certain integrations. Check which a tutorial describes.

A worktree separates changes but does not automatically resolve conflicts when two tasks alter the same rule. Expanding an exporter while changing its identifiers in parallel requires coordination of the data contract. Before combining results, review the whole change and rerun affected cases.

Reference documentation: OpenAI — Codex CLI · OpenAI — Reusable cloud environments · OpenAI — Worktrees · OpenAI — Authentication.

Reusable instructions, skills and plugins

AGENTS.md retains project instructions such as conventions and checks. A skill packages a procedure with resources; a plugin can distribute skills and MCP connections. These are different mechanisms: instructions, reusable process and tool access. Installing a connection does not define when it should be used.

For a team maintaining OSH resources in three languages, instructions might specify translation paths, prohibit unsourced numerical changes and require link checks. A skill could describe reviewing a profile from sources through preview. A connected tool would supply authorized reading or writing access.

Separate reference material from instructions. A file comment, external page or supplied document can contain text resembling an order; that does not authorize a change of scope. The task should identify which sources explain the problem and who decides what changes.

Reference documentation: OpenAI — Project instructions with AGENTS.md · OpenAI — Skills and plugins.

Development and design integrations

Xcode 26.3 integrated Codex for Apple projects with build, test and documentation tools. GitHub added Codex to Agent HQ in February 2026. Figma’s MCP integration connects design context and implementation. Each environment retains its access requirements; an announced integration is not necessarily enabled in an account.

Connections reduce manual steps when they provide useful context. A design can guide implementation of a training website, but acceptance still needs keyboard navigation, readability, translations and behavior with real content. Code resembling an image does not establish that the resource works.

Before connecting a system, define which data is read and which actions are allowed. A link audit might need page reading and report generation; an authorized correction adds writing. These are different scopes, and available tools should reflect the difference.

Reference documentation: Apple — Agentic coding in Xcode · GitHub — Agent HQ, February 2026 · OpenAI/Figma — Design and code workflow.

Permissions, execution and data handling

Environment isolation limits technical actions; approval policy determines when authorization is requested. They are not equivalent. Current permission profiles, still beta, constrain files and network access for local commands. Their network destination list is not a universal policy for browsers, connectors and every other tool.

Authentication is another boundary. ChatGPT sign-in follows the relevant workspace controls; an API key follows its API organization’s controls. Local clients support both, while Codex Cloud requires ChatGPT sign-in. Check the actual environment before attributing retention or access policies to it.

To transform OSH records, start with fictional data and a working copy. Identify permitted files, expected output and excluded actions. A script reading data does not necessarily need write access to the source system. Supply credentials through environment mechanisms rather than including them in examples, reports or debugging logs.

Final verification should inspect what changed and what left the environment. An error can involve file contents or the wrong destination. Useful traceability connects the request, changes, checks and result without retaining unnecessary sensitive information.

Reference documentation: OpenAI — Command permission profiles · OpenAI — Agent approvals and security · OpenAI — Authentication.

Codex Security and Patch the Planet

Codex Security was introduced on 6 March 2026 as the successor to Aardvark, whose private beta was announced in October 2025. It addresses application security: building context and a threat model, finding issues, attempting validation and proposing fixes. Here “security” concerns software, not occupational safety and health assessment.

Current documentation distinguishes the local plugin, CLI, SDK and Codex Security Cloud. Cloud remains listed as a research preview requiring appropriate access. A finding and proposed patch are different outputs: identifying a vulnerable path does not establish that any suggested change closes it without altering other behavior.

On 22 June 2026, OpenAI introduced Patch the Planet, a Daybreak initiative with Trail of Bits to help open-source maintainers find and fix vulnerabilities. Provider-reported outcomes concern particular evaluations and projects rather than guaranteeing results for another repository.

For an OSH portal, a review might investigate whether a download link exposes documents outside the authorized group. Acceptance would check permitted access, denied access and older documents as well as the original finding. Technical review protects the resource but does not establish the accuracy of its preventive content.

Reference documentation: OpenAI — Codex Security launch · OpenAI — Aardvark, October 2025 · OpenAI — Current Codex Security documentation · OpenAI — Patch the Planet.

Adoption, historical vulnerabilities and patch quality

OpenAI reported more than two million weekly active users in March 2026. Expansion occurred in a competitive coding-assistant and agent market. Commercial adoption provides context rather than a controlled comparison of quality or productivity.

BeyondTrust disclosed a corrected vulnerability in 2026 involving GitHub branch names and command execution during environment setup, potentially compromising tokens. It illustrates why infrastructure connecting the agent to tools also needs review, alongside generated text.

Patch quality has prompted a separate debate. In August, Dark Reading reported a 1Password researcher’s objections to Patch the Planet outputs. 1Password’s FLAWED study examined specific models and vulnerabilities under experimental constraints; it does not measure a universal Codex failure rate. It distinguishes fixing a problem, changing behavior and leaving or introducing a vulnerability.

For adoption, measure reviewed and accepted changes, regressions and total effort. Accepting more lines or finishing the first proposal sooner does not necessarily reduce subsequent work. A useful pilot includes known faults and new cases, showing what the tool detects and what still requires the team.

Reference documentation: OpenAI — Astral acquisition announcement · BeyondTrust — Codex command injection disclosure · 1Password — FLAWED research · Dark Reading — Patch quality debate.

How it can contribute to OSH resources

The following applications are Sabentis editorial proposals for technical development, not autonomous preventive assessment capabilities:

• Information preparation: help write a program that validates columns, data types and identifiers before producing a report.
• Website maintenance: locate broken links, untranslated text or inconsistencies in preventive information resources.
• Change review: investigate whether a modification preserves known rules, such as excluding personal data from technical logs.

The contribution is turning a specification into reviewable code. Competent personnel should define what each indicator or status means. A program can follow an incorrect instruction successfully and produce a mistaken preventive conclusion.

Hypothetical example: calculating coverage without hiding outstanding work

A team needs a training report from an authorised file containing no health data. It wants to retain the intended population and distinguish it from people who have completed training.

1. Define input columns: fictional participant identifier, group, course, version and status. Document who belongs to the intended population.
2. Set acceptance cases before programming: eighteen completions among twenty people equal 90%; a group without a defined population should show “not calculable”, rather than 0% or 100%.
3. Ask Codex to prepare the transformation and flag duplicate records, unknown statuses and missing fields. Keep those exceptions visible.
4. Review the code and run the cases using fictional data. Check that repeating a participant does not increase the denominator or completion count.
5. Manually compare a sample against the source and document the cut-off date, filters and program version before using the result.

The verifiable output is a reproducible report with identified exceptions. Completion coverage still does not demonstrate practical competence: the program calculates a definition without validating its professional interpretation.

Add an independent check: twenty planned participants, eighteen completions and one duplicate row must still produce 90%, not 95%. If the course version changes, the record key should distinguish it without mixing completions across versions. Retain the fictional input, expected output and program version so the test can be repeated after future changes.

Limitations: instructions, tests and actions

OpenAI documents repository rules in AGENTS.md to guide reviews around project conventions. Rules can highlight data boundaries or compatibility concerns, but the documentation retains tests, branch protections and approvals as complementary controls.

Use the minimum necessary context and keep credentials out of examples. Review actual differences and executed tests: an agent’s statement is not evidence by itself. Distinguish prepared, saved and deployed code. A passing check also does not establish that permissions, edge cases or every production condition have been covered.

Reference documentation: OpenAI — Custom Code Review rules for Codex.

When to choose Codex and what to pair it with

Consider it when there is a concrete development task, authorised project access and the ability to review the result. Selection should include change quality, clear evidence and maintainability.

Cursor offers another assisted coding experience for comparison. Excel can help cross-check a small calculation sample before incorporating it into a repeatable process. Always define the authorised data source and prevent checking copies from becoming parallel official records.

Frequently asked questions about Codex in OSH

Does Codex certify that a preventive calculation is correct?

No. It can help implement and test a formula, but methodology, inputs and interpretation require validation by competent owners.

Does a cloud task see files on my computer?

Not automatically. It uses files and services available in its environment. Supply the authorised context it needs.

What should be requested at completion?

An explanation of the change, modified files, checked cases and anything left unverified. That evidence supports a decision on accepting the result.

Reference documentation: OpenAI — Codex environments.