Codex: review

By Ivo Donker · October 28, 2026 — created with AI assistance (writer: DeepSeek V4.1 Flash; critic: Gemini 3.8 Flash + gpt-oss-120b via Groq)

Codex: Review Install & set up News Technical tutorial

Current as of September 2026, compiled from our own notes and news archive; text machine-generated and editorially checked. Check versions and commands in the official documentation.

Codex is OpenAI's coding agent. You give an instruction in plain language and Codex reads your project, edits files and runs commands within a sandbox. This review looks at what it is, where it is strong and weak, what it costs and who it suits (as of September 2026).

What it is and who it is for

Codex is available as a terminal program (Codex CLI), as a desktop app and as an editor extension, and also runs as a cloud agent from ChatGPT. This review is mainly about the CLI. It is open source under the Apache-2.0 licence, written in Rust, and runs on macOS, Linux and Windows (natively in PowerShell or via WSL 2).

Codex is made for developers who already work with ChatGPT or the OpenAI API and want to delegate tasks: fixing a bug, writing tests, a refactor, a code review in CI.

How it works

The security model has two controls. The sandbox (read-only, workspace-write or danger-full-access) limits at OS level what commands may touch. The approval policy (on-request, never or a fine-grained table) determines when Codex asks you something. The default combination lets Codex work freely within your project directory and asks first for internet access or actions outside it.

Project instructions are in AGENTS.md: globally in ~/.codex and per directory in your repository, with the file closest to your working directory taking precedence. Settings are in ~/.codex/config.toml; a project configuration is only loaded if you trust the project. Via MCP you connect external tools, and with codex exec Codex runs in scripts and CI.

Strengths

New OpenAI models. As of September 2026, OpenAI recommends GPT-6 Sol in Codex for complex programming work, GPT-6 Luna for volume work and GPT-6 Astra for the heaviest work. Switching per task is done with /model.
Open source. The CLI is on GitHub under Apache-2.0: you can see what it does, build it yourself and contribute.
A well-thought-out security model. Sandbox and approval are separate controls, the sandbox works on all three operating systems, and untrusted projects do not get their own configuration.
Suitable for CI. codex exec outputs JSON Lines, writes the final answer to a file, supports a JSON Schema for structured output and can ignore your own configuration for reproducible runs.
Own proxy possible. With openai_base_url or your own model_providers block you route traffic through your own gateway, for logging or cost monitoring.

Weaknesses and risks

Sandbox leaks in 2026. In September 2026, researchers published two escapes. Heapjack gave a host action from read-only without an approval prompt; Overpatch made writing outside the working directory possible. Both were fixed from CLI 0.149.0. Earlier that year Plugin4Shell (bypassing commit pinning in plugin marketplaces) affected multiple agents; Codex patched that in 0.146.0. So keep updating and use danger-full-access only in disposable environments.
Rapid changes in the configuration. The old [profiles] table no longer works since 0.134.0, untrusted is no longer supported and on-failure is deprecated. Anyone copying old examples from the internet will run into errors.
Models disappear quickly. GPT-5.4 was phased out on 31 August 2026 and GPT-5.5 follows on 14 October 2026, at least for those who log in with a ChatGPT account. Scripts with a fixed model name must therefore be maintained.
Strongly focused on OpenAI. Other providers are possible via your own model_provider, but the experience and documentation revolve around OpenAI models.

Price and licence

The CLI is free and open source (Apache-2.0). You pay for model usage: with a ChatGPT subscription within the limits of your plan, or with an API key per token according to OpenAI's API prices. Which plans include Codex and with which limits changes regularly; check OpenAI's current pricing page.

Alternatives

Claude Code (Anthropic): similar terminal agent with Claude models, strong in hooks, permissions and headless use; not open source.
Cursor: an editor with agent features, for those who prefer to work graphically.
OpenCode: open-source terminal agent that works with many model providers.
Hermes Agent: open source, aimed at self-hosted and long-running agents.

Conclusion

Codex is a strong choice for anyone already in the OpenAI ecosystem who wants an open-source CLI with a serious security model. The codex exec part makes it particularly suitable for reviews and maintenance in CI. Do bear in mind the pace: the configuration and the models change quickly, and the 2026 sandbox leaks show that updating is not an option but an obligation.