OpenAI Launches Codex, Its Cloud-Based Coding Agent

An asynchronous agent, not an autonomous programmer

OpenAI introduced Codex on May 16, 2025 as a research preview: a cloud software-engineering agent able to process several tasks in parallel. Initial access covered ChatGPT Pro, Business, and Enterprise, with Plus and Edu listed as coming soon.

Codex receives a task—writing a feature, fixing a bug, or answering about a repository—and works asynchronously in its environment. This reduces continuous supervision but does not guarantee end-to-end completion: OpenAI acknowledges failures and uncertainty and requires human review before code is integrated or run.

How It Works in Practice

According to OpenAI, each task assigned to Codex runs in its own isolated cloud "sandbox," preloaded with the user's repository. From the ChatGPT sidebar, users simply type a prompt and click "Code" to set the agent to work, or "Ask" if they just want to ask a question about existing code.

Inside that environment, Codex can read and edit files and run tests, linters, and type checkers. The announcement gives a typical duration of 1 to 30 minutes, depending on complexity, with progress visible in real time. “Typical” sets neither a maximum nor a success rate.

Once the work is done, Codex commits its changes in its own environment and provides what OpenAI calls "verifiable evidence": citations of terminal logs and test outputs that let users trace every step taken during the task. From there, developers can review the results, request further revisions, open a GitHub pull request directly, or integrate the code into their local environment.

OpenAI has also introduced AGENTS.md files, a format similar to README files that tells Codex how to navigate a repository, which commands to use for testing, and which conventions the project follows. The company adds that agents perform best with configured environments, reliable tests and clear documentation: the repository and its controls are part of the system being evaluated.

The coding figures have conditions too. OpenAI excluded 23 SWE-bench Verified samples that were not runnable on its infrastructure and tested codex-1 at a maximum context of 192,000 tokens with medium reasoning effort. Its internal software-engineering benchmark is a curated set of real OpenAI tasks. None of those results is a universal success rate across arbitrary repositories.

The Model Behind It: codex-1

Codex runs on codex-1, a version of OpenAI o3 optimized for software engineering. According to the safety addendum, it was trained with reinforcement learning on coding tasks across varied environments to follow instructions, approximate style preferences, and run tests iteratively. A green test is not the same as a correct result: the card itself considers buggy or insecure code and false claims of completion.

OpenAI says a training goal was to align outputs with human coding preferences and that codex-1 produces cleaner patches than o3 for review. “Ready for review” is the operative phrase; it does not mean ready for immediate integration. Tests, diff review, and validation in the real environment remain separate controls.

Security and Sandboxed Execution

OpenAI devotes part of the report to an agent that writes and runs code with initiative bounded by an isolated container. The full card clarifies the sequence: the container has network access during setup to clone the repository and install dependencies; once codex-1 takes control, network access is disabled. Isolation reduces exposure and exfiltration, but it does not prevent mistakes within accessible files.

The security boundary therefore begins after environment preparation. The user defines dependencies, configuration and tools before the model trajectory. Disabling the network during execution limits new connections; it does not certify the integrity of material already introduced through the repository or setup script.

For malware risk, OpenAI trained refusals and evaluated one synthetic set and one set curated by internal policy experts. It reports refusal rates of 0.97 and 0.98, respectively; these are manufacturer results, not guaranteed “accurate identification” for every request. The challenge is to preserve legitimate dual-use work such as kernel engineering without enabling harm.

Even with these safeguards, OpenAI stresses one point: it still remains essential for users to manually review and validate all agent-generated code before integrating or running it.

Who's Already Using It

According to OpenAI, its own engineering teams have already started using Codex in their day-to-day work, mainly for repetitive, well-defined tasks—refactoring code, renaming elements, writing tests—that would otherwise break their concentration. The company also says it's proving useful for scaffolding new features, wiring up components, fixing bugs, and writing documentation.

The announcement lists cases from a small group of testers selected by OpenAI. Cisco was evaluating ideas; Temporal cited features, debugging, tests, and refactoring; Superhuman, repetitive work; and Kodiak, debugging tools and code understanding. These are adoption testimonials without a comparative sample, baseline, or common published measurement: they show possible uses, not a quantified productivity gain.

Drawing on the experience of these early testers, OpenAI recommends assigning well-defined tasks to multiple agents at once and experimenting with different task types and prompt phrasings to get a better sense of the model's capabilities.

A Lightweight Version for the Terminal

Alongside the Codex launch, OpenAI noted that it had introduced Codex CLI the previous month, a lightweight open-source coding agent running in a user's terminal with models such as o3 and o4-mini. On May 16 it also announced a smaller o4-mini-based version optimized for low-latency code questions and edits. It was the CLI's default and available through the API as codex-mini-latest; the name referred to a snapshot OpenAI planned to update regularly, not an immutable model.

The CLI and remote agent belonged to the same family but not the same surface. One worked in a local, interactive environment; the other delegated tasks to cloud containers. Any comparison needs the model, snapshot date, environment, tools and interaction mode.

What Changes for Developers

The difference from autocomplete lies in delegation: users hand off a task and receive a diff accompanied by commands and tests the agent ran. “Tested” means those tests executed; it does not mean coverage was sufficient or the change is correct. Work shifts toward defining the task, preparing the environment, reviewing evidence, and deciding what to integrate.

OpenAI framed the launch as a research preview, not a finished product. On May 16, global access began with Pro, Enterprise and Business; Plus and Edu were listed as coming soon. The company offered generous use at no extra cost for the following weeks and said rate limits and options to buy additional usage would follow, without fixing a stable tariff on that page.

The limitations list defines the real product: it did not accept images for frontend work, could not be redirected while a task was running, and remote delegation could take longer than interactive editing. Human validation of generated code therefore remained mandatory before integration or execution.