What Is OpenAI Codex? Cloud Agent, CLI, Plans and History: Surfaces, Pricing, Models and Controls Explained

OpenAI Codex is now several products under one name, and teams often cannot tell which surface, plan or model they are actually approving. Codex is OpenAI's software engineering agent: it reads a codebase, edits files, runs commands and proposes changes, either locally on a developer's machine or in an OpenAI-hosted cloud environment. This page explains what each Codex surface is, what the plans cost, which models are available, how the sandbox and admin controls work, and how the product has changed since 2025. It is written for engineering leads, platform teams and security reviewers who need a factual reference before rollout. Last checked: 2026-11-15.

This is an independent guide from NHI Mgmt Group, based on OpenAI's public Codex documentation as of November 2026. It is not sponsored or reviewed by OpenAI. Product features change, so confirm settings against OpenAI's current documentation.

Key takeaways

• One name, many surfaces. Codex runs as a desktop app, an open source CLI, an IDE extension, a web and cloud agent, in the ChatGPT mobile app, and through GitHub, Slack, an SDK and a GitHub Action.
• Plans decide access and limits. As of November 2026 Codex is included from the Free plan upwards, with Plus at $20 per month, Pro from $100 and Business from $20 per user per month billed annually; API key use is billed separately at API rates.
• The model line-up moves fast. The Codex models page lists GPT-6 Astra, GPT-6.1 Sol, GPT-6.1 Terra and GPT-6 Luna, and several GPT-5.x models were retired from ChatGPT sign-in between August and October 2026.
• Local work is sandboxed by permission mode. Sandbox modes read-only, workspace-write and danger-full-access combine with approval policies on-request and never, enforced by Seatbelt on macOS, bubblewrap on Linux and a native sandbox on Windows.
• Enterprise controls sit in several places. Managed configuration keys, workspace RBAC, the Compliance API, OpenTelemetry events and the Policy API each cover a different part of governance, so plan which one answers which audit question.

What is OpenAI Codex?

OpenAI describes Codex as ChatGPT's agent for software and other work: given a goal or task, it gathers context, takes action and produces output, for example exploring code, building features, reviewing code and fixing issues. The name covers two lineages that have since merged into one product family.

• Codex CLI: an open source coding agent that runs locally on your computer, published at github.com/openai/codex under the Apache-2.0 licence. OpenAI's May 2025 announcement says the CLI launched the month before.
• Codex cloud (Codex Web): a cloud-based software engineering agent that works on many tasks in parallel, each in its own environment, launched as a research preview on 16 May 2025 and reached at chatgpt.com/codex.
• Codex app, IDE and mobile: the ChatGPT desktop app, an extension for VS Code and compatible editors, and the ChatGPT mobile app now act as front ends to the same agent and account.

The earlier OpenAI Codex model from 2021, which powered early code completion, is a different and long-retired product; this page covers the agent family only.

Key facts at a glance

As of 15 November 2026, from OpenAI's Codex documentation and the openai/codex repository.

Plans and pricing

Codex is bundled with ChatGPT plans rather than sold as a separate seat. Prices below are as listed on OpenAI's Codex pricing page on 15 November 2026, in US dollars.

Usage limits and credits

Plus and Standard Business plans carry estimated local message allowances per five-hour window, which OpenAI states are estimates rather than fixed limits; cloud tasks may consume more, and weekly limits may also apply.

• Speed multipliers: Fast mode uses 2.5 times included usage and 2 times purchased credits; Ultrafast, on GPT-6 Astra and GPT-6.1 Sol, uses 8 times included usage and 6 times credits.
• Voice: desktop voice costs $0.05 per minute on Plus and 1.25 credits per minute on credit-based workspaces.
• API key billing: signing in with an API key bills usage at standard API rates, separate from subscription usage. The pricing page does not list per-token API prices; those sit on the API pricing page.
• Credit purchase prices: depend on the plan or agreement and are not listed on the Codex pricing page.

Models available

The Codex models page describes four current models. When no model is set, Codex uses a recommended model; the page's configuration example sets model = "gpt-6.1-sol".

Retired and deprecated models

• gpt-5.4 and gpt-5.4-mini: retired from Codex with ChatGPT sign-in on 31 August 2026.
• GPT-5.3-Codex-Spark: retired 14 September 2026.
• GPT-5.5: retired from Codex with ChatGPT sign-in on 14 October 2026 at 19:00 UTC; API key sessions were not affected.
• gpt-5.2 and gpt-5.3-codex: listed as deprecated in Codex with ChatGPT sign-in, with no date given on the models page.

The CLI can also call models through custom providers. Changelog entries for October 2026 add a built-in Google Cloud Vertex AI provider (model_provider = "gcp") in CLI 0.165.0 and an Amazon Bedrock setup wizard enabled by default in 0.164.0.

Features and modes

• Local agent: the CLI and desktop app read and edit files in a working directory and run commands, within the sandbox and approval settings described below.
• Cloud tasks: Codex cloud runs tasks in cloud environments, so several tasks can proceed in parallel; cloud use requires Sign in with ChatGPT.
• Non-interactive mode: codex exec runs Codex in repeatable workflows and pipelines, and the Codex SDK, App Server and GitHub Action embed it in other systems.
• Code review: the /review command reviews uncommitted changes, a commit or a base branch and reports prioritised findings without modifying the working tree.
• Project instructions: /init creates an AGENTS.md file; the docs also cover subagents, rules, skills, plugins, hooks and memories.
• MCP: codex mcp adds local or remote MCP servers, handles their authentication and lists available tools.
• Environments: documented modes include local environments, Git worktrees and cloud environments.
• Other capabilities in the docs: browser, computer use, voice, web search, image inputs and generation, scheduled tasks and long-running work.
• Recent CLI additions: saved prompt presets (0.164.0), codex doctor --network-only (0.166.0), an agent command center via codex agents (0.167.0) and side-conversation panes (0.168.0 and 0.169.0).

Supported IDEs and platforms

The standalone installers download from releases.openai.com by default and fall back to GitHub Releases; the environment variable CODEX_INSTALLER_USE_RELEASES_OPENAI_COM=false forces GitHub Releases, which matters for organisations that allow-list download hosts.

Enterprise and admin controls

Identity and sign-in

• Sign in with ChatGPT: follows the workspace's groups, provisioning, roles and RBAC; Business plans include SAML SSO and MFA, and OpenAI advises SSO administrators to enforce MFA.
• API key: usage-based access billed at API rates; OpenAI advises against it for untrusted or public environments.
• Codex access tokens: Enterprise admins can let permitted members create these for non-interactive automation such as trusted scripts and CI runners. Treat them as non-human credentials with an owner, scope and rotation date.

Managed configuration keys

If active credentials do not match these restrictions, Codex logs the user out and exits.

Audit, telemetry and policy

• Compliance API: auditable records for security, legal and governance work; Work Cloud records appear under conversation_message and codex_log.
• OpenTelemetry: local execution emits separate OTel events, collected by configuring an OTel collector endpoint.
• Hooks: admin-defined MCP hooks can run on the cloud coordinator for supported lifecycle and tool events.
• Analytics: workspace analytics, Codex analytics and an Analytics API report adoption; OpenAI states these are not audit logs.
• Policy API and Agent Security UI: the Policy API manages Global settings, while local and Codex cloud settings are managed in the Agent Security UI.

OpenAI's governance page notes that Compliance API records, local telemetry and hook logs are separate sources, and that conversation visibility alone does not capture all local actions.

Data handling and privacy

• Retention follows the sign-in path: with ChatGPT sign-in, usage follows the workspace's ChatGPT Enterprise retention and residency settings; with an API key, it follows the API organisation's retention and data-sharing settings.
• Local credentials: file-based storage in ~/.codex/auth.json holds access tokens, and OpenAI says to protect it like a password. Setting cli_auth_credentials_store to keyring keeps tokens in the operating system keychain.
• Local versus cloud execution: local tasks run on the developer's machine under the permission profile, while cloud tasks run in OpenAI-hosted containers governed by Work Cloud policies; the two are governed separately.
• Training use: the Codex authentication page makes no statement on model training; check the workspace's ChatGPT or API data controls for the applicable policy.

For how AI coding tools spread secrets into prompts, logs and config files, see the AI Coding Tools and Secrets Sprawl guide.

Release history

The CLI ships new versions every few days, so pin a version in managed fleets and review the changelog before upgrading.

Limits and known constraints

• Usage allowances are estimates: five-hour message ranges vary by task size, and weekly limits may apply on top.
• Model availability depends on plan and sign-in: Free and Go plans list GPT-6 Luna only, and retirements apply to ChatGPT sign-in while API key sessions can follow a different schedule.
• Cloud requires ChatGPT sign-in: API key and access token users work locally or in automation, not in Codex cloud.
• Local computer access with Work Cloud: needs a workspace owner to enable Work Cloud and turn on Allow local computer access; API keys and access tokens cannot enable it.
• Approval policy change: the untrusted approval policy is no longer selectable, so older configuration files that use it need migration.
• Sandbox dependency on Linux: Codex uses bubblewrap and otherwise falls back to a bundled helper that needs unprivileged user namespace support, which some hardened hosts disable.

Security guidance

Codex permission settings are the main customer-side control for local work. The table summarises the documented options; the full hardening baseline, admin roles, token handling and detection guidance are in the OpenAI Codex Security Guide, which this page does not repeat.

Platform enforcement uses Seatbelt on macOS, bubblewrap on Linux and WSL2, and a native Windows sandbox in PowerShell. For risks that apply across agentic coding tools, such as poisoned AGENTS.md or MCP configuration files, see the Coding Agent Configuration File Attacks guide and the AI Coding Agents Security Guide.

Practitioner checklist

• Decide which Codex surfaces you will allow (CLI, app, IDE, cloud, mobile, GitHub, Slack) and record the approved list.
• Set forced_login_method and forced_chatgpt_workspace_id so developers use the corporate workspace rather than personal accounts or ad hoc API keys.
• Set cli_auth_credentials_store to keyring where supported, and treat any ~/.codex/auth.json file as a secret.
• Default to workspace-write with on-request approvals, and restrict danger-full-access to disposable environments.
• Inventory Codex access tokens used in CI, give each an owner and expiry, and review them with your other non-human identities.
• Connect the Compliance API and an OTel collector so both cloud and local activity reach your SIEM.
• Pin CLI versions in managed fleets and check the model retirement list before each plan or configuration change.
• Budget with the pricing page's estimate ranges and speed multipliers, and set workspace spend controls before enabling Fast or Ultrafast modes.

Standards and references

• OpenAI: Codex documentation
• OpenAI: Codex pricing
• OpenAI: Codex models
• OpenAI: Codex changelog
• OpenAI: Codex identity and access
• OpenAI: Codex sandboxing
• OpenAI: Codex security and compliance
• OpenAI: Introducing Codex
• OpenAI: Codex CLI repository on GitHub

Related NHI Mgmt Group resources: OpenAI Codex Security Guide · AI IDE and Coding Agent Security Guide · AI Coding Tools and Secrets Sprawl · How to audit AI coding assistant tokens and config files