How to Use OpenAI Codex: Setup and Real Workflows (2026)

Last updated: 13 November 2026

What is OpenAI Codex today?

The name Codex has a long history. In 2021 it referred to a code model that powered early GitHub Copilot. Since 2025 it has meant OpenAI’s coding agent: first the open-source Codex CLI in April 2025, then Codex in the cloud, an IDE extension, and in February 2026 a dedicated Codex app. In July 2026, Codex moved into the unified ChatGPT desktop app alongside Chat and Work, after OpenAI combined its desktop products. Along the way it gained plugins, computer use, automations, remote environments, pull request review and security scanning.

Codex runs on OpenAI’s latest coding-capable models, and the available models change frequently; in late 2026 these include the GPT-6 family. Check the model picker in Codex for what your plan offers.

Where you can use Codex

Getting started

1. Check your plan. Codex is included with paid ChatGPT plans, with limits that vary by tier, and is also available through the API.
2. Install the ChatGPT desktop app and switch to Codex mode, or install the Codex CLI or IDE extension.
3. Sign in with your ChatGPT account or configure API access.
4. Open a project folder or connect a GitHub repository for cloud tasks.
5. Set permissions. Choose how much Codex can do without asking: read-only, edit with approval, or more autonomous modes inside a sandbox.
6. Add an AGENTS.md file describing how to install, build, test and style the project.
7. Start with a small task and review the result carefully.

Writing an AGENTS.md file

AGENTS.md is a plain Markdown file at the root of your repository that briefs coding agents, much like onboarding notes for a new developer. A good one is short and practical:

• Project overview: what the app does and the main folders.
• Setup commands: how to install dependencies and run the app locally.
• Test commands: how to run unit, integration and lint checks, and which must pass before a change is done.
• Conventions: language versions, formatting, naming, error handling and logging.
• Boundaries: files or folders the agent must not change, such as generated code or migrations.
• Definition of done: for example, “tests pass, lint passes, no new warnings, update the changelog”.

You can also add AGENTS.md files in subfolders for specific parts of a monorepo. Keep them updated as the project changes; an outdated briefing leads to outdated behaviour.

How to write tasks Codex can succeed at

Codex performs best when a task is specific, scoped and testable. Think of how you would brief a capable new team member.

Good tasks name the outcome, the constraints, what not to touch and how success is measured.

Reviewing Codex’s work

Codex shows a summary of what it did, the commands it ran and a diff of changes. Review it as you would a colleague’s pull request:

1. Read the summary and check it matches what you asked for.
2. Review the diff file by file. Look for unrelated changes, removed tests or suspicious shortcuts.
3. Check the test output Codex reports, then run tests yourself if it is a local task.
4. Ask for explanations of anything unclear: “Why did you change the date parsing here?”
5. Request adjustments as follow-ups rather than starting over.
6. Open a pull request and run your normal CI checks and human review.

Never merge agent changes you do not understand. Speed is only valuable if the code is correct and maintainable.

Local vs cloud tasks

A common pattern is to explore and plan locally, then delegate well-defined tasks to the cloud in parallel, such as updating dependencies in one task, adding tests in another and fixing a reported bug in a third.

Real workflows that work well

1. Bug fixing from issues

Paste a bug report or link an issue, including steps to reproduce and expected behaviour. Ask Codex to reproduce the bug with a failing test first, then fix it. The failing test proves the bug existed and protects against regressions.

2. Writing tests for untested code

Point Codex at a module and ask for tests that cover normal cases, edge cases and errors, without changing the module itself. This is low risk and high value, and it makes later refactors safer.

3. Dependency updates

Ask Codex to upgrade a library, update code for breaking changes, and run the full test suite. Review carefully, as upgrades can have subtle effects.

4. Small features

Well-defined features, such as adding a filter to a list, exporting data to CSV or adding a settings option, are a sweet spot for agents.

5. Refactoring with guardrails

Refactors are safe when tests are strong. Ask Codex to keep public behaviour unchanged and confirm all tests pass.

6. Documentation

Ask for README updates, API documentation or code comments based on the actual code. Review for accuracy.

7. Code review assistant

Use Codex to review pull requests for bugs, security issues and missing tests before human review, so reviewers can focus on design and product questions.

8. Website and marketing tech tasks

For marketing teams with developers, Codex can handle tasks like adding structured data across templates, fixing broken internal links, improving page speed or implementing tracking. See our guide to schema markup for AEO for what to ask for.

Safety, permissions and security

A coding agent can run commands on your machine or in the cloud, so permissions matter.

• Use the sandbox. Keep Codex in a sandboxed mode that limits file access and network access unless a task truly needs more.
• Start with approvals on. Require approval for commands and edits until you trust its behaviour in your project.
• Never share production credentials. Use test databases and test API keys. Keep secrets in environment variables the agent does not need.
• Watch for prompt injection. Content in issues, web pages or files can contain instructions aimed at agents. Review what the agent read and did, especially when it browsed the web.
• Review dependency additions. Check any new package for legitimacy and licence.
• Use branches and pull requests so nothing reaches your main branch without review.
• Follow company policy on AI tools and data; see our AI usage policy template.

Managing usage and cost

Codex usage counts against your ChatGPT plan’s limits or your API spending. Larger repositories, long-running tasks, parallel agents and the most capable models use more. To keep usage efficient:

• Break big goals into focused tasks.
• Give precise file paths and context so the agent does not search the whole codebase.
• Use lighter models for routine tasks where available.
• Cancel tasks that are clearly going in the wrong direction rather than letting them run.
• Review usage dashboards regularly. For API pricing comparisons, see LLM API pricing comparison.

Codex vs other coding agents and tools

For a broader comparison, see our list of the best AI coding assistants.

Codex for teams

When several developers use Codex on the same repository, a little coordination prevents chaos:

• Share one AGENTS.md and treat it like code: changes go through review.
• Use branches per task so agent changes never collide on the main branch.
• Label agent pull requests so reviewers know to check for typical agent mistakes, such as unnecessary changes or weakened tests.
• Agree on autonomy levels for different kinds of work, for example full autonomy for documentation but approvals for database changes.
• Track outcomes. Measure cycle time and bug rates before and after adopting Codex to see real impact.

Common mistakes

• Vague tasks that leave the agent guessing about scope and success.
• No tests in the project, so neither you nor the agent can verify changes.
• Giving full autonomy too soon, before you understand how Codex behaves in your codebase.
• Merging without review because the summary sounded convincing.
• Huge tasks that touch dozens of files at once and are hard to review.
• Exposing secrets in the environment or repository.
• Ignoring AGENTS.md, leaving the agent to rediscover your conventions every time.

Codex for non-developers and small teams

Codex is designed for developers, but small businesses with a website or simple app can still benefit through a developer or technically minded team member. Typical wins include fixing long-standing small bugs, adding analytics events, improving page speed, cleaning up broken links and adding structured data. The key is to describe outcomes clearly and have someone who understands the code review the changes. For simpler one-off tasks, ChatGPT itself may be enough; see how to use ChatGPT for coding.

An illustrative first week with Codex

1. Day 1: Install, connect your repository, write AGENTS.md and ask Codex to explain the architecture back to you.
2. Day 2: Ask for tests on one untested module. Review and merge.
3. Day 3: Fix two small bugs from your backlog with failing tests first.
4. Day 4: Try cloud tasks: delegate a dependency update and a documentation update in parallel.
5. Day 5: Use Codex to review a teammate’s pull request and compare with human review.

By the end of the week you will know where Codex saves time in your project, where it needs tighter instructions, and how much autonomy feels comfortable.

Using the Codex CLI

The Codex CLI is open source and runs in your terminal. It is popular with developers who prefer keyboard-driven workflows and scripts. Typical use looks like this: open a terminal in your project, start Codex, describe the task, and approve or deny the commands it proposes. Recent versions add an agent command centre for managing several agents from the terminal. Because it runs locally, it uses your local tools, environment and Git setup, which makes it easy to combine with your existing scripts. Keep the CLI updated, as new releases arrive frequently with improvements and fixes.

Automations, plugins and computer use

During 2026 Codex gained features that extend it beyond editing code:

• Plugins connect Codex to tools such as issue trackers, documentation and cloud services, so it can read tickets or update status.
• Automations let you schedule recurring tasks, such as a weekly dependency check or a nightly test of a critical flow.
• Computer use and browser tools allow Codex to interact with applications and web pages, for example to test a user flow in a browser.
• Security scanning and pull request review help catch issues before they reach production.

Each of these increases what the agent can touch, so apply the same caution: limit permissions, review results and keep humans in the approval loop for anything that affects users or data.

Our take

Codex has matured from an experimental terminal tool into a full agent platform that lives in the ChatGPT desktop app, your terminal, your editor, the cloud and even your phone. For developers, the biggest gains come from delegating well-defined work, such as tests, bug fixes, upgrades and reviews, while keeping humans responsible for design decisions and final approval. Invest an hour in a good AGENTS.md, write tasks with clear acceptance criteria, and treat every diff like a colleague’s pull request. Do that and Codex can take a meaningful share of routine engineering work off your plate.

Bottom line for busy teams

If you only remember a few things about Codex, make them these. First, the quality of what Codex produces depends heavily on the quality of your instructions: a clear AGENTS.md and tasks with acceptance criteria make a bigger difference than switching models. Second, tests are the safety net that makes agent work trustworthy; invest in them before delegating larger changes. Third, every change still needs human review, ideally through the same pull request process your team already uses. Fourth, permissions matter: keep the agent sandboxed, approvals on for risky actions, and production credentials far away. Fifth, measure the impact in real terms, such as time to merge and bugs after release, rather than relying on how fast it feels.

Teams that follow these principles usually find Codex takes on a growing share of routine work over a few months, starting with tests and small fixes and moving towards larger, well-specified features. Teams that skip them often end up with large, hard-to-review diffs and a sense that the agent creates as much work as it saves. The tool is powerful; the discipline around it is what turns that power into reliable output. Start small this week with one well-defined task, review it carefully, and build from there.

Frequently asked questions