Claude Code vs Codex

Two Safety Models

The clearest architectural difference is how each agent is kept inside its bounds on a developer's machine. Codex relies on an operating-system sandbox. Its default mode, workspace-write, lets the agent read and edit files in the project and run routine commands, and requires approval to go further. The sandbox is enforced by platform mechanisms (Seatbelt on macOS, bubblewrap on Linux, a native sandbox on Windows), and network access is restricted unless granted. A read-only mode and an unrestricted mode sit on either side.

Claude Code relies on permission modes. In Manual mode it stops and asks before most actions that edit files, run shell commands or reach the network. Other modes relax that: acceptEdits approves file changes, plan mode explores without editing, and auto mode hands the approve-or-deny decision to a second model, a classifier, that reviews each action. Anthropic's documentation says auto mode is now the starting mode for interactive terminal and VS Code sessions on current versions. One approach draws a hard boundary and lets the agent move freely inside it; the other evaluates actions one by one. Security teams tend to have a preference, and it is worth asking them before standardising.

Web Search and Tool Choice

The two agents differ sharply in how often they consult the web. Armature, a vendor, analysed 5,292 valid agent sessions in which Claude Code, Codex and Cursor were asked to pick tools such as databases, payment providers and email services across 75 repositories. Codex used web search in 94% of sessions. Claude Code searched in roughly 30%, although when it did, it browsed about three times as many pages as Codex. The three agents chose the same tool only 42% of the time.

The product defaults are consistent with that gap. Codex enables cached web search by default for local work, drawing on an OpenAI-maintained index instead of fetching arbitrary pages live, which OpenAI says reduces prompt injection risk. Claude Code's WebSearch and WebFetch tools require permission. The practical consequence for developers is that Codex's recommendations are more likely to reflect recently published information, while Claude Code's are more likely to reflect what the model learned in training unless it is told to look. For companies that build developer tools, it means the two agents are reached through different channels. The study is a vendor report and does not state which model versions were used, so the exact percentages should be treated as a snapshot.

Models and Openness

Each agent is tied to its maker's models by default. Claude Code uses Opus 5.5 as the default on paid plans and the API, with Sonnet 5.5, Haiku and Fable models selectable, and enterprises can route them through Amazon Bedrock, Google Cloud or Microsoft Foundry. Codex recommends GPT-6.1 Sol, which OpenAI describes as offering "near-Astra performance for complex work at a lower cost", with Astra for the hardest work and GPT-6 Luna for lighter tasks.

Codex is the more open of the two as software. The CLI is published under the Apache-2.0 licence, and its documentation describes configuring custom model providers through any compatible Responses API endpoint. Claude Code's repository is public and widely starred, but an open-source licence for the agent is not publicly documented, and the product runs Claude models only. Teams that want to audit, fork or re-point the harness will find more room in Codex. Teams that want the agent their model vendor tunes most closely get that from either.

Cloud Tasks and Surfaces

Both run long tasks in the cloud. Codex Cloud gives each task its own container with restricted network access by default, and tasks can be started from ChatGPT on the web, desktop or mobile, from the CLI, by mentioning @codex on GitHub, or from Slack. Claude Code's cloud sessions run on isolated Anthropic-managed virtual machines with limited network access by default, start from the browser, mobile app, desktop app or terminal, and can be pulled back into a local terminal session. Anthropic also offers routines for scheduled and event-triggered runs, and Codex lists scheduled tasks. Functionally these are close. Codex's advantage is that it lives inside ChatGPT, which many organisations already license. Claude Code's is session mobility between local and cloud.

Pricing and Adoption

Both are bundled with a $20 subscription. ChatGPT Plus includes Codex with published estimates of 15 to 160 local messages per five hours on GPT-6.1 Sol and 350 to 3,000 on GPT-6 Luna; Pro starts at $100 with $200 and $500 options, and Business is $20 per user per month billed annually. OpenAI also lists limited Codex access on its Free and $8 Go plans. Claude Pro at $20 includes Claude Code, Max starts at $100 with five or twenty times Pro's usage, and Team seats are $25 or $125. Anthropic does not publish message-count estimates on its pricing page.

On usage, JetBrains' survey of more than 15,000 professional developers (May to July 2026) put Claude Code at 39% and Codex at 16%, with GitHub Copilot at 21% and Cursor at 12%. Shares overlap because many developers use several agents.