OpenAI Codex Review: Plans, Models, and a Planted-Bug Test

What Is OpenAI Codex?

OpenAI Codex is a coding agent that reads your repository, edits files, runs commands, and reviews changes. You reach it through one ChatGPT account across a desktop app, a terminal client, an editor extension, a cloud runner, and GitHub.

The terminal client is open source: the openai/codex repository is Apache-2.0 licensed and has about 133k stars on GitHub.

For install steps, sandbox flags, and CI usage, see the Codex CLI guide. To connect Codex to tools outside the repository, see Codex MCP.

Codex Plans and Models in November 2026

The Codex pricing page says ChatGPT Work and Codex share usage: ChatGPT Work uses the same pricing, credits, and usage limits as Codex.

Dollar prices are on that page. The table below lists what each plan unlocks in Codex.

OpenAI's Codex models page describes GPT-6 Astra as its most capable model and GPT-6.1 Sol as near-Astra performance at a lower cost. GPT-6.1 Terra is the fast choice for writing and computer use, and GPT-6 Luna handles focused, high-volume tasks.

• Retired in 2026 - gpt-5.4 and gpt-5.4-mini left Codex for ChatGPT sign-ins on August 31, GPT-5.3-Codex-Spark left the desktop app, CLI, and IDE extension on September 14, and GPT-5.5 left ChatGPT sign-ins on October 14.
• API-key sessions - GPT-5.5 stays available through the OpenAI API and in Codex sessions signed in with an API key, so CI jobs on a key were not cut off.
• Saved configs - Any script, custom agent, or scheduled task that names a retired model needs a new model name. Pin the model with -m so a retirement surfaces as a failed run instead of an unnoticed model switch.

The pricing page estimates local messages per five-hour period for Plus and standard Business, says Pro plans currently have no five-hour limit, and notes that weekly limits may also apply. The Codex usage guide shows how to check what is left with /usage and /status.

How Codex Sandboxes and Approves Commands

OpenAI's approvals and security guide says Codex runs with network access off by default. Locally, an OS-enforced sandbox limits what it can touch, and an approval policy decides when it must stop and ask you.

• read-only - Codex can read and plan but not edit. Switch to it with /permissions when you want a chat about the code without changes.
• workspace-write with on-request approvals - The Auto preset. Codex reads, edits, and runs commands inside the working directory, and asks before it edits outside it or runs a command that needs the network.
• danger-full-access - Codex is no longer limited to your project directory. OpenAI's Windows docs warn that full access can cause destructive actions and data loss, and suggest rules for targeted exceptions instead.
• The retired untrusted policy - approval_policy = "untrusted" no longer works. For interactive, read-only use, OpenAI suggests the read-only sandbox with on-request approvals.

For unattended runs, codex exec accepts --approve-for-me, which routes approval requests through automatic review inside the workspace-write sandbox. The Codex auto-review guide covers what that reviewer checks before it approves a command.

Testing Codex Review on a Planted-Bug Pull Request

The test gave Codex a pull request with known defects. A small Node order desk got a branch that adds a bulk discount, order notes, and order cancelling, with bugs planted on purpose and its unit tests still green.

The setup mirrors a normal code review: the reviewer sees the diff and the repository, including a written pricing spec in docs/pricing.md, and nothing else.

npm install -g @openai/codex
git checkout feature/bulk-pricing
CODEX_API_KEY=<your-api-key> codex exec review --base main -m gpt-6.1-sol -o codex-review.md

The patch introduces unauthorized order cancellation and stored HTML injection, along with regressions in discount boundaries and quote validation feedback.

Full review comments:

- [P1] Check ownership before cancelling an order - server.mjs:77-79
  A request with `X-User: ana` can delete Ben's seeded order via `DELETE /api/orders/2`. The new handler checks only the ID, unlike the GET handler's ownership check. Include the current user in the lookup and return 404 for orders belonging to someone else.

- [P1] Render order notes as text rather than HTML - public/app.js:56-59
  An order note such as `<img src=x onerror=alert(1)>` is stored unchanged and interpolated into `innerHTML`, causing script execution whenever history renders. The 200-character limit does not prevent this. Build the note using `textContent` or escape it before HTML interpolation.

- [P2] Apply the bulk discount at exactly ten units - pricing.mjs:7-7
  For a quantity of exactly 10, this condition charges full price despite both `docs/pricing.md` and the new promotional text promising the discount for 10 or more units. For example, ten cold brews cost $45 instead of $40.50. Use an inclusive threshold and cover the boundary in the pricing test.

- [P2] Restore quote error handling before formatting the total - public/app.js:33-34
  When the user requests a quote with no selected items or an invalid quantity, the API returns an error without `total`. The removed error branch means the page now displays `Total: $NaN` and leaves the error message blank. Check the response for an error, clear the total, and display the API's validation message before formatting a successful quote.

Browser Check Results

A diff review and a behavior check answer different questions, which is the gap AI code review vs verification lays out. The behavior side here was Kane CLI, TestMu AI's browser agent: it runs a plain-English objective in real Chrome and returns pass or fail with a sealed evidence pack of screenshots, network log, and console output.

Kane CLI exits 0 on a pass, 1 on a failed check, 2 on an environment error, and 3 on a timeout, and it records a confirmed product bug as result code 740. Each objective came straight from docs/pricing.md:

kane-cli run "Go to http://127.0.0.1:8741/. Set the Cold brew 1L quantity to 10 and click Get quote. Verify the total reads exactly Total: \$40.50, because docs say 10 or more units get 10% off the line." --agent --headless --timeout 300
echo $?   # 1 on the pull request build, 0 after the fixes

Check	Build	Result	Triage verdict	Time and credits
10 units quote $40.50	Pull request	Failed, exit 1, result code 740	Application issue, UI data defect, 0.98 confidence	85 s, about 25 credits
150 units show "Quantity must be 1-99"	Pull request	Failed, exit 1, result code 740	Application issue, UI data defect, 0.96 confidence	149 s, about 34 credits
Both checks in one objective	After applying the fixes Codex suggested	Passed, exit 0	None needed	91 s, about 25 credits

• Same bugs, different evidence - Kane CLI reached the two P2 bugs from the rendered page. For the quote check, its triage read the HTTP response and placed the fault in the page: the request correctly rejected 150, and the page displayed an invalid total instead of the message.
• Exit codes ignore priority - A failed browser check exits 1 whatever priority a reviewer assigned, so a P2 bug that GitHub would never show still stops the pipeline.
• What stayed with Codex - The ownership and HTML-injection bugs never surface on a normal page load, so a browser objective for the happy path would not find them. The diff review is the layer that catches those.

Codex Review on GitHub, the CLI, and CI

Codex reaches a pull request through several routes, and they differ in who can trigger them, what they show, and which sign-in they need.

To steer what Codex flags, the GitHub review docs point to a ## Code Review Rules section in the AGENTS.md file closest to the code, with ### headings to group checks. Start with two or three concise rules, keep lint and formatting in CI, and see AGENTS.md for how Codex merges nested files. Rules for this order desk could look like this:

## Code Review Rules

### Pricing

- Discount thresholds must match docs/pricing.md. Flag any boundary that differs from the written rule.

### Order endpoints

- Every /api/orders/:id route must check that the order belongs to the requesting user, as the GET route does.

• One-off focus - Add the focus to the trigger, such as @codex review for issues in the database migration.
• Fix follow-ups - Comment @codex fix the P1 issue, and Codex starts a chat with the pull request as context and can push a fix when it has permission.
• Rule scope - OpenAI's docs say review rules guide Codex but do not replace tests, branch protections, or required approvals.

To put lower-priority findings on a pull request, run Codex in CI and post its output yourself.

The Codex GitHub Action installs the CLI, runs codex exec with a review prompt you write, and its sample workflow posts the final message as a pull request comment. It needs a Linux or macOS runner, or safety-strategy: unsafe on Windows.

Note: Codex reviews the diff; Kane CLI by TestMu AI checks the running page in real Chrome and exits 1 on a failed objective, so a bug Codex ranks P2 can still stop the merge. Start free and add a browser check next to your Codex review.

Is Codex Good?

Yes, for teams already on a ChatGPT plan who want one agent across the terminal, editor, cloud, and GitHub, with a reviewer that gives specific and repeatable findings. Its limits are the GitHub severity filter, a reviewer that never runs the app, and fast model turnover.

• Reach - A Plus sign-in covers the desktop app, CLI, IDE extension, Codex Cloud, and GitHub review, so work started in one surface can be reviewed in another.
• A consistent reviewer - Two runs produced the same four findings with the same priorities, each with a reproduction and a fix.
• Safe defaults - Network access is off and writes stay inside the workspace unless you change the sandbox.
• The GitHub filter - Only P0 and P1 findings post to pull requests, which in this test would have left both P2 bugs off the review.
• No runtime check - The reviewer reads code. It did not run the tests or open the page, so behavior claims still need a separate check.
• Model churn - GPT-5.4, GPT-5.3-Codex-Spark, and GPT-5.5 all left Codex for ChatGPT sign-ins between August 31 and October 14, so scripts that name a model need upkeep.

In the same survey's want-to-use results, 2,152 of 12,255 respondents (17.6%) said they want to use OpenAI Codex in the next six months, third behind Claude Code and GitHub Copilot.

If you are choosing between agents rather than reviewing Codex alone, Claude Code vs Codex vs Cursor compares models, permissions, and plans side by side. This short from TestMu AI maps each agent to the job it fits:

• On Plus or higher with GitHub - Turn on Automatic review, add Code Review Rules to AGENTS.md, and read the full CLI review for anything the pull request does not show.
• CI on an API key only - Run codex exec review in the pipeline and parse its output, because API-key sign-in has no GitHub code review.
• Free or Go - Try Codex in the desktop app with GPT-6 Luna before paying for the CLI and review features.
• Shipping user-facing changes - Pair the review with a browser check that exercises the flows users rely on, written from your spec.

Conclusion

Run a Codex review with codex exec review --base main on your next pull request, and compare its P2 findings with what GitHub posted for the same change.

Then let Codex run a browser check on its own changes. The Kane CLI with AI coding agents guide installs the Kane CLI skill for Codex CLI with npx @testmuai/kane-cli-skill. How Codex then finds and selects that skill is covered in Codex skills.

Testing from the terminal? Kane CLI by TestMu AI lets SDETs and developers plan, write, run and debug tests from the command line.

To run your first test, start free, or

book a demo

for a full walkthrough of the product.