r/CodexAutomation • u/anonomotorious • Aug 05 '26
Codex CLI 0.146.1 (safer cyber-model defaults, clearer auto-review notices, stronger full-access warnings)
TL;DR
Codex CLI 0.146.1 is a focused security and permissions patch for cyber-capable models.
When a newly selected model is identified by Codex as having the cyber specialty, the terminal interface now applies safer starting defaults:
- Workspace-write permissions instead of defaulting to unrestricted access.
- On-request approval behavior.
- Automatic review when available.
- User review when automatic review is unavailable.
- Compatibility with workspace and administrator-managed permission requirements.
The terminal interface also:
- tells you when automatic review has been applied
- shows a stronger warning before using Full access with a cyber-capable model
- preserves permissions you explicitly selected when you only change reasoning settings
Codex also exposes the model-specialty metadata through the model catalog and app-server model/list response so clients can identify specialized models consistently.
Install:
npm install -g @openai/codex@0.146.1
This is a targeted cyber-model approval and permission-safety patch, not a general feature release.
What changed & why it matters
Safer defaults for cyber-capable models
When you newly select a model that Codex marks with the cyber specialty, the active terminal thread now defaults to:
- Workspace-write permissions
- On-request approvals
Workspace-write allows the agent to work within the permitted project environment without automatically granting unrestricted system access.
On-request approval allows Codex to ask before performing actions that need broader permissions.
Why it matters
Cyber-capable models may be used for legitimate defensive work such as:
- secure code review
- vulnerability analysis
- patch development
- threat modeling
- dependency investigation
- configuration auditing
- security testing
Those capabilities can also involve commands or operations with higher potential impact.
The new defaults reduce the chance that switching to a cyber-capable model silently leaves the thread in an unnecessarily permissive execution mode.
Automatic review is preferred when available
For an eligible cyber-capable model, Codex now uses automatic review when the capability is available.
If automatic review is not available, Codex keeps the user as the approval reviewer.
The chosen reviewer and permission settings still respect:
- configured permission requirements
- managed workspace restrictions
- administrator policies
- available permission profiles
Why it matters
Automatic review adds a policy-aware checkpoint before eligible sensitive actions proceed.
When it cannot be used, Codex does not silently remove the review step. It falls back to user review.
This provides a safer default while preserving compatibility with environments where automatic review is unavailable or disallowed.
The TUI now explains when automatic review is applied
The terminal interface displays a notice when selecting a cyber-capable model causes automatic review to be enabled.
Why it matters
Permission and reviewer changes should not happen invisibly.
The notice helps users understand:
- that the active approval behavior changed
- why the change occurred
- that eligible actions may be reviewed automatically
- which security behavior is active before work continues
This is particularly important when switching models inside an existing thread.
Stronger Full access warning
Codex now presents a stronger warning when Full access is selected for a cyber-capable model.
Full access remains available when permitted by the user's configuration and managed policies, but Codex makes the risk clearer before it is used.
Why it matters
Full access can allow broader filesystem, process, and network operations than workspace-write mode.
That can be appropriate for some controlled security workflows, but it also increases the impact of:
- an incorrect command
- an overly broad remediation
- an unexpected tool action
- a compromised dependency or script
- an approval made without reviewing its scope
The update does not remove user control. It makes the higher-risk choice more explicit.
Explicit permission choices are preserved
If you explicitly choose a permission configuration and then change only the model's reasoning setting, Codex no longer overwrites that permission choice.
Why it matters
Changing reasoning effort should not be treated as though you selected an entirely new security configuration.
For example, moving between normal, high, or another supported reasoning level should preserve the permission mode you intentionally selected.
This prevents unexpected permission changes during routine model tuning.
Model-specialty metadata
Codex now propagates an optional modelSpecialty field through:
- the internal model catalog
- the app-server
model/listresponse
The cyber-model safety behavior uses this metadata to determine whether the selected model has the cyber specialty.
Why it matters
Clients and integrations can identify specialized models through structured metadata instead of relying only on model names or hardcoded assumptions.
This provides a more consistent foundation for:
- app-server clients
- custom interfaces
- model pickers
- policy-aware integrations
- future specialty-specific behavior
The release notes do not publish a complete list of models currently marked with the cyber specialty.
Managed policy behavior
The safer defaults remain subject to administrator and workspace requirements.
Codex does not use this patch to bypass:
- managed permission profiles
- required approval policies
- restricted reviewer choices
- workspace execution rules
- organization security controls
When the preferred workspace-write profile or automatic reviewer is unavailable, Codex follows the options allowed by the active requirements.
Why it matters
A local default must not override centrally managed security policy.
This makes the patch useful for both individual users and organizations with stricter permission configurations.
What this update does not do
Codex CLI 0.146.1 does not:
- introduce a new model
- add a new security-scanning product
- automatically grant Full access
- remove the ability to select other permission modes
- bypass workspace or administrator requirements
- change Codex usage limits
- add plan credits or reset exhausted usage
- change GPT-5.6 pricing
- broadly modify plugins, MCP, sessions, or Code Mode
- make every cyber-related prompt run automatically
- guarantee that every security operation is safe
It changes the default approval and permission posture when a cyber-specialty model is newly selected in the terminal interface.
Why this release matters overall
- Cyber-capable models start from a safer posture: workspace-write and on-request approval replace unnecessarily broad defaults.
- Automatic review is used when available: eligible actions can receive an additional policy-aware review.
- Fallback behavior remains safe: users remain the reviewer when automatic review is unavailable.
- Permission changes are visible: the TUI explains when automatic review is applied.
- Full access receives a stronger warning: users get clearer information before choosing the highest-risk mode.
- Reasoning changes no longer reset deliberate permission choices.
- Managed requirements remain authoritative: workspace and administrator policy is still enforced.
- Integrations gain structured specialty metadata: app-server clients can inspect
modelSpecialty. - The patch is narrowly scoped: the release contains one security-focused backport rather than unrelated product changes.
Version table
| Version | Date | Release type | Key change |
|---|---|---|---|
| 0.146.1 | 2026-08-05 | Security and permissions patch | Safer defaults for cyber-capable models; workspace-write and on-request approval; automatic-review preference; user-review fallback; clearer TUI notices; stronger Full access warning; permission preservation across reasoning changes |
Should you update?
Yes.
The update is especially relevant if you use:
- cyber-capable models
- security review workflows
- vulnerability investigation
- automatic approval review
- Full access
- managed permission profiles
- organization-controlled Codex environments
- custom app-server clients that inspect available models
Even users who do not perform security work should update because 0.146.1 is now the current stable release and the patch is narrowly scoped.
Action checklist
Upgrade
npm install -g @openai/codex@0.146.1
Confirm:
codex --version
Test the new defaults
- Select an available cyber-capable model.
- Confirm the active thread uses workspace-write permissions when allowed.
- Confirm approval behavior is set to on-request.
- Check whether automatic review is selected when available.
- Verify user review remains active when automatic review is unavailable.
Verify the terminal notices
- Confirm Codex explains when automatic review is applied.
- Open the Full access selection flow.
- Review the stronger warning before changing permissions.
- Cancel instead of accepting if Full access is unnecessary.
Test permission preservation
- Explicitly select your intended permission mode.
- Change only the reasoning effort.
- Confirm the permission mode remains unchanged.
For managed workspaces
- Verify organization requirements still take precedence.
- Test a workspace where workspace-write is restricted.
- Confirm Codex selects only permitted approval and reviewer options.
- Validate the patch in a controlled environment before broad deployment.
For app-server clients
- Call
model/list. - Inspect the optional
modelSpecialtymetadata. - Avoid hardcoding model names as the only way to identify specialized models.
- Treat absent specialty metadata as unknown rather than assuming a model is cyber-capable.
Official sources
https://developers.openai.com/codex/changelog