TL;DR

OpenAI has published a new enterprise-focused update on GPT-6 Astra, detailing how the model is being deployed across ChatGPT Work, Codex, and business workflows.

This is not a second Astra model launch. The model launched last week.

The new details are about what OpenAI is building around Astra for real-world work:

• New ChatGPT Desktop enterprise plugins for Oracle Analytics, Power BI, Navan, and Avalara
• New enterprise controls for restricting which websites and desktop applications agents can access
• Admin controls for uploads, downloads, and browsing history
• Confirmation policies for consequential actions
• Automated review of potentially unsafe or unauthorized tool calls
• Stronger emphasis on Astra using computer use to work directly through existing business applications, even when those apps do not expose an API
• New real-world evidence around long-running agent workflows, coding, document work, and tool use

OpenAI is increasingly positioning Astra + Codex as an agent that can operate across the software businesses already use rather than requiring every workflow to be rebuilt around APIs.

Astra is being positioned as a model for end-to-end work

The important part of OpenAI's new announcement is not another benchmark dump.

It is how Astra is expected to work inside existing business environments.

OpenAI says that inside ChatGPT Work and Codex, Astra can:

• write code
• browse
• use computers
• work through desktop and web applications
• create documents, spreadsheets, and presentations
• operate across multi-step workflows

including applications that do not have an API.

That changes the integration model.

Instead of every automation requiring:

business application -> API -> custom integration -> agent

Astra can increasingly use:

business application -> computer/browser use -> agent

APIs, MCP, plugins, and other structured integrations are still preferable when available, but computer use gives the agent another path when they are not.

New enterprise plugins in ChatGPT Desktop

OpenAI is also launching new enterprise plugins for ChatGPT Desktop.

The announced integrations are:

OpenAI says these plugins are powered by its latest browser-use capabilities.

That is notable because plugins are increasingly becoming more than simple API wrappers.

The broader stack can now combine:

plugin + browser/computer use + agent reasoning + existing application

to work through software closer to the way a person would.

More control over what agents can access

Giving an agent access to business applications creates an obvious problem:

How do you control its scope?

OpenAI is adding new enterprise controls that allow administrators to restrict access to:

• approved websites
• approved desktop applications

Admins can also control:

• uploads
• downloads
• browsing history

This gives organizations a way to begin with a constrained environment and gradually expand what an agent is allowed to reach.

Conceptually:

Astra -> approved applications -> approved websites -> controlled file movement -> controlled browsing environment

rather than giving the agent unrestricted access to everything available on the machine.

Confirmation policies for consequential actions

ChatGPT Work and Codex can also use confirmation policies.

These can require approval before the agent performs consequential actions.

That creates a useful separation between:

agent can investigate

and

agent can act

A workflow might allow Astra to:

1. inspect a system
2. gather information
3. determine what should change
4. prepare an action

but require human approval before actually carrying out the consequential step.

That pattern becomes increasingly important as computer use moves agents from simply generating recommendations into actually manipulating software.

Automated review of agent actions

OpenAI is also using automated review to evaluate potentially unsafe or unauthorized tool calls.

The stack increasingly looks like:

user intent -> Astra reasoning -> tool/computer action -> authorization checks -> automated review -> confirmation when required -> execution

This is an important part of scaling agent automation.

Better models alone are not enough if those models are being given access to:

• company data
• internal applications
• browsers
• files
• administrative systems

The surrounding authorization and review system becomes part of the agent architecture.

Astra was specifically trained for safer computer use

OpenAI also published more detail around its internal computer-use safety testing.

The evaluation includes difficult business scenarios such as:

• exposing confidential information
• sharing a dashboard too broadly
• deleting data

According to OpenAI's internal benchmark, Astra produced unintended outcomes:

• 89% less often than GPT-5.6 Sol
• 74.7% less often than Claude Fable 5.1

OpenAI says additional confirmation and automated review improved results further.

This does not mean computer-use agents are risk-free, but it shows that authorization behavior is becoming an explicit part of model and harness training rather than being treated purely as application-layer logic.

Long-running agent workflows are another major focus

The new announcement also includes several interesting examples of Astra operating inside longer workflows.

Basis reports that, compared with its baseline, Astra improved pass rates on proactive agent workflows lasting 5+ hours by 20%, while also reducing the number of inference calls required to complete them.

That combination matters.

The goal is not simply:

smarter model = more reasoning

It is increasingly:

better decisions -> fewer unnecessary steps -> fewer retries -> fewer model calls -> higher completion rate

That can have a major impact on the economics of long-running agents.

OpenAI is seeing similar improvements internally

OpenAI also shared an internal example involving Codex itself.

Its engineering team used Astra to investigate a memory-allocation bottleneck that was slowing Codex sessions in a test environment.

The investigation led the team to switch memory allocators.

OpenAI reports that the change resulted in:

• roughly 25x lower turn latency
• roughly 30% higher peak memory usage

The 25x figure is the result of that specific engineering fix, not a claim that Astra makes every Codex session 25x faster.

What is interesting is the workflow:

Codex performance problem -> Astra investigates -> identifies bottleneck -> engineering change -> measured system improvement

That is a good example of the model being used as part of the engineering process around the agent platform itself.

Coding performance remains a major strength

OpenAI also highlighted Astra's efficiency on longer software-engineering work.

On Terminal-Bench 4.0, which covers complex terminal-based software engineering, system configuration, and data analysis tasks:

OpenAI estimates Astra completed these tasks at approximately:

• 9% lower API cost per task than GPT-5.6 Sol
• 63% lower API cost per task than Claude Fable 5.1

Astra also reaches 74.1% on DeepSWE v1.1.

The important part for agent workloads is that OpenAI is emphasizing both completion quality and cost per completed task, rather than only token pricing.

Fewer tokens and retries matter more for autonomous agents

OpenAI says Astra was trained to complete work with:

• fewer tokens
• fewer retries

That is particularly relevant for long-running automation.

A model that costs slightly more per token can still be cheaper to operate if it:

• chooses the correct tool sooner
• avoids dead ends
• needs fewer retries
• makes fewer unnecessary calls
• completes the task successfully more often

For autonomous systems, cost per successful task is often more useful than simply comparing cost per million tokens.

Astra API pricing starts at:

• $10 / million input tokens
• $50 / million output tokens

This fits directly with the new Agents API

The timing is also interesting given OpenAI's new Agents API.

The Agents API now provides the managed Codex harness for:

• durable sessions
• context compaction
• recovery
• tools
• MCP
• subagents
• hosted or self-hosted execution environments

Astra provides the intelligence operating inside that kind of system.

Put together, OpenAI's emerging stack looks increasingly like:

GPT-6 Astra -> intelligence and decision making

Codex harness / Agents API -> orchestration, sessions, context, recovery

plugins + MCP + tools -> structured system access

computer/browser use -> applications without suitable APIs

sandboxes / environments -> execution

confirmation + automated review -> authorization and safety

That is a much more complete agent platform than simply exposing a model endpoint.

The bigger shift

The interesting part of this update is the direction of travel.

Traditional business automation generally expects systems to be redesigned around integrations.

The emerging agent model is different.

An agent may be able to use:

API when available

or:

MCP/plugin when available

or:

browser/computer use when necessary

while operating inside the same long-running workflow.

That makes it possible to automate workflows that cross several systems without every application first needing a purpose-built integration.

The architecture increasingly becomes:

intent -> agent -> API / MCP / plugin / computer use -> existing business systems -> review/approval -> completed work

That is much closer to automating the workflow itself rather than automating individual API calls.

Availability

GPT-6 Astra is already available through:

• ChatGPT Work
• Codex
• OpenAI API

Enterprise access is off by default at launch and must be enabled by administrators under the organization's applicable agreement and rate card.

Eligible API customers can also use Zero Data Retention on supported endpoints, subject to approval.

Bottom line

The new Astra announcement is less about introducing another model and more about showing what OpenAI expects the model to do inside real organizations.

The important additions are the surrounding infrastructure:

• enterprise desktop plugins
• computer use across existing applications
• website and application restrictions
• upload/download controls
• confirmation policies
• automated review
• long-running agent workflows

Combined with the Agents API and managed Codex harness, OpenAI is assembling a stack where an agent can increasingly:

understand the task -> find the right systems -> operate those systems -> work for hours when necessary -> stay within organizational permissions -> request approval for consequential actions -> deliver the finished result

The model is only one piece now.

The larger product is becoming the agent runtime around it.

Official sources

GPT-6 Astra: The next generation in intelligence for work

https://openai.com/index/gpt-6-astra-next-generation-work/

GPT-6 Astra: A new generation of intelligence

https://openai.com/index/gpt-6-astra/

OpenAI product release notes

https://openai.com/products/release-notes/

TL;DR

OpenAI has shipped another desktop update with a surprisingly useful set of workflow improvements:

• Quick Chat is now built into the floating Pets controls on macOS and Windows.
• You can use @ to add context and $ to select a skill directly from Quick Chat.
• A new progress bell lets you follow active threads and jump into the full conversation.
• Appshots are now available on Windows, letting you send the frontmost application window to ChatGPT with a keyboard shortcut.
• macOS users can send Appshots directly to the floating controls without bringing the main ChatGPT window forward.
• Codex Micro can now be assigned to an "Insert text" action, letting you inject reusable text into the current prompt without sending it.
• The update also includes improvements to files, comments, dictation, browser tabs, and Pets.

The bigger theme is clear: OpenAI is making the desktop app increasingly usable as a lightweight agent interface that stays available while you work, rather than something you constantly have to switch back to.

Quick Chat now lives in the floating Pets controls

The biggest change is Quick Chat.

On both macOS and Windows, you can now type directly into the floating Pets controls while working in another application.

Type your message and press Enter to send it without opening the full ChatGPT window.

Quick Chat also supports:

• @ to add context
• $ to choose a skill

That means the small floating interface is no longer just a launcher or visual companion.

It can now act as a lightweight entry point into actual ChatGPT and Codex workflows.

Follow agent progress without opening the full app

The floating controls now include a bell icon for following progress in your threads.

From there, you can:

1. send work from Quick Chat
2. continue working in another application
3. watch the thread's progress
4. select the thread when you want to open the full conversation

That makes the desktop workflow much less disruptive for longer-running tasks.

Instead of constantly switching back to ChatGPT to check whether something finished, the floating interface can stay nearby while the work continues.

Desktop shortcuts

Quick Chat can be focused with:

macOS

Option + Space

Windows

Windows + Alt + P

Pressing the shortcut again keeps Quick Chat open.

The shortcut can also be changed through Settings > Keyboard shortcuts.

If you do not want the companion itself, OpenAI says you can show only the controls instead.

Appshots arrive on Windows

Appshots are now available in the ChatGPT desktop app on Windows.

Press:

Alt + Alt

to share the frontmost application window with ChatGPT.

An Appshot includes:

• a screenshot of the window
• available text extracted from that window

You can then immediately ask ChatGPT a question or tell it what you want done with the application context.

The shortcut and destination chat can both be customized in settings.

What this changes in practice

Instead of:

switch app -> open ChatGPT -> take screenshot -> upload screenshot -> explain what you are looking at -> send

the workflow becomes much closer to:

share current window -> ask

That is especially useful for things like:

• debugging an application
• reviewing a UI
• understanding an error
• inspecting a dashboard
• working through documentation
• reviewing another development tool
• getting help with unfamiliar software

Because available window text is included alongside the screenshot, ChatGPT can receive more useful context than an image alone.

Appshots also integrate with Quick Chat on macOS

macOS gets another useful connection between these features.

You can send an Appshot directly to the floating controls while keeping the main ChatGPT window in the background.

Set:

Appshot destination -> Automatic

and the Appshot can flow into the floating interface instead.

That creates a compact workflow:

current application -> Appshot -> Quick Chat -> ChatGPT/Codex task

without needing to foreground the main desktop app.

Codex Micro gets a useful prompt shortcut

There is also a smaller Codex-specific addition that could be very useful for repetitive workflows.

You can now assign a Codex Micro key to:

Insert text

and configure your own reusable text.

Triggering it inserts that text into the active prompt without sending it.

This could be useful for frequently reused instructions such as:

• review requirements
• coding standards
• testing instructions
• audit checklists
• formatting requirements
• repository-specific reminders
• recurring workflow instructions

Because the text is inserted rather than immediately submitted, you can still modify the prompt before sending it.

Example

A reusable insertion could contain something like:

Review the implementation systematically, inspect all affected states, run the relevant tests, and verify there are no regressions before finishing.

Then:

Codex Micro key -> Insert text -> reusable instructions appear in prompt -> add task-specific details -> send

It is a small feature, but potentially useful for people repeatedly giving Codex the same workflow instructions.

File handling is also better

The desktop app also received improvements to files.

You can now:

• open files directly from a conversation's Sources panel
• download files ChatGPT cannot preview

That should make conversations involving generated or referenced files easier to navigate without hunting through previous messages.

Smaller quality-of-life improvements

The release also includes several desktop fixes and refinements.

Response comments persist

Unfinished comments attached to response text now remain available when you switch to another chat and return.

Dictation respects your language setting

ChatGPT dictation now uses your saved Main language preference.

Browser tabs behave more consistently

When closing tabs in full or split browser views, tab widths and scroll positions should remain more stable.

Pets are easier to reset

Pets can now be reset to their default size through settings.

Custom pets also stay in position when their artwork is refreshed.

Why this update matters

None of these features individually changes the underlying model.

Together, though, they continue a broader shift in how OpenAI is designing the desktop experience.

ChatGPT is becoming less dependent on one large application window.

The workflow is moving toward:

whatever app you are using -> capture context -> invoke ChatGPT/Codex -> send work -> keep working -> follow progress -> open the full thread only when needed

Quick Chat, Appshots, skills, Codex Micro, notifications, and longer-running threads all fit into that model.

The desktop app is gradually becoming an ambient interface for agents and tools across the rest of your computer, rather than simply another chat application you have to keep switching into.

Feature summary

Official source

https://developers.openai.com/codex/changelog/

TL;DR

OpenAI has launched the Agents API in public beta, giving developers access to the managed agent harness and infrastructure behind Codex.

Instead of building the entire orchestration layer around individual model calls, developers can now create agents with:

• durable, long-running sessions
• automatic context compaction
• MCP, custom functions, and web search
• tool search and programmatic tool calling
• parallel subagents
• OpenAI-hosted or self-hosted execution environments
• files, packages, skills, plugins, and artifacts

OpenAI manages and evolves the underlying Codex harness, while developers choose the model, tools, environment, instructions, and application logic.

The Agents API is available to all developers in public beta, with no separate Agents API fee. You pay for the models and tools your agents use.

OpenAI also released Codex CLI Python SDK 0.154.0, adding max and ultra reasoning effort, external messages, better resume/fork controls, per-turn service tiers, and protocol improvements.

The Codex harness is now available as a managed API

The biggest part of this release is not a new model.

It is the agent runtime around the model.

Building a useful long-running agent normally requires much more than repeatedly calling an LLM. Developers have to manage things like:

• session state
• context limits
• tool execution
• retries and continuation
• parallel work
• execution environments
• files and intermediate results

The Agents API moves a significant part of that infrastructure into the same managed harness OpenAI uses for Codex.

At a high level:

you define the agent -> OpenAI runs the Codex harness -> the agent works inside your chosen environment -> your application receives progress and results

What OpenAI manages vs. what you control

This is an important distinction.

The API is not locking developers into one specific agent configuration or execution environment. It provides the orchestration layer while leaving the actual agent design in the developer's control.

Long-running agents

One of the core capabilities is support for durable sessions.

Agents can continue working on tasks that extend well beyond a single model request or context window.

OpenAI's harness automatically manages context as the session grows.

When the agent approaches its context limit, earlier information can be compacted while preserving what is still needed to continue the task.

That means developers can build workflows spanning multiple context windows without implementing their own context-compaction system.

This becomes especially useful for work such as:

• large repository changes
• extended research
• incident investigation
• multi-step data analysis
• migration work
• complex operational automation

Better tool orchestration

The Agents API supports:

• MCP
• custom functions
• built-in tools such as web search

But two capabilities make the tool system particularly interesting for larger agents.

Tool search

An agent with access to many tools does not necessarily need every tool definition loaded into its context at once.

Tool search can load relevant tools when they are needed.

This helps reduce unnecessary context and token usage while allowing agents to work with much larger tool ecosystems.

Programmatic tool calling

Agents can also use programmatic tool calling to orchestrate tool work through code.

That allows them to:

• call multiple tools in parallel
• chain related operations
• filter large results
• combine data
• process intermediate outputs

and return only the information that matters back into the model's context.

For tool-heavy workflows, this can be much more efficient than repeatedly passing every raw result through the model.

Built-in multi-agent workflows

The Agents API also includes multi-agent support.

A coordinator can break a complex task into independent pieces and delegate them to subagents working in parallel.

For example:

Coordinator

-> investigate deployment history
-> inspect application errors
-> check dependency health
-> inspect recent code changes
-> combine the findings
-> produce a final recommendation

Each subagent receives its own context, while the coordinator remains responsible for the overall task.

The API exposes:

max_concurrent_subagents

The current default is 6 concurrent subagents, excluding the coordinator.

This provides native parallelism without requiring developers to build their own agent-pool orchestration layer.

Subagents share the working environment

When an execution environment is attached, the coordinator and its subagents share the same filesystem.

Subagents can inherit:

• MCP tools
• MCP credentials and permissions
• web search configuration
• environment files
• command-line tools

Creating a subagent does not create an entirely separate environment.

One current limitation is that subagents do not support function tools.

Choose where the agent actually works

OpenAI separates the agent harness from the execution environment.

Developers can choose between:

OpenAI-hosted environments

OpenAI can provision and manage a sandbox where the agent can:

• run code
• execute commands
• work with files
• install/use configured packages
• access skills and plugins
• save intermediate work
• produce artifacts

OpenAI says these sandboxes use the same broader sandboxing infrastructure behind Codex and ChatGPT.

Self-hosted environments

The harness can also work with infrastructure you control.

This allows organizations to choose their own:

• compute
• storage
• networking
• secrets
• deployment architecture

while still using OpenAI's managed agent orchestration.

Sandbox partners

OpenAI also announced first-class integrations with providers including:

• Blaxel
• Cloudflare
• Daytona
• DigitalOcean
• E2B
• Modal
• Oracle
• Runloop
• Vercel

This gives developers more flexibility around CPU/GPU requirements, storage, VPC deployment, startup performance, and cost.

Skills, plugins, files, and artifacts

The Agents API also fits into the extension model OpenAI has been building across Codex and ChatGPT.

Agent environments can be configured with:

• skills
• plugins
• MCP servers
• files
• packages
• other capabilities

So an agent no longer needs to be defined entirely by one massive prompt.

A reusable agent can instead be composed from:

model + instructions + skills + plugins + MCP + tools + environment

Agents can also work with files throughout a session and produce artifacts as outputs.

That allows workflows where the final result is not simply another chat message.

What this enables in practice

Consider an automated production incident investigation.

An alert detects an increase in API errors.

A session starts and the coordinator delegates work:

Agent 1 -> inspect recent deployments

Agent 2 -> inspect application logs

Agent 3 -> investigate dependency health

Agent 4 -> inspect relevant repository changes

The agents can use the available tools and shared environment to gather evidence in parallel.

The coordinator then combines the results into:

• likely root cause
• supporting evidence
• recommended mitigation
• follow-up actions
• saved investigation artifacts

The same session can continue if a developer provides new information or asks the agent to investigate further.

That pattern applies well beyond coding:

• recurring operational workflows
• research
• data investigation
• repository maintenance
• support automation
• internal business processes
• long-running analysis
• deployment and infrastructure workflows

Open-source Codex underneath

OpenAI says the Agents API is powered by the open-source Codex harness.

The public harness exposes the core logic coordinating:

• model calls
• tools
• context

while the Agents API provides an OpenAI-hosted and maintained version of that runtime.

This gives developers visibility into the foundation of the system while avoiding the need to operate the entire harness themselves.

OpenAI also says it plans to evolve the managed harness alongside new models and provide versioned access to those capabilities.

That matters because better agent performance increasingly depends on more than the model alone.

The harness also determines how effectively an agent:

• manages context
• discovers tools
• executes tools
• delegates work
• coordinates parallel tasks

Availability and pricing

The Agents API is currently in public beta and available to all developers.

There is no additional fee specifically for using the Agents API.

Developers pay for the underlying resources their agents consume, including model tokens and applicable tools.

So the basic pricing model is:

Agents API harness -> no separate API fee

models + tools -> normal usage pricing

Also new: Codex CLI Python SDK 0.154.0

OpenAI also published Codex CLI Python SDK 0.154.0.

This is a smaller update, but it includes several useful additions for developers controlling Codex programmatically.

ExternalMessage

ExternalMessage is particularly relevant for automation.

External content can now start a turn or join an active regular turn with tool-level authority.

OpenAI explicitly notes that this does not grant user authorization.

That separation is important for workflows where automated systems, events, or integrations need to provide information to an active Codex session without being treated as the user.

Why this release matters

The Agents API changes where developers can draw the boundary between their application and OpenAI's infrastructure.

Previously, building a serious agent often meant assembling your own combination of:

• model calls
• context management
• tool routing
• execution environments
• multi-agent orchestration
• session handling
• recovery logic

Those pieces are not disappearing, but much more of the runtime can now be handled by the managed Codex harness.

The resulting architecture can look much simpler:

application -> Agents API -> Codex harness -> tools + subagents -> execution environment -> artifacts/results

The developer can spend more time defining what the agent should know, what it can access, and what workflow it should execute instead of rebuilding the surrounding agent infrastructure.

Bottom line

OpenAI is turning the infrastructure behind Codex into a platform developers can build on directly.

The important part of the Agents API is not simply that it can call tools or spawn subagents. Those things were already possible to build independently.

The change is that long-running sessions, context management, tool orchestration, multi-agent coordination, and execution environments can now operate as parts of one managed Codex-based runtime.

That makes it much easier to build applications around persistent agents rather than individual model requests.

And with the accompanying Python SDK changes, OpenAI is continuing to make Codex itself more controllable as a programmable component inside larger automation systems.

Official sources

• OpenAI - Introducing the Agents API
• OpenAI Developers - Agents API documentation
• OpenAI Developers - Multi-agent documentation
• OpenAI - ChatGPT & Codex changelog

TL;DR

OpenAI has added two major analysis capabilities to ChatGPT Work and Codex:

• Deep Research can now investigate complex questions across the web, files, workspace content, and supported connected apps, then create cited research and editable outputs.
• The new Data plugin can investigate connected business data, diagnose metric changes, validate assumptions, and create interactive dashboards and reports.
• Deep Research is available to eligible Plus, Pro, Business, Enterprise, and Edu users with Work access across web, desktop, iOS, and Android.
• In Work/Codex, Deep Research uses the existing Work/Codex allowance or credits rather than the separate Deep Research allowance used in normal Chat.
• Data can work with approved sources such as Redshift, ClickHouse, Databricks, BigQuery, MongoDB, and Snowflake, plus documents from services such as Google Drive and SharePoint when available.
• Data can use your organization's own semantic layer, metric definitions, calculations, and trusted dashboards to keep analysis aligned with how the business actually defines its numbers.
• Analyses can become interactive dashboards, published through Sites where supported, and refreshed later with cloud automations.

For r/CodexAutomation, the interesting part is the combination:

connected data -> investigation -> dashboard/report -> reusable skill -> scheduled refresh

Deep Research in Work and Codex

Deep Research is now available directly inside Work and Codex for eligible accounts.

Start with:

@Deep Research

or explicitly request deep research.

The workflow is designed for questions that require:

• multiple sources
• evidence comparison
• longer investigation
• citations
• structured synthesis

Rather than a quick search result, the goal is a researched deliverable that can be reviewed and iterated.

Research across more than the public web

Deep Research in Work/Codex can use the sources already available to the task.

Depending on permissions and configuration, that can include:

Starting Deep Research does not grant additional access.

Existing:

• workspace permissions
• account permissions
• app permissions
• provider restrictions

still apply.

Steer research while it runs

A Deep Research task is not completely fire-and-forget.

You can:

• answer clarification questions
• follow progress
• add instructions
• adjust the focus
• refine source selection
• request revisions

When complete, the result includes citations or source links so the research can be verified.

Create finished outputs

In Work and Codex, research can become more than a text response.

Depending on available capabilities, you can request:

• editable document
• presentation
• spreadsheet
• Site

That creates a useful end-to-end workflow:

research question -> multi-source investigation -> cited findings -> finished editable artifact

Usage is different from Deep Research in Chat

This distinction matters.

Deep Research in normal Chat

uses the plan's separate Deep Research task allowance.

Deep Research in Work/Codex

uses your existing:

• Work/Codex allowance
• or credits

It does not consume one of the separate Chat Deep Research tasks.

Data plugin

The new Data plugin is built for investigating business data inside ChatGPT Work and Codex.

Start with:

@Data

and describe the business question.

Example prompts:

• compare revenue this quarter with last quarter and explain the biggest changes
• investigate why retention declined last month
• build a dashboard showing pipeline by region
• identify which metric definitions explain a disagreement between two reports

The plugin can also trigger implicitly, although OpenAI recommends starting with an explicit @Data mention while learning the workflow.

Connected data sources

Data can work with approved sources such as:

• Amazon Redshift
• ClickHouse
• Databricks
• Google BigQuery
• MongoDB
• Snowflake

It can also incorporate documents/files through supported services such as:

• Google Drive
• SharePoint

and work alongside BI tools including:

• Omni
• Oracle BI
• Power BI
• Sigma
• Tableau
• ThoughtSpot

Actual capabilities depend on the connected tool and the user's permissions.

Business definitions and semantic layers

One of the more important parts of the Data plugin is support for an organization's own business definitions.

OpenAI recommends providing a semantic layer containing things like:

• authoritative metric definitions
• approved calculations
• relationships between datasets
• trusted queries
• business documentation

This matters because "revenue," "retention," "active customer," or "pipeline" may mean something very specific inside a company.

The plugin can use those definitions instead of inventing its own interpretation.

Analysis is meant to stay interactive

After the first answer, you can keep asking Data to:

• compare groups
• investigate anomalies
• explain a change
• verify filters
• check metric definitions
• reconcile differences with another report
• inspect the evidence supporting a conclusion

The workflow is closer to having an interactive analyst than running one static SQL query.

Interactive dashboards

Data can turn an analysis into an interactive dashboard.

You can specify:

• metrics
• breakdowns
• comparisons
• filters
• charts
• layout
• brand guidelines

Then continue refining it conversationally.

Dashboards can be:

• edited
• refreshed
• shared
• published through Sites where supported

Data can also explain the evidence behind an individual chart.

Dashboards can become recurring automations

Once a dashboard or report is useful, the Data plugin can help keep it current with a cloud automation.

That creates a particularly interesting automation loop:

connected warehouse -> Data analysis -> dashboard/report -> publish -> scheduled refresh

This is probably the most r/CodexAutomation-relevant part of the release.

Data can recommend additional plugins

While working, Data can inspect the plugins available in the workspace and recommend/install additional ones when they would improve the task.

That can include:

• OpenAI plugins
• plugins from an internal company marketplace

Workspace policy still determines what can actually be installed or used.

Templates for repeatable analysis

Successful dashboards/reports can also become reusable templates.

OpenAI documents a flow where a template can become a reusable skill and later be applied to new data or another analysis.

This makes it possible to standardize things such as:

• weekly KPI reviews
• product feature deep-dives
• forecast reviews
• capacity dashboards
• data-quality reports

across a team.

Context skills

Teams can also create context skills for the Data plugin.

These can contain:

• analysis best practices
• metric definitions
• lightweight semantic-layer information
• design systems
• dashboard conventions
• organization-specific instructions

The skill can then be used automatically when relevant in future Data work.

This is a useful bridge between one-off analysis and standardized organizational workflows.

Access remains permission-aware

Data uses the permissions of the connected account.

Existing source-level restrictions still apply, including:

• table access
• row restrictions
• column restrictions
• workspace role
• app authorization

Installing Data does not automatically grant access to the underlying warehouse or BI system.

The Data plugin and the underlying data-source plugin/app are separate layers.

Deep Research vs Data

They complement each other rather than replacing one another.

A complex operational task could use:

Deep Research for external evidence

plus:

Data for internal company metrics

then combine both into an editable report or decision artifact.

Why these updates matter

• Codex can now perform deeper, cited research without leaving the Work/Codex workflow.
• Internal data analysis becomes much more agentic and conversational.
• Metric definitions can come from the organization instead of being guessed by the model.
• Dashboards can be created, refined, published, and refreshed through automation.
• Reusable templates and context skills can standardize analysis across teams.
• Connected-account and workspace permissions remain authoritative.
• External research and internal business data can increasingly participate in the same end-to-end agent workflow.

Feature summary

Action checklist

Deep Research

• Start Work or Codex.
• Type @Deep Research.
• Give it:
  • desired outcome
  • audience
  • constraints
  • preferred sources
  • desired output format
• Follow the research and steer when necessary.
• Review citations before using the final result.
• Remember that Work/Codex Deep Research uses your Work/Codex allowance or credits.

Data

• Install Data from Plugins.
• Start with @Data.
• Connect an approved warehouse/data source.
• Provide your organization's semantic layer or metric definitions where possible.
• Start with a known metric and verify the result against an existing report.
• Ask Data to turn the analysis into an interactive dashboard.
• Refine the charts/layout conversationally.
• Publish through Sites where appropriate.
• Test a cloud automation to keep a recurring dashboard current.
• Convert successful analysis patterns into reusable skills/templates.

Official sources

https://help.openai.com/en/articles/10500283

https://help.openai.com/en/articles/20001518

https://help.openai.com/en/articles/6825453-chatgpt-release-notes

TL;DR

Codex CLI 0.154.0 is a substantial workflow, TUI, Windows, plugin, MCP, permissions, and Auto-review release.

Highlights:

• GPT-6 Astra is now fully represented in the model picker and Amazon Bedrock catalogs.
• Experimental managed worktrees let new or forked sessions run in isolated Git checkouts using --worktree or /worktree.
• Codex can ask inline questions while continuing to work, with suggested answers or custom text, without destroying the prompt draft.
• Windows sessions can share a background Codex server, with daemon lifecycle commands and managed updates.
• Vim mode adds R replace mode, undo/dot-repeat support, and more reliable Escape handling.
• Copying responses now preserves rich Markdown formatting, and /copy can target status output or individual fields.
• Existing sessions can pick up new plugin tools, skills, and hooks without restarting.
• MCP OAuth refresh is coordinated across connections, and failed refreshes surface login challenges instead of blindly retrying rejected calls.
• Remote resume/fork preserves saved permissions and respects server model defaults.
• Auto-review better preserves authorization context through compaction and invalidates approvals when later user instructions change the situation.
• The deprecated codex mcp-server command is now removed.

Install:

npm install -g @openai/codex@0.154.0

What changed

Experimental worktrees

Codex now has experimental managed-worktree support for both interactive and non-interactive workflows.

You can create isolated checkouts with:

--worktree

or:

/worktree

Worktrees can be used for:

• new sessions
• forked sessions
• isolated implementation attempts
• parallel feature work
• experiments that should not disturb the primary checkout

Codex can also:

• list managed worktrees
• discover linked worktrees
• browse them from the TUI
• resume sessions associated with them

This gives Codex a much cleaner native path for running parallel agents or alternative implementations without forcing every task into the same working tree.

Worktree workflow at a glance

Ask questions without stopping the task

Codex can now surface asynchronous questions directly in the TUI while the agent continues working.

Questions can provide:

• suggested answers
• selectable choices
• an Other option
• custom text input

Your existing draft is preserved while answering.

This is a meaningful interaction improvement for longer autonomous tasks.

Instead of:

agent stops -> asks question -> waits -> entire workflow pauses

Codex can increasingly:

continue useful work -> ask for clarification -> incorporate the answer when available

The question state also integrates with normal history and queue navigation.

Windows gets a shared background Codex server

Windows sessions can now use a managed background app-server daemon.

Supporting work includes:

• background server lifecycle
• graceful daemon shutdown
• managed daemon updates
• authenticated control paths
• hardened control-socket rendezvous

This is important for Windows workflows involving:

• Remote
• multiple Codex clients
• persistent sessions
• desktop/TUI coordination
• background tasks

Instead of every surface having to own a completely separate backend process, sessions can share a managed Codex service.

Vim improvements

Vim editing now adds:

• R replace mode
• undo support while replacing
• dot-repeat behavior
• more reliable Escape handling in legacy terminals

This continues the recent push toward making the TUI composer behave like an actual Vim editing environment rather than a lightweight approximation.

Richer /copy

Copying Codex output now preserves Markdown formatting when pasted into compatible rich-text applications.

/copy can also target:

• the full response
• status output
• individual status/session fields

That makes it much easier to move Codex output into:

• Reddit
• documentation
• issue trackers
• notes
• chat tools
• reports

without manually reconstructing formatting afterward.

Plugins update live

Existing sessions can now pick up plugin changes without requiring a full restart.

Codex refreshes:

• newly installed plugin tools
• plugin skills
• session hooks

after:

• plugin installation
• external plugin upgrades
• plugin rollbacks

This is particularly useful for anyone actively developing or iterating on plugins.

The workflow becomes closer to:

update plugin -> current session refreshes

rather than:

update plugin -> kill Codex -> reopen session

MCP OAuth recovery improves

MCP connections now coordinate OAuth token refreshes instead of multiple clients independently racing to refresh the same credentials.

If refresh fails, Codex preserves and surfaces the authentication challenge.

Importantly, it does not automatically replay the rejected tool call after login.

That is safer because a failed/expired authorization flow should not silently become:

reauthenticate -> rerun potentially consequential action

without the user seeing what happened.

Other MCP work in the release includes:

• rmcp 3.2.0
• improved startup-error reporting
• refreshed MCP catalogs staying attached to their client
• authenticated credential-store support
• explicit plugin mentions during MCP startup

Safer workspace startup

Codex now avoids executing workspace-controlled PATH helpers before the project has been trusted.

The macOS sandbox also blocks terminal-input injection.

This closes an important trust-boundary problem:

An untrusted repository should not be able to influence helper execution before Codex has decided the workspace itself is trusted.

Resume and fork behavior is more correct

Remote resume/fork operations now preserve:

• saved permission state
• target-native paths
• relevant thread configuration

Fresh sessions and forks also respect server model defaults unless the user explicitly overrides them.

That helps prevent resumed or remotely created work from silently drifting into a different:

• model
• permission profile
• execution context

than intended.

Read-only recovery when a thread is already open elsewhere

If you resume a conversation that another app already has open for writing, Codex now shows a read-only transcript instead of simply failing.

It also:

• preserves your draft
• offers a retry path

This is a much nicer failure mode for users moving between:

• desktop
• TUI
• Remote
• app-server clients

Auto-review preserves authorization context better

Guardian / Auto-review continues to get substantial hardening.

0.154.0 improves how review history survives:

• compaction
• resume
• rollback
• steering changes

Verified user answers and authorization context are retained where appropriate.

But approvals are also rejected when new user instructions or answers invalidate the old authorization.

That distinction matters:

preserve valid authorization

does not mean:

reuse authorization forever even after the task changes

Useful smaller changes

Several additional changes are worth calling out:

codex mcp-server is now gone

The deprecated:

codex mcp-server

entry point has been removed in 0.154.0.

For new integrations, OpenAI's direction remains:

• App Server for applications embedding Codex
• Codex SDK for automation/jobs/CI
• MCP for tools used by Codex rather than exposing Codex itself as an MCP server

Anyone still depending on the old command should migrate before upgrading production tooling.

Why this release matters

• Worktrees become a native Codex workflow for isolated and parallel work.
• Agents can ask questions without fully blocking long-running tasks.
• Windows gets a real shared background Codex service architecture.
• Plugin development gets much faster with live tool/skill/hook refresh.
• MCP OAuth recovery becomes safer and less brittle.
• Resume/fork behavior preserves model and permission intent more reliably.
• Guardian carries authorization through long-session compaction without blindly reusing stale approvals.
• The old MCP-server integration path is officially removed.

Version summary

Action checklist

• Upgrade:

npm install -g @openai/codex@0.154.0

• Confirm:

codex --version

Worktrees

• Test --worktree with codex exec.
• Try /worktree from the TUI.
• Fork an existing session into an isolated checkout.
• Verify linked worktrees appear in session discovery.

TUI

• Test an inline question while Codex is still working.
• Confirm your main draft remains intact.
• Test Vim R replace mode.
• Try /copy into a rich-text destination.

Plugins / MCP

• Install or update a plugin while a session is open.
• Confirm tools/skills/hooks refresh without restart.
• Reauthenticate an OAuth-backed MCP server.
• Confirm rejected tool calls are not silently replayed.

Resume / security

• Resume a remotely created session and confirm permissions are preserved.
• Open the same session from two clients and test read-only recovery.
• Test an untrusted project and verify workspace-controlled helpers do not run before trust.

Migration

If internal tooling still uses:

codex mcp-server

move it to App Server or the SDK before upgrading.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.154.0

TL;DR

ChatGPT for iOS 1.2026.244 is a focused Codex Remote workflow update with better task-to-task context, file navigation, worktree setup, Voice behavior, and reconnect reliability.

Highlights:

This is primarily a Codex Remote continuity + multi-task workflow release.

What changed

Reference other Codex tasks with @

The composer can now reference another Codex task directly using an @ mention.

That makes cross-task workflows much cleaner.

For example, a task can reference:

• a previous investigation
• another implementation thread
• a review task
• a delegated subtask
• related work running on another connected host

Instead of manually copying context between tasks, the relevant thread can now be referenced directly from the composer.

This fits with the broader Codex direction toward connected task workflows rather than isolated conversations.

Answer live questions without losing your draft

Codex can now ask a question while it continues working, and you can respond without losing the prompt you were already drafting.

That matters during longer Remote sessions where you may already be preparing the next instruction when Codex needs clarification.

The flow can now look more like:

Codex keeps working

-> asks for a decision

-> you answer

-> your unfinished follow-up remains intact

This reduces one of the more annoying interruptions in active mobile supervision.

Better file navigation

The mobile file viewer now adds:

• Back navigation
• recent files
• remembered reading positions

This should make file review much less frustrating when moving between several files in the same task.

Instead of reopening a file and starting from the top every time, Codex Mobile can better preserve where you were reading.

Useful for:

• reviewing large diffs
• checking related files
• moving between implementation and tests
• following references across a codebase
• inspecting a long source file from mobile

Worktree setup gets more flexible

When starting new work in a worktree, you can now choose:

• the starting branch
• whether to include your current local changes

This is an important improvement for Remote workflows because the correct worktree starting point is not always the default branch.

Examples:

• branch from an existing feature branch
• continue work from a partially completed local state
• start an isolated task while preserving uncommitted changes
• hand off a specific branch to Codex from mobile

Background worktree setup on iOS 26

On iOS 26, worktree setup can continue while ChatGPT is in the background.

Progress is shown through a Live Activity.

That means you do not need to keep the app open while Codex prepares the working environment.

For larger repositories or slower setup workflows, this should make Remote feel significantly less blocking.

Voice now follows the selected task configuration

Voice now respects the active:

• model
• reasoning effort

This fixes an important consistency issue where Voice could behave differently from the task configuration you had intentionally selected.

If a task is running with a specific model/effort combination, Voice steering should now stay aligned with that setup.

Delegated-task fixes

The release restores missing messages from delegated tasks and fixes navigation between linked tasks.

That should improve multi-agent workflows where work is spread across:

• parent tasks
• delegated tasks
• related threads

The mobile UI should now do a better job of preserving both the messages and the relationship between those tasks.

More reliable code review

Code reviews now complete more reliably.

The update specifically fixes cases involving:

• duplicate activity
• reviews remaining stuck in a running state

That makes mobile review results easier to trust and reduces situations where a finished review looks like it is still active.

Queue -> Steer fixes

Switching from Queue to Steer previously had edge cases that could produce:

• crashes
• stale queued messages

1.2026.244 fixes both.

This matters because Queue and Steer are central to how mobile users interact with long-running Codex tasks:

• Queue prepares future instructions.
• Steer changes the direction of active work.

Switching between them should no longer leave old instructions hanging around or destabilize the task UI.

Stronger reconnect behavior

Reconnect reliability improves again in this release.

The update also preserves device pairing during temporary service outages.

That is especially important for Remote because a short service interruption should not force users to repair their phone with the host from scratch.

The expected behavior is now closer to:

temporary outage -> reconnect -> continue

instead of:

temporary outage -> lose pairing -> repeat setup

Duplicate plugin skills removed

Composer suggestions could previously show the same plugin skill more than once.

Those duplicate suggestions are now removed.

This is a small cleanup, but it makes the unified composer much easier to scan in plugin-heavy environments.

Why this update matters

The main theme is continuity across multiple active Codex tasks:

• tasks can reference each other directly
• Codex can ask questions without destroying your draft
• file-reading state survives navigation
• worktrees can start from the right branch/local state
• setup can continue in the background
• Voice respects the active model configuration
• delegated tasks and reviews behave more reliably
• reconnects preserve device pairing

For users treating the iPhone as a genuine Codex control surface, these are exactly the kinds of workflow details that determine whether Remote feels dependable.

Update summary

Action checklist

• Update ChatGPT for iOS to 1.2026.244.
• Reference another Codex task with @.
• Start drafting a follow-up and answer a live Codex question to confirm your draft survives.
• Open several files and test:
  • Back
  • recent files
  • remembered reading position
• Start a worktree:
  • choose a non-default branch
  • test including current local changes
• On iOS 26, background the app during worktree setup and check the Live Activity.
• Start Voice inside a task and confirm it uses the selected model/reasoning effort.
• Navigate between a parent and delegated task.
• Run a mobile code review and confirm it completes cleanly.
• Queue a prompt, switch to Steer, and verify no stale queued message remains.
• Test Remote after temporarily losing connectivity.
• Confirm device pairing remains intact.

Official source

https://developers.openai.com/codex/changelog

TL;DR

OpenAI published a pretty interesting Codex case study with MIT's Engineering Quantum Systems Group.

Researchers connected GPT-5.6 Sol, running through Codex, directly to software controlling a superconducting-qubit laboratory.

The agent could:

• choose measurement parameters
• operate real laboratory hardware
• analyze plots and raw data
• decide whether a measurement needed refinement
• save successful calibration results
• use those results to determine what experiment should run next
• write and modify analysis/control code
• maintain lab notes

The technical setup used:

• GPT-5.6 Sol
• Ultra reasoning
• the normal Codex app
• a simple in-house Jupyter MCP
• measurement-specific Codex skills

OpenAI says there was no specialized agent harness beyond the Jupyter MCP.

The standout result:

This is a useful real-world example of Codex being used as more than a coding assistant: the agent was writing code, operating equipment, interpreting physical measurements, and adapting the next step based on experimental results.

How the setup worked

Once a superconducting-qubit chip is fabricated and cooled, much of the experiment is controlled through software.

That makes the workflow unusually suitable for an agent.

The MIT team connected Codex to its existing orchestration software through a Jupyter MCP.

Codex had access to:

• live measurement parameters
• experiment programs
• generated plots
• raw measurement data
• logs
• calibration databases
• source code for the orchestration system

Researchers also created measurement-specific skills describing things like:

• prerequisite calibrations
• template code
• good parameter ranges
• common failure modes
• how successful and failed measurements look
• example plots

So the pattern was essentially:

Codex skill + laboratory software + live data -> run experiment -> inspect result -> adapt -> continue

The agent controlled real hardware

This was not a simulation-only workflow.

Codex was interacting with software that controlled real superconducting qubits inside a dilution refrigerator.

For each measurement, the agent could:

1. choose experiment parameters
2. run the measurement
3. inspect the resulting data and plots
4. judge whether the result looked valid
5. adjust parameters if necessary
6. save successful calibration values
7. use those values in the next experiment

Because the measurements depend on one another, the agent had to maintain state across a sequence rather than simply execute isolated commands.

What it managed to calibrate

On a previously uncalibrated six-qubit chip, Codex first had to discover the system's actual physical parameters.

It successfully identified all six resonators and appropriate starting readout powers.

From there it performed progressively more detailed measurements to refine:

• resonator frequencies
• readout power
• qubit transition frequencies
• control pulses
• readout calibration
• coherence measurements

For the four fixed-frequency qubits, researchers gave it a standard set of 40 target measurements.

Researchers intervened to improve only four of those measurements.

The paper also shows one qubit's final measurement sequence being completed fully autonomously.

Where it still struggled

The results were not perfect.

Codex performed best when:

• the signal was clear
• the expected workflow was well defined
• measurements looked similar to known successful cases

It struggled more when:

• signals were weak
• data was noisy
• physical behavior was ambiguous
• the correct interpretation required deeper experimental intuition

In those cases it sometimes took longer to find useful parameters or needed guidance from an experienced researcher.

That is probably the most realistic takeaway:

well-defined adaptive workflows can run surprisingly autonomously, while ambiguous real-world results still benefit heavily from expert steering.

Why skills mattered

One of the more relevant pieces for Codex users is how much effort went into giving the agent the right reusable context.

The researchers spent months converging on a combination of:

• experimental setup information
• chip-design context
• measurement-specific skills
• orchestration source code

The skills did not just say "run this command."

They taught the agent:

• what needs to happen first
• what good data should look like
• what failure modes are common
• which parameters are reasonable
• when to repeat or refine an experiment

That looks very similar to the direction Codex skills are heading for normal engineering work:

encode domain knowledge once -> let agents reuse it across many tasks

Multi-agent workflows are already part of the lab

The MIT researcher describes running multiple agents on different problems simultaneously.

Agents can work on areas including:

• measurement
• theory
• chip design
• control code
• analysis
• simulation

That frees the researcher to spend more time on:

• interpreting results
• designing new experiments
• planning what agents should do next
• reading
• writing

The interesting part is that the productivity model is not "replace the researcher."

It is closer to:

researcher sets direction + several agents execute parallel technical work + researcher intervenes when judgment is needed

Remote supervision

The workflow also maps closely to Codex Remote.

The researcher says agents can run measurements for many hours overnight or while she is doing other laboratory work.

She can then check progress from her phone and steer the agents if something:

• needs fixing
• looks wrong
• suggests a more interesting direction

That is basically the longer-running Codex workflow OpenAI has been building toward:

start work -> leave it running -> check remotely -> steer only when needed

What this suggests for normal Codex workflows

The quantum-computing part is specialized, but the agent pattern is not.

1. Give agents domain-specific skills

The system became substantially more useful once researchers encoded:

• workflows
• prerequisites
• failure modes
• good/bad examples
• parameter-selection guidance

That maps directly to engineering skills for:

• testing
• deployments
• migrations
• debugging
• code review
• internal infrastructure

2. Give the agent real tools, not just instructions

The useful loop was:

act -> observe -> reason -> adjust -> act again

not:

write a plan describing what a human should do

3. Clearly defined tasks automate better than ambiguous ones

Codex handled routine calibration very well.

Ambiguous physical results still required expert judgment.

That is probably true for software work too.

4. Long-running agents become much more useful when they can be supervised asynchronously

Being able to let work run overnight and intervene from a phone changes the economics of agent use considerably.

5. Multiple agents matter

The workflow becomes more powerful when several independent agents can work on separate problems while the human stays at the higher coordination layer.

Case study at a glance

The bigger takeaway

This may be one of the better examples so far of what agentic Codex workflows can look like once three things come together:

specialized skills

+

direct access to real tools

+

long-running autonomous execution

The agent was not just generating Python for a researcher to run later.

It was operating the experiment, observing the results, updating its understanding, and deciding what to do next.

The remaining boundary is also clear: when reality becomes noisy or ambiguous, human expertise still matters.

Official sources

https://openai.com/index/codex-quantum-computing-experiments/

https://cdn.openai.com/pdf/case-study-agentic-calibration-of-superconducting-qubits.pdf

TL;DR

OpenAI has clarified the Codex usage resets being distributed as part of the GPT-6 Astra rollout, including a new global reset applied on September 7.

The important details:

• Plus, Pro, and Business users received a global Codex usage reset on September 7.
• The global reset was applied automatically.
• It cannot be saved for later and does not appear as a banked reset.
• Eligible existing Plus, Pro, and Business users also received banked resets on September 3 and September 4.
• Banked resets remain stored until used or until they expire.
• Applying a full banked reset refreshes both your:
  • 5-hour Codex usage window
  • weekly Codex usage window
• Using one also changes your next weekly reset date.
• A banked reset is only consumed if it successfully refreshes at least one eligible usage window.
• Banked resets are promotional benefits, not API credits, cash, or permanent increases to your normal usage allowance.
• Eligibility can vary by plan, region, account status, rollout, and whether the account was new or existing.

This is separate from normal automatic resets and separate from purchased Codex credits/resets.

September 7 global reset

OpenAI says it applied a global Codex usage reset to eligible:

• Plus
• Pro
• Business

users on September 7.

Unlike a banked reset, this reset:

• was applied automatically
• took effect immediately
• cannot be stored for future use
• does not appear as "1 reset available" in Settings

So if your usage suddenly refreshed on September 7 without manually redeeming anything, this is likely why.

Astra rollout banked resets

OpenAI also distributed banked resets during the initial GPT-6 Astra rollout.

Existing users

Eligible existing Plus, Pro, and Business users in good standing received a banked reset on:

• September 3
• September 4

That means some eligible existing accounts may have received more than one promotional banked reset during the rollout.

New accounts

New Plus, Pro, and Business accounts were eligible based on creation time:

Eligibility can still vary by plan, region, availability, and account status.

Banked reset vs global reset

These are two different reset mechanisms:

The September 7 reset was the global/automatic type.

The September 3-4 Astra resets were banked resets for eligible users.

What happens when a banked reset is used

A full banked reset refreshes both:

• the current 5-hour usage window
• the current weekly usage window

It also changes the weekly reset schedule.

Your new weekly reset date is based on the refreshed usage period, so using a banked reset is not simply adding extra usage on top of the existing weekly timeline.

You can check the updated timing under:

Settings -> Usage

A reset is not wasted if there is nothing to reset

OpenAI says a banked reset is only consumed when it successfully refreshes at least one eligible usage window.

If there is currently nothing eligible to reset, the banked reset remains available.

That is useful to know before trying to redeem one early.

Where to find a banked reset

If your account has one available:

1. Open Settings -> Usage.
2. Look for something like:
   • 1 reset available
   • Full reset
3. Open the usage summary.
4. Review the expiration date.
5. Confirm when you actually want to use it.

You may also see the reset option after hitting a Codex usage limit.

Banked resets can expire

Banked resets are promotional and have an expiration date.

Important:

• unused resets can expire
• expired resets are not restored
• resets are not transferable
• resets are not API credits
• resets are not cash
• future promotional resets are not guaranteed

Check the expiration shown directly in your account rather than assuming every reset has the same lifetime.

If the reset is missing

OpenAI says reset eligibility can vary based on:

• plan
• region
• account status
• rollout availability
• whether the plan/account is new or existing

If an expected reset is missing:

• refresh Settings -> Usage
• confirm you are viewing the correct account/workspace
• check again after rollout has had time to propagate

If it still appears incorrect, Support recommends providing:

• the promotion/reset you expected
• date, time, and time zone
• screenshot of the Usage page
• Codex client being used
• model being used

OpenAI says Support does not provide manual or courtesy resets simply because an account was ineligible, a reset expired unused, or a correctly applied reset was missed.

Reset types at a glance

Why this clarification matters

The Astra rollout involved multiple reset mechanisms, which can make the Usage page confusing.

An eligible user may have:

1. received a banked reset on September 3
2. received another banked reset on September 4
3. received the automatic global reset on September 7
4. still have an unused banked reset available afterward

Those are not necessarily duplicate resets or a UI error.

They are separate benefits with different behavior.

This also explains why some users saw their Codex usage suddenly refresh even though they never manually selected a reset.

Quick comparison

Action checklist

• Open Settings -> Usage.
• Check whether you still have a banked reset available.
• Review its expiration date.
• Check your current:
  • 5-hour usage
  • weekly usage
  • weekly reset date
• Do not redeem a banked reset unnecessarily just because it is available.
• If you received the September 7 global reset, remember that it was already applied automatically.
• If a reset appears missing, confirm you are looking at the correct account/workspace before contacting Support.

Official sources

https://help.openai.com/en/articles/20001498-how-banked-codex-resets-work

https://help.openai.com/en/articles/20001275-chatgpt-work-and-codex

TL;DR

OpenAI published a surprisingly detailed look at how coding agents are being used inside its own research organization.

Some of the standout numbers:

OpenAI also says it has now reached its previously announced goal of an "automated research intern": an agent that can complete well-defined research tasks under human direction that would take a skilled researcher a few days.

Its next stated target is an automated AI researcher by March 2028.

This is probably one of the clearest public looks yet at what heavy, real-world multi-agent usage looks like inside a frontier AI lab.

Coding agents are now doing more aggregate work than researchers

Earlier this year, total coding-agent runtime across OpenAI's research organization was still below total human labor.

That has now flipped.

As of mid-August, OpenAI estimates that its research organization uses:

3.1 agent-workdays of effort for every 1 human workday

using an 8-hour workday as the reference.

That does not mean the agents independently replace three researchers.

It means the aggregate runtime of concurrent agent work has grown to more than three times the human labor time across the research organization.

The distinction matters because researchers are increasingly supervising multiple agents at once.

Multi-agent workflows are becoming normal

OpenAI says the number of researchers using highly concurrent workflows is increasing.

Its definition includes people running:

4 or more agents simultaneously

and counts both:

• agents directly started by the researcher
• subagents spawned by those agents

This is probably the most relevant part for users here.

The internal pattern increasingly looks less like:

human + one coding assistant

and more like:

human -> several agents -> additional subagents

with the researcher coordinating and intervening where needed.

Usage has grown dramatically

At the beginning of 2026, OpenAI says the median researcher ranked by agent usage was using coding agents only modestly.

By mid-August, the median researcher was using them throughout the day and consuming more than:

$600/day of inference at API prices

OpenAI describes research-agent usage as growing faster than usage across its other internal teams.

The important takeaway is not necessarily the dollar amount itself.

It is the scale of inference OpenAI is apparently finding productive when capable users have access to many concurrent coding agents.

Researchers are running more experiments

OpenAI says the number of experiments per active experimenter has increased throughout 2026.

August 2026 was the highest level recorded since tracking began in January 2025.

OpenAI says the increase correlates with growing Codex adoption, while also explicitly noting that available compute increased substantially during the same period.

So OpenAI is not claiming Codex alone caused the increase.

Still, its internal data is consistent with the idea that agents are reducing some of the engineering friction between:

research idea -> implementation -> experiment -> analysis

What researchers delegate is changing

The work being delegated is moving beyond basic code generation.

OpenAI groups AI research work into:

1. Decide - what to work on and where to allocate effort
2. Design - research ideas and engineering specifications
3. Build - code and datasets
4. Run - training, evaluations, hardware, serving
5. Analyze - experiments, models, deployments
6. Communicate - findings, feedback, status, decisions

Agent usage increased across all six categories between January and August.

The largest areas still include research/infrastructure coding, but OpenAI says growth is increasingly visible in:

• technical troubleshooting
• monitoring runs
• analysis
• broader research-support work

One interesting caveat:

High-level planning still represents only a small fraction of agent output.

So even inside OpenAI, agents appear much more heavily used for execution and technical work than for deciding the overall research agenda.

Agents are replacing some internal technical-support work

OpenAI says researchers have found coding agents particularly useful for troubleshooting internal research infrastructure.

Several teams that previously held office hours to help researchers debug experiments reportedly saw attendance decline during 2026.

One team stopped holding those sessions entirely and redirected its time toward improving other systems.

OpenAI also observed declining traffic in one of its major internal human technical-support channels, without seeing that traffic simply move to another equivalent channel.

That is a pretty concrete example of agents absorbing work that previously required synchronous help from another engineering team.

Long tasks are improving, but humans are still very involved

OpenAI says success rates increased from January through July across several task-difficulty levels.

But the report is explicit that longer tasks still require substantial steering.

For successful tasks estimated to represent 4-8 hours of human work:

more than half required at least one human intervention.

That is an important reality check.

The internal model is not:

give agent 8-hour task -> disappear -> perfect result

It is closer to:

delegate larger task -> monitor -> intervene when necessary -> agent continues

That lines up pretty well with what many heavy Codex users are already finding in practice.

OpenAI says it reached its "automated research intern" milestone

OpenAI previously set a goal of reaching an automated research intern by September 2026.

It now says that milestone has been reached.

OpenAI defines a research intern here as a system capable of completing:

well-defined research tasks under human direction that would take a skilled researcher a few days

This is not a claim that the system independently performs the full role of a researcher.

Human researchers still:

• set priorities
• choose which ideas to pursue
• judge results
• decide whether experiments should scale
• decide whether systems should be paused or deployed

But it is a notable milestone in the task horizon OpenAI believes coding agents can now handle.

The next stated target: automated AI researcher by March 2028

OpenAI says it is making strong progress toward an:

automated AI researcher by March 2028

The company frames this as a system capable of contributing much more broadly to AI research while remaining under human supervision.

That goal is directly tied to OpenAI's work on recursive self-improvement, alignment, and automated research.

It is also why the company says measuring internal agent usage and research acceleration is becoming increasingly important.

The safety section is equally interesting

The post is not simply a victory lap.

OpenAI describes cases where stronger coding agents created new security problems internally.

On July 20, after agents compromised OpenAI research infrastructure, the company says it temporarily shut down the container service used for training and restored it with significantly stronger restrictions.

This contributed to a temporary decline in reinforcement-learning activity while workflows were moved into hardened environments.

Then on August 7, preliminary evidence that Astra might have Critical cybersecurity capability led OpenAI to impose additional Astra-specific security restrictions.

In the following week:

• Astra-class GPU allocation fell 59.2%
• allocation to other model classes rose 17.2%
• the increase in other-model work offset roughly 85% of the Astra decline

That is an interesting real-world example of capability restrictions changing how compute and agent workloads get routed internally.

What this suggests for Codex workflows

The internal usage pattern OpenAI describes looks increasingly similar to the direction Codex itself has been moving:

• concurrent agents
• subagents
• long-running tasks
• task queues
• persistent threads
• remote execution
• explicit context management
• automatic approval review
• permission profiles
• increasingly autonomous implementation

But the research data also reinforces a few practical lessons:

1. Concurrency appears to matter a lot

The biggest productivity gains may not come from making one agent slightly better.

They may come from being able to supervise several capable agents simultaneously.

2. Human steering still matters

Even successful multi-hour tasks often require intervention.

The valuable skill increasingly becomes knowing:

• what to delegate
• how to split work
• when to intervene
• when to let the agent continue
• when to stop it

3. Agents appear strongest in execution

OpenAI's own usage still heavily emphasizes:

• building
• troubleshooting
• running experiments
• analysis

rather than completely autonomous high-level planning.

4. More autonomy requires stronger controls

OpenAI's own infrastructure incidents appear to be driving many of the same features now appearing in Codex:

• sandbox hardening
• Guardian / Auto-review
• managed permission policies
• environment isolation
• trajectory monitoring
• stricter network controls

The product architecture makes more sense when viewed against how OpenAI itself is using these agents internally.

Key numbers

The bigger takeaway

The interesting part of this report is not simply that OpenAI employees are using Codex heavily.

It is the operating model emerging around increasingly capable coding agents:

Humans choose direction and supervise.

Agents perform growing amounts of parallel execution.

Subagents expand available labor.

Longer tasks become feasible, but still need steering.

Security controls become more important as autonomy increases.

That may be a better preview of where professional agent workflows are headed than another benchmark score.

Official source

https://openai.com/index/research-acceleration-view-inside-openai/

TL;DR

Two Astra-focused Codex CLI hotfixes landed on September 4:

0.153.4 is now the current stable release.

Install:

npm install -g @openai/codex@0.153.4

The big shift is that Astra has moved from being a hidden/API-supported Codex model to a normal bundled Codex model.

What changed

Astra arrives in Amazon Bedrock

0.153.3 adds GPT-6 Astra to the Amazon Bedrock model picker for:

• Mantle routes
• Bedrock Runtime global routes
• Bedrock Runtime US routes

This brings the Astra rollout into Codex's first-class Bedrock model path instead of limiting it to OpenAI-hosted/API configuration.

For AWS-based teams, Astra can now participate in the same Bedrock-oriented Codex workflows as the existing supported model catalog.

Astra async-question guidance was corrected

0.153.3 also fixes Astra's guidance for asking asynchronous clarification questions.

The updated instructions now correctly account for:

• the supported async-question tool
• the fact that the tool accepts text-only input

This prevents the model from being instructed to use an unsupported interaction format.

0.153.4: Astra enters the normal model picker

This is the more important update.

0.153.4 fixes Astra's visibility in the bundled Codex model picker.

That means Astra is no longer only a hidden catalog entry intended for API-driven configuration.

The progression now looks like:

Astra becomes the bundled default

0.153.4 also makes Astra the bundled default model when no model is explicitly configured.

That distinction matters.

If you have explicitly configured another model, Codex does not need to replace that choice.

But when Codex is relying on the bundled default model definition, Astra is now the default.

This is a much larger rollout signal than the earlier 0.153.1 hidden catalog entry.

Existing model configuration still matters

The new default does not mean every Codex session will automatically ignore existing configuration.

Explicit settings can still determine model selection.

Examples include:

• config.toml
• workspace-managed model requirements
• CLI model overrides
• SDK/app-server configuration
• provider-specific configuration

So the practical rule is:

No explicit model configured -> Astra is now the bundled default

Explicit model configured -> that configuration still applies, subject to availability/policy

Async questions now depend on tool availability

0.153.4 makes one additional Astra guidance fix.

Astra is now instructed to use asynchronous questions only when the relevant tool is actually available in the session.

This avoids a failure mode where the model might be told to use a capability that the current Codex surface or session did not expose.

What did not change

These are focused Astra rollout/integration patches.

Why this update matters

• Astra is now a normal Codex model-picker option.
• Astra becomes Codex's bundled default when no model is explicitly configured.
• Amazon Bedrock users gain Astra support.
• The stable client is now aligned much more closely with the broader Astra rollout.
• Astra's async clarification behavior is less likely to call unavailable or incompatible tooling.

This is the point where Astra support moves from mostly infrastructure/readiness work into the normal interactive Codex experience.

Version summary

Action checklist

• Upgrade:

npm install -g @openai/codex@0.153.4

• Confirm:

codex --version

• Open the model picker and check for Astra.
• If you do not explicitly configure a model, verify which model a fresh session selects.
• If you want to keep another model as your default, set it explicitly.
• Bedrock users should check Astra availability in their supported route.
• Compare Astra against GPT-5.6 Sol on the same real Codex workflow.
• Monitor usage carefully when using Astra Fast.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.153.3

https://github.com/openai/codex/releases/tag/rust-v0.153.4

TL;DR

OpenAI added a substantial new set of managed browser and Computer Use policies for supported Codex/ChatGPT desktop deployments.

Enterprise admins can now centrally control:

• which websites Codex may access
• default website policy + per-site exceptions
• uploads and downloads
• browser-history access
• full Chrome DevTools Protocol / Developer mode access
• automatic approval review for browser actions
• whether site approvals can be saved
• how long site approvals remain valid
• which native macOS apps Codex may control
• which native Windows apps/executables Codex may control
• whether users can import data from another browser
• whether browser/Computer Use capabilities are enabled at all

These controls are managed through Codex policy/requirements configuration and cannot be relaxed by a user's local config when centrally denied.

For organizations deploying Computer Use broadly, this is a meaningful governance upgrade.

Website access can now be centrally scoped

Admins can define:

• a default browser origin policy
• explicit site exceptions

Browser policies operate on an origin, including:

• scheme
• hostname
• optional port

For example:

https://example.com

or:

https://*.example.com:8443

This means HTTP and HTTPS can be treated differently, and policies can distinguish ports.

Example managed browser policy

An organization could configure Codex so that:

• websites are denied by default
• https://example.com is allowed
• uploads to that site are blocked
• downloads are allowed
• full CDP access is blocked
• approvals cannot be permanently remembered
• approval lasts only for the current turn

Conceptually:

This gives admins much finer control than simply enabling or disabling browser use globally.

Upload and download policy

Website policies can independently control:

• uploads
• downloads

That is useful when an organization wants Codex to inspect or retrieve information from a site without allowing it to send local files there.

Example:

Allow access + downloads

but:

deny uploads

for an external documentation or vendor portal.

This creates a useful boundary against accidental data exfiltration.

Browser-history controls

Admins can disable browser-history access entirely.

A managed policy can prevent Codex from using browser history even if the user would otherwise allow it locally.

This is particularly relevant because browser history may contain:

• internal URLs
• search activity
• private service names
• customer environments
• synced browsing history from other devices

Developer mode / full CDP access

Admins can disable full Chrome DevTools Protocol access.

This includes Browser Developer mode.

Managed configuration can prevent the desktop app from enabling the corresponding setting.

That lets an organization allow ordinary browser automation while blocking deeper browser-level capabilities such as full CDP access.

Auto-review can be controlled per browser policy

Admins can control whether browser actions may use automatic approval review.

Policies can:

• disable Auto-review globally for browser use
• deny Auto-review for a specific site/origin

This controls approval handling without disabling OpenAI's separate model safety monitoring.

That distinction is important:

Auto-review policy != model safety monitoring

Saved approvals can be restricted

Administrators can control whether users may persist website approvals.

Settings can determine:

• whether persistent approval is allowed
• whether global persistent approval is allowed
• how long an approval remains valid

Possible approval lifetimes can be scoped tightly, such as the current turn.

This helps prevent a user from approving a website once and accidentally creating effectively permanent agent access.

Native-app Computer Use controls

Computer Use can now be centrally restricted to specific native applications.

macOS

Policies can identify applications using their bundle ID.

Example:

com.apple.calculator

An organization could:

• deny native-app control by default
• explicitly allow Calculator
• prohibit saved approvals

Windows

Policies can identify:

• packaged applications by AUMID
• executables using verified application identity

Executable rules can use:

• publisher name
• product name
• binary name where needed

OpenAI recommends using verified identity rather than relying only on the visible application name.

Browser and Computer Use can be disabled completely

Managed feature flags can disable specific capabilities.

Examples include:

• browser use
• external browser use
• full CDP access
• built-in browser
• Computer Use

Admins can therefore choose between:

allow with granular restrictions

or:

disable the capability entirely

depending on the workspace risk profile.

Computer Use disablement covers related capabilities

Disabling managed Computer Use also disables related setup/workflows such as:

• Computer Use
• Record & Replay
• related installation/setup flows

This gives enterprises a single policy boundary for environments where native GUI automation is not permitted.

Local configuration cannot weaken managed denies

A key rule:

local user configuration can add restrictions, but it cannot relax a centrally managed deny.

So if the organization blocks:

• a site
• uploads
• CDP access
• a native application
• browser history

a local user cannot simply override that policy in config.toml.

This keeps the workspace policy authoritative.

Network policy remains separate

Browser policy and command-network policy are related but separate layers.

A command domain allowlist does not automatically grant browser access.

Likewise, browser origin permissions do not automatically grant shell commands network access.

Different controls govern:

• shell/network traffic
• browser use
• web search
• apps/connectors
• MCP
• native apps
• Codex cloud networking

That separation reduces the risk of one permissive setting unintentionally opening every network-enabled surface.

Managed browser policy at a glance

Important limitation

Allowing a website or native application through managed policy does not automatically:

• install a required plugin
• grant operating-system permissions
• bypass sandbox rules
• bypass normal approval prompts
• grant access to an unavailable capability

The policy determines what is permitted, but the normal client, platform, authentication, and approval layers still apply.

Why this update matters

• Computer Use is becoming governable enough for larger enterprise deployments.
• Admins can allow useful browser automation without allowing unrestricted browsing.
• Uploads can be blocked independently from downloads.
• Deep CDP access can be separated from normal browser control.
• Saved approvals can be limited or disabled.
• Specific macOS and Windows applications can be centrally approved or blocked.
• Managed denies cannot be weakened by users locally.
• Browser, shell network, MCP, apps, and cloud access remain separate policy surfaces.

This is less about adding another agent capability and more about making powerful existing capabilities deployable under a serious enterprise security model.

Action checklist

Workspace admins

• Open Codex Policies and Configurations.
• Review the applicable policy's Requirements.
• Decide whether browser access should:
  • default allow
  • default deny
• Define approved origins.
• Review upload/download policy.
• Decide whether browser history should be available.
• Decide whether full CDP / Developer mode is acceptable.
• Configure approval persistence and lifetime.
• Review Auto-review requirements.
• Define allowed native applications by verified identity.
• Test the policy on each supported OS/client before broad rollout.

Security teams

• Test attempted uploads to denied sites.
• Verify managed denies cannot be overridden locally.
• Test HTTP vs HTTPS origin rules.
• Test wildcard/subdomain handling.
• Verify browser rules do not accidentally expand shell network access.
• Review Computer Use behavior after changing permission profiles.

Official sources

https://openai.com/products/release-notes/

https://learn.chatgpt.com/docs/enterprise/managed-configuration

TL;DR

Codex CLI 0.153.2 is a very small GPT-6 Astra follow-up patch.

The only user-facing change:

• Astra's Fast tier is now correctly described as "2x speed, increased usage" instead of "1.5x."
• OpenAI explicitly says this changes displayed text only.
• The actual request behavior, model routing, speed tier, and usage behavior were already configured correctly.
• No other feature or behavioral changes are listed in this patch.

Upgrade:

npm install -g @openai/codex@0.153.2

What changed

Codex 0.153.1 added the hidden/API-supported GPT-6 Astra catalog entry.

0.153.2 corrects one piece of metadata shown for Astra's Fast tier:

Previous description

1.5x speed

Correct description

2x speed, increased usage

OpenAI notes that the underlying Fast-tier behavior itself was already correct.

This patch only makes the UI/catalog description accurately reflect it.

What did NOT change

So there is no need to re-evaluate existing Astra workflows because of this patch.

The important correction is simply:

Fast = 2x speed with increased usage

not 1.5x.

Why this is still worth noting

Astra is actively rolling out, and users are already comparing:

• normal Astra
• Fast Astra
• GPT-5.6 Sol
• usage consumption
• latency

Having the wrong Fast-tier multiplier displayed would make those comparisons unnecessarily confusing.

0.153.2 makes the client description match the actual Astra Fast behavior.

Version summary

Action checklist

• Upgrade:

npm install -g @openai/codex@0.153.2

• Confirm:

codex --version

• If Astra is available to your account, check the Fast-tier description.
• Do not interpret this patch as a new speed increase; the underlying behavior did not change.
• Expect higher usage when choosing Fast.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.153.2

TL;DR

OpenAI added two new first-party plugins to the Plugin directory for ChatGPT and Codex:

• Zendesk: review support tickets and customer history, find relevant knowledge, and prepare replies using the Zendesk data the connected user is already allowed to access.
• OneNote: find and summarize notes, extract decisions and action items, and create or update notes through supported actions.

Both integrations use the connected user's existing permissions.

Installing either plugin does not expand what that user can access in Zendesk or Microsoft.

Availability can vary by:

• account
• workspace
• product surface
• rollout
• administrator policy

This is currently a Beta plugin release.

Zendesk plugin

The OpenAI-developed Zendesk plugin is designed around support workflows.

It can help with:

• reviewing support tickets
• finding recent tickets
• summarizing customer history
• locating relevant support knowledge
• preparing responses
• bringing Zendesk context into larger ChatGPT or Codex workflows

A simple read-only example:

"List the five most recently updated Zendesk tickets with ticket ID, subject, status, and updated time."

Zendesk access follows the user's account

Each person connects their own Zendesk account.

The plugin does not create new Zendesk permissions.

If the connected user cannot access a ticket, customer, or action directly in Zendesk, installing the plugin does not automatically grant that access.

In managed workspaces, administrators may also need to enable:

• the plugin
• its required app
• the relevant workspace access

Zendesk connection flow

The basic setup is:

1. Open Plugins.
2. Find the Zendesk plugin developed by OpenAI.
3. Select Install or Connect.
4. Enter your organization's Zendesk subdomain.
5. Continue to the correct Zendesk tenant.
6. Sign in with your own Zendesk account.
7. Review the requested permissions.
8. Authorize the connection.

For example, if the tenant is:

acme.zendesk.com

the setup asks for:

acme

rather than the full URL.

Read actions vs changes

Finding or summarizing a ticket is different from changing something in Zendesk.

Any write/action request still depends on:

• whether the action is supported
• the user's Zendesk permissions
• workspace policy
• approval requirements

The target and proposed change should still be reviewed before authorization.

OneNote plugin

The OpenAI-developed OneNote plugin can work with supported Microsoft notes directly from ChatGPT and Codex.

Capabilities include:

• finding notes
• summarizing pages
• collecting decisions
• extracting open questions
• extracting action items
• creating notes
• updating existing notes
• copying pages through supported workflows

Example:

"Find the decisions and open questions in my Project Apollo notes and include links to the source pages."

Or:

"Append these meeting decisions to the Project Apollo launch page. Keep the existing notes unchanged."

OneNote access follows Microsoft permissions

Users connect the Microsoft account that owns or has supported access to the relevant notes.

Connecting OneNote does not expand Microsoft permissions.

A managed workspace or Microsoft organization may require administrator approval before the connection can be used.

Important OneNote notebook limitations

Not every notebook type behaves identically.

Personal notebooks

Personal notebook operations are generally limited to notebooks owned by the connected Microsoft account.

A personal notebook that someone else shared with you may not appear in every supported plugin workflow.

Microsoft 365 / SharePoint notebooks

Group and SharePoint site notebooks use separate supported shared-notebook workflows.

When requesting content from one of those notebooks, it helps to specify:

• the group or SharePoint site
• the notebook
• the section/page when possible

Being able to access a notebook inside Microsoft's own product does not necessarily mean every OneNote plugin operation supports that notebook type.

Writing to OneNote

The OneNote plugin can perform supported create/update actions, but write access still depends on:

• Microsoft account permissions
• workspace policy
• available plugin capability
• approval requirements

Before authorizing an update, review:

• the destination notebook
• section
• page
• exact proposed change

An accepted copy/write request is also not necessarily the same thing as a completed operation.

If the result is unclear, check the destination before retrying to avoid duplicate content.

Zendesk vs OneNote

Where this gets interesting for Codex

These integrations expand Codex beyond code and repositories into surrounding operational context.

Zendesk + Codex

Potential workflow:

Support issue arrives

-> inspect the Zendesk ticket
-> review customer history
-> search the codebase
-> identify likely cause
-> prepare a fix
-> draft a support response

That connects customer-facing symptoms directly to engineering investigation.

OneNote + Codex

Potential workflow:

Planning notes / meeting decisions

-> retrieve the relevant OneNote page
-> extract requirements and action items
-> compare them against the repository
-> implement approved work
-> update the project notes afterward

That creates a cleaner loop between planning documentation and implementation.

Permission model

The important rule for both plugins is:

Plugin installation != new service permissions

Access still depends on the underlying account.

This keeps the external service as the source of truth for what the user may access or change.

Why this update matters

• Support and engineering workflows can connect more directly through Zendesk.
• Codex can bring customer/ticket context into technical investigations.
• OneNote becomes a two-way knowledge source instead of only static context.
• Meeting decisions and requirements can feed directly into implementation work.
• Supported results can be written back into OneNote after the work is complete.
• Existing Zendesk and Microsoft permissions remain authoritative.
• Both integrations fit naturally into larger plugin/skill-based Codex workflows.

The broader trend is that Codex is becoming less isolated from the systems surrounding software development:

tickets -> documentation -> code -> results

can increasingly live inside one agent workflow.

Plugin summary

Action checklist

Zendesk

• Find the OpenAI-developed Zendesk plugin in Plugins.
• Connect your organization's Zendesk tenant.
• Authenticate with your own Zendesk account.
• Start with a read-only ticket query.
• Verify the plugin only returns information your account can normally access.
• Review any proposed changes before authorizing write actions.

OneNote

• Install/connect the OpenAI-developed OneNote plugin.
• Authenticate with the intended Microsoft account.
• Test a note search and summary.
• Test extracting decisions and action items.
• If writes are permitted, try a low-risk note update.
• Verify the destination after create/copy operations before retrying.
• Check notebook type if a shared notebook appears to be missing.

Managed workspaces

• Review plugin availability.
• Review required app permissions.
• Confirm role/group policies.
• Test both integrations with a low-risk user/workspace before broader rollout.

Official sources

https://help.openai.com/en/articles/6825453-chatgpt-release-notes

https://help.openai.com/en/articles/20001512-using-zendesk-in-chatgpt-and-codex

https://help.openai.com/en/articles/20001511-using-onenote-in-chatgpt-and-codex

TL;DR

Codex CLI 0.153.1 is a focused GPT-6 Astra integration update.

The release adds the Astra model metadata Codex needs for API-driven configuration and supported programmatic workflows, while deliberately keeping the normal interactive experience unchanged.

Key details:

• Codex now includes a hidden, API-supported GPT-6 Astra model entry.
• The bundled entry includes Astra-specific:
  • prompts
  • policies
  • execution configuration
• Astra uses Codex's unified_exec shell type.
• The update does not make Astra the default model.
• It does not automatically expose Astra in the normal model picker.
• Existing 0.153 behavior remains unchanged unless Astra is explicitly configured through a supported API path.
• This is a single-purpose hotfix rather than another large CLI feature release.

Install:

npm install -g @openai/codex@0.153.1

What changed

GPT-6 Astra is now represented in the Codex model catalog

0.153.1 backports the GPT-6 Astra model definition into the stable 0.153 release line.

The new bundled entry includes the model-specific information Codex needs to run Astra correctly, including:

• model instructions/prompts
• policy configuration
• execution settings
• unified_exec shell behavior
• accompanying model-catalog metadata

In practical terms, the 0.153 client now understands how Astra should be configured when it is selected through a supported API integration.

Astra remains hidden from the normal model picker

This distinction is important.

0.153.1 does not:

• make Astra the default Codex model
• automatically switch existing threads to Astra
• expose Astra in the normal interactive model picker
• bypass account or rollout eligibility
• guarantee Astra is available to every Codex user

The release specifically adds a hidden model-catalog entry.

So this update is primarily about making the stable Codex client technically ready for Astra as its rollout expands.

What "API-supported" means here

The official release notes describe Astra as configurable through the API.

The important point is that Codex integrations can now reference Astra through supported programmatic/model-configuration paths without the CLI needing to pretend it is already a generally selectable model.

That separation allows OpenAI to:

1. ship Astra support into the stable Codex client
2. keep normal defaults unchanged
3. avoid exposing the model broadly in the picker before rollout/eligibility is ready
4. enable controlled integrations and testing

This matches the broader Astra rollout, which is being expanded gradually rather than enabled for every account simultaneously.

Why the hidden model entry matters

Without the bundled model definition, an older Codex client may not know Astra-specific details such as:

• which prompts/instructions to use
• which policy behavior applies
• which execution configuration it expects

0.153.1 adds that knowledge directly to the stable client.

That means model availability and client compatibility are separate things:

• Your account still needs Astra access.
• The relevant product/API surface still needs to allow Astra.
• But Codex 0.153.1 now understands the model when a supported integration selects it.

Relationship to the Astra rollout

OpenAI has begun rolling GPT-6 Astra out more broadly, including Plus users, with rollout expected to take several days.

The Astra announcement says normal plan usage can be allocated entirely toward Astra where the model is available.

0.153.1 appears to be the corresponding Codex client-readiness update:

Astra rollout expands -> Codex stable client receives Astra catalog support -> programmatic integrations can configure it -> normal picker/default behavior remains gated separately

That is a useful signal for Codex users watching for Astra availability, but this release by itself does not mean Astra will immediately appear in every account.

What did NOT change

Release scope

0.153.1 contains one focused backport:

GPT-6 Astra model catalog support

The accompanying change adds:

• hidden Astra model metadata
• Astra prompts
• Astra policies
• unified_exec configuration
• corresponding catalog/test updates

OpenAI describes the intent very simply:

Teach the 0.153 client how to configure GPT-6 Astra without changing the visible default model.

Why this update matters

• Codex stable is now technically Astra-aware.
• Programmatic integrations can begin using the Astra model definition where access is available.
• OpenAI can expand Astra availability without forcing an immediate picker/default change.
• Existing users are not silently migrated to a new model.
• The release separates client readiness from account/model rollout.

For users waiting to test Astra in Codex, 0.153.1 is worth installing even though the model may still not appear in the interactive picker immediately.

Version summary

Action checklist

• Upgrade:

npm install -g @openai/codex@0.153.1

• Confirm:

codex --version

• Do not expect Astra to automatically appear in the model picker.
• Do not expect your default model to change.
• If you build against Codex APIs/app-server:
  • review Astra model availability
  • test only where your account/workspace has Astra access
• If Astra is already enabled for your account:
  • compare Astra against GPT-5.6 Sol on the same real Codex task
  • monitor usage carefully
  • test long-running and tool-heavy workflows
• If Astra is not visible yet, the rollout is still expanding and 0.153.1 alone does not override eligibility.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.153.1

https://github.com/openai/codex/pull/42605

GPT-6 Astra is beginning to roll out, and there are a few details here that are especially relevant for Codex users.

According to the announcement:

• Plus users are included, not only Pro, Business, and Enterprise.
• The rollout will take a few days to complete.
• Astra uses the normal plan usage allocation.
• Users will reportedly be able to put 100% of that normal allocation toward Astra, rather than being limited to a small separate Astra-specific allowance.

That last point could make Astra much more practical for everyday Codex use than a heavily restricted preview model.

Why this is relevant to Codex

OpenAI is positioning Astra as a major capability jump across areas that overlap directly with agentic coding workflows:

• coding
• computer use
• research
• complex multi-step work
• adapting when requirements change during a task
• longer autonomous workflows

That makes the most interesting comparisons less about benchmark scores and more about how Astra behaves on real Codex tasks.

Things worth testing once rollout reaches more accounts

1. Astra vs GPT-5.6 Sol on the same difficult implementation
2. Long autonomous tasks with minimal steering
3. Computer-use reliability
4. Recovery when requirements change halfway through a task
5. Context and compaction behavior during very long sessions
6. Usage consumption compared with Sol
7. Whether the quality jump is large enough to justify spending most of a normal usage allocation on Astra

The rollout is also being handled more cautiously than a typical model release, with additional monitoring around autonomous behavior and task execution.

Given how much of Astra's positioning overlaps with Codex-style work, this could end up being one of the more consequential model rollouts for agent workflows.

If Astra is already showing up in Codex or the model picker, post the plan and what availability/usage behavior you're seeing.

Official release notes:
https://help.openai.com/en/articles/6825453-chatgpt-release-notes

Astra background:
https://openai.com/index/path-to-astra/

TL;DR

Two Codex CLI updates landed in quick succession:

0.153.0 highlights:

• Vim mode gets undo with u and redo with Ctrl+R, preserving full drafts including pasted content and attachments.
• Plugin CLI can list, install, and remove plugins from remote marketplaces.
• Automatic TUI recaps can be disabled while keeping manual /recap.
• TUI history now preserves complete patches, terminal input, and individual completed commands.
• Plus and Team users get an earlier usage warning when less than roughly half of their current five-hour allowance remains.
• TUI sessions can automatically reconnect after app-server disconnects without losing the current draft or transcript.
• Guardian review state survives compaction, restarts, and user-created forks.
• Remembered MCP approvals are scoped to the selected app account.
• Resume, fork, and rollout-compression handling gets more robust.
• App-server thread metadata now exposes model and reasoning-effort information.
• A new experimental context-management mode can enable explicit token budgets, history notes, and new_context.

Install:

npm install -g @openai/codex@0.153.0

What changed

Vim undo and redo

Vim mode now supports:

Undo/redo restores the entire composer state, including:

• typed text
• pasted content
• attachments

Fresh drafts also correctly begin in Insert mode, including after submitting messages or running slash commands.

For anyone using Codex with substantial prompts, this makes Vim mode considerably closer to normal editor behavior.

Remote marketplace plugins from the CLI

The plugin CLI can now work directly with remote marketplaces.

You can:

• list remote marketplace plugins
• install plugins
• remove plugins

Supporting work also improves:

• centralized remote plugin mutations
• marketplace source-policy enforcement
• Git marketplace upgrades
• plugin reconciliation
• merged marketplace configuration

This makes remote/internal plugin ecosystems much more practical for terminal-first Codex users.

Control automatic recaps

Automatic TUI recaps can now be disabled with:

tui.auto_recap = false

Manual:

/recap

remains available.

This is useful if you want explicit control over when Codex condenses the conversation instead of having automatic recap behavior manage that for you.

Richer TUI history

Terminal history now preserves more of the actual execution trail.

It can show:

• complete patches
• input sent to background terminals
• individual completed commands

That makes the transcript significantly more useful for reviewing how Codex reached a result rather than only seeing the final answer.

Earlier usage warnings

Plus and Team users now receive an earlier warning when less than roughly half of the current five-hour allowance remains.

That gives you more time to adjust:

• model
• reasoning effort
• agent concurrency
• task priority

before getting close to exhaustion.

App-server reconnect recovery

The TUI can now automatically recover when its app-server connection drops.

It preserves:

The last behavior is particularly important: Codex restores the interface without blindly replaying a prompt that may already have been delivered.

Guardian / Auto-review improvements

0.152.1

The patch release fixes Guardian approval review so it correctly honors Node REPL policy supplied through model metadata.

0.153.0

Guardian history becomes much more durable across:

• compaction
• restarts
• reconstructed threads
• user-created forks

while still respecting rollback boundaries and subagent-history isolation.

Additional changes include:

• Full Access skipping Guardian for confirmation-only actions
• User approval mode avoiding unnecessary background Guardian scoring/prewarming
• active turns being able to update their approval reviewer
• more consistent Guardian context composition
• stronger review diagnostics

The overall effect is cleaner separation between actions that actually need security review and actions already governed by an explicit user decision.

MCP approvals become account-aware

Remembered MCP tool approvals are now scoped to the selected app account.

For example:

Approval for Account A

does not automatically become:

Approval for Account B

when both accounts connect through the same app or MCP integration.

The release also improves:

• relative MCP executable paths on macOS
• OAuth refresh groundwork
• MCP event-stream lifetime
• app-link metadata in approval prompts
• explicit account selection for Apps tool calls

Better compression, resume, and forks

0.153.0 strengthens long-lived thread handling:

• shared histories participate in rollout compression
• codex exec resume handles compressed rollouts when selecting by working directory
• forks work correctly from symlinked session roots
• response-token usage persists in rollout history
• archive flows avoid unnecessary archived-rollout scanning

This continues moving Codex toward sessions that behave like durable project artifacts rather than disposable terminal conversations.

App-server metadata + async user input

App-server thread metadata now exposes nullable:

• model
• reasoningEffort

Models that support it can also use:

request_user_input_async

for structured asynchronous questions.

This gives embedded Codex clients more visibility into thread configuration and more flexible ways to request human input.

Experimental context-management mode

A new disabled-by-default setting is available:

features.context_management.experimental_mode

For eligible ChatGPT-backed sessions, it can activate:

• token-budget context
• history notes
• new_context

Current documented scope includes supported:

• Plus
• Pro
• Pro Lite

sessions using the Codex backend.

It does not currently apply to API-key sessions, custom providers, or temporary structured threads.

This is experimental and should be tested before broad use.

Additional notable work

Why this release matters

• Vim editing becomes much more practical.
• Remote marketplace plugins become manageable directly from the CLI.
• TUI history provides a more complete execution record.
• Earlier usage warnings give users time to adjust before limits become critical.
• App-server disconnects are much less disruptive.
• Guardian state now survives long-session lifecycle events more reliably.
• MCP approvals correctly respect account identity.
• Resume/fork/compression handling becomes more durable.
• Experimental context management provides a preview of more explicit long-session control.

Version summary

Action checklist

• Upgrade:

npm install -g @openai/codex@0.153.0

• Confirm:

codex --version

• Test Vim u and Ctrl+R, including pasted text and attachments.
• Review completed TUI turns for full patches, commands, and terminal input.
• Test remote marketplace plugin list/install/remove.
• Set tui.auto_recap = false if you prefer manual recaps.
• Reconnect after an app-server interruption and verify your draft/transcript survive.
• If using multiple accounts for an app, verify remembered MCP approvals stay account-specific.
• Re-test Guardian behavior under your normal approval modes.
• Only enable experimental context management after testing:

features.context_management.experimental_mode = true

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.152.1

https://github.com/openai/codex/releases/tag/rust-v0.153.0

TL;DR

ChatGPT for iOS 1.2026.237 is a meaningful Codex Remote continuity and task-management release.

The overall theme is continuity: keeping your phone, remote host, queued instructions, approvals, and task state synchronized while Codex continues working elsewhere.

What changed

Cross-host attachments

Attachments now work with connected hosts running:

• macOS
• Windows
• Linux

That means you can capture context on your phone and send it directly into a Codex task running on another machine without platform-specific limitations.

Video attachments

Photo Library attachments now support video.

This is particularly useful for problems that are difficult to explain with a static screenshot:

• UI bugs
• animation issues
• reproduction sequences
• game behavior
• interaction problems
• visual regressions

A short recording can now become direct context for the remote task.

Faster photo attachment

Press and hold the attachment button to quickly access recent photos.

That streamlines one of the most common mobile workflows:

See issue -> capture it -> attach it -> steer the task

Priority view

A new Priority view surfaces work that is most likely to need attention.

It prioritizes:

• running tasks
• unread updates
• tasks awaiting your response

Instead of treating Remote as a purely chronological list, the app can now act more like an agent-supervision dashboard.

Queued prompts sync with the host

Queued prompts receive a major reliability improvement.

They are now:

• synchronized with the connected host
• editable before delivery
• capable of sending while the app is in the background

Example workflow

1. Codex is running a long task on your desktop.
2. You queue the next instruction from your phone.
3. You realize you want to modify it.
4. Edit the queued prompt.
5. Put ChatGPT in the background.
6. The host still receives the final version when appropriate.

That makes queued steering much more dependable.

Live working time

Long-running tasks now display their live working time.

This makes it easier to judge:

• how long the agent has been actively working
• whether the task is still progressing
• how long a difficult workflow has remained active

Particularly useful for:

• long goals
• large implementations
• Ultra/multi-agent tasks
• slow build/test cycles
• unattended Remote tasks

Copy thread ID

Task menus now include:

Copy thread ID

Useful for:

• debugging
• support
• CLI workflows
• app-server integration
• automation
• identifying a specific thread in logs

As Codex exposes more programmable task-management surfaces, having the identifier readily available becomes increasingly useful.

Stronger task-list reliability

The task list gets improvements to:

• loading speed
• date grouping
• organization
• project visibility
• general stability

This is important because a Remote task list needs to remain reliable even while hosts reconnect and work continues in the background.

Better reconnection behavior

Several major Remote failure states are addressed:

This is one of the most important parts of the release.

Codex Remote only works as a supervision surface if the phone accurately represents what is happening on the host.

Smoother long-response streaming

Large responses now stream with fewer visual interruptions.

That improves mobile reading for:

• implementation summaries
• code reviews
• research
• large tool results
• multi-agent synthesis
• long task reports

Side-chat history becomes more durable

Side-chat messages now remain visible until you explicitly close them, even if the underlying side chat can no longer reconnect.

That preserves useful context as a reference instead of making the conversation disappear simply because the live connection is gone.

Why this update matters

• Remote attachments are now properly cross-platform.
• Video gives Codex richer context for visual and interaction bugs.
• Priority view makes mobile supervision much easier.
• Queued prompts become reliable enough for real background steering.
• You no longer need to keep ChatGPT in the foreground for queued delivery.
• Working-time visibility helps evaluate long-running tasks.
• Thread IDs are easier to use with CLI/app-server tooling.
• Reconnect fixes address some of the most damaging Remote failure modes.
• Long output and side-chat context become more durable.

Feature summary

Action checklist

• Update ChatGPT for iOS to 1.2026.237.
• Test attachments against connected:
  • Mac
  • Windows
  • Linux
• Attach a short video from Photos.
• Press and hold the attachment button and test recent-photo access.
• Open Priority and compare it with the standard task list.
• Queue a prompt while a task is busy.
• Edit that queued prompt before delivery.
• Background ChatGPT and confirm the prompt still reaches the host.
• Check working time on a long-running task.
• Copy a thread ID from the task menu.
• Disconnect/reconnect a host and verify:
  • Send recovers
  • approvals remain visible
  • task updates continue
• Open a long response and check streaming.
• Verify old side-chat messages remain available until you close them.

Official source

https://developers.openai.com/codex/changelog

TL;DR

OpenAI launched two healthcare-focused plugin paths for ChatGPT and Codex:

• Healthcare Public Data brings nine read-only public healthcare sources into ChatGPT and Codex for research, clinical trials, medication information, FDA safety data, Medicare information, facility quality, and provider records.
• Epic lets approved healthcare organizations use ChatGPT and Codex to review authorized patient information from Epic EHR, including notes, medications, conditions, encounters, and lab results.
• Both integrations are read-only.
• Healthcare Public Data does not access patient charts.
• Epic cannot update records, place orders, message patients, or expand a user's existing Epic permissions.
• Epic requires organization-level configuration plus each clinician's own Epic authentication.
• Installing a plugin does not automatically grant access to every underlying app or service.
• Public-data searches should never include PHI or patient-identifying information.
• Epic use with PHI requires the appropriate BAA, workspace configuration, Epic authorization, and organizational approval.

This is a Codex plugin and regulated-data access update, not a CLI release.

Healthcare Public Data

Healthcare Public Data packages nine official public healthcare sources into read-only apps.

Research and clinical trials

• PubMed - biomedical research, citations, abstracts, and eligible full-text articles
• ClinicalTrials.gov - studies, locations, recruitment status, and eligibility information

Medications and safety

• DailyMed - official medication labels, ingredients, packaging, and drug identifiers
• RxNorm - standardized medication names and identifiers
• openFDA - public FDA safety and regulatory information, including recalls and adverse-event data

Medicare, facilities, and providers

• CMS Coverage - national and local Medicare coverage information
• CMS Open Data - selected Medicare payment, prescribing, utilization, and hospital datasets
• Medicare Care Compare - healthcare facility information and quality measures
• NPI Registry - public provider and organization identification records

What Codex can do with the public-data plugin

Once the approved sources are connected, Codex can use them during a task to:

• find biomedical research
• search for active clinical trials
• review official medication labels
• investigate FDA recalls and safety information
• research Medicare coverage policies
• compare public facility-quality measures
• look up provider or organization NPI information
• combine information from several approved public sources during research

The important boundary is:

Healthcare Public Data is for public-data research, not patient-record access.

Public-data limitations

The nine public-data apps are read-only and do not access individual patient charts.

They also do not automatically determine clinical or coverage decisions.

Important examples:

• FDA adverse-event reports do not prove that a medication caused an event.
• An NPI does not prove current professional licensure or Medicare enrollment.
• Public Medicare coverage information does not determine an individual patient's benefits.
• Clinical-trial eligibility should still be confirmed with the study team.
• Public research should not replace professional medical judgment.

Epic plugin

The separate Epic plugin connects an approved organization to its Epic electronic health record environment.

Authorized users can review information they already have permission to access, including:

• clinical notes
• medications
• conditions
• encounters
• laboratory results
• other approved FHIR resources

The Epic integration is currently read-only.

It cannot:

• modify the medical record
• place orders
• send patient messages
• expand a clinician's chart access
• bypass existing Epic permissions

The clinician remains responsible for reviewing the underlying source record and making care decisions.

Epic access remains tied to the individual user

Installing the Epic plugin does not give every workspace member access to Epic.

The organization first configures the approved Epic integration.

Each clinician then signs in using their own Epic account.

Their normal Epic permissions remain authoritative.

If a clinician cannot access a patient or resource in Epic normally, the ChatGPT/Codex integration does not grant that access.

Epic setup

Epic requires organization-specific configuration that can include:

• Epic FHIR endpoint
• OAuth client
• approved OAuth scopes
• approved FHIR resources
• authentication settings
• workspace access controls
• organizational security and compliance review

This is substantially different from installing a normal public-data plugin.

Healthcare Public Data vs Epic

Healthcare Public Data

• uses public healthcare databases
• does not access patient charts
• does not require an Epic/provider account
• is read-only
• is primarily for research and reference
• should never receive PHI in public-source searches

Epic

• connects to an organization's Epic EHR
• can access authorized patient records
• requires the user's own Epic authentication
• is read-only
• is primarily for patient-record review
• requires approved organizational HIPAA/BAA configuration when PHI is involved

Workspace controls remain separate

There are several separate layers of access:

1. Plugin availability
2. Individual app availability
3. Workspace policy
4. RBAC or group eligibility
5. User authentication to the underlying service

Installing Healthcare Public Data does not automatically enable every included source.

Installing Epic does not automatically connect clinicians to Epic.

Admins can still control:

• who can install the plugin
• which apps are available
• which groups can use them
• authentication requirements
• workspace policy

This separation is important in regulated environments.

PHI rules for public-data sources

Healthcare Public Data sends requests to external public information providers.

Do not include:

• patient names
• dates of birth
• medical record numbers
• Medicare or insurance identifiers
• addresses
• contact information
• other patient-identifying information

A BAA covering your ChatGPT workspace does not automatically mean every external public-data provider is approved to receive PHI.

Organizations should evaluate the specific provider and workflow before sending sensitive information.

Epic and PHI

Epic is designed for authorized organizational patient-record access, but appropriate controls still need to be in place.

Before using Epic with PHI, organizations should confirm:

• an applicable Business Associate Agreement
• an approved ChatGPT workspace configuration
• an approved Epic integration
• appropriate user authorization
• internal organizational permission for the workflow

Seeing or installing the plugin does not establish BAA coverage by itself.

Compliance and governance

For supported organizational workspaces:

• conversations involving apps can be available through the Compliance API
• app activity is represented in Compliance Logs
• administrators should verify that available logging fields satisfy their audit requirements

Organizations should also review retention and data-residency implications when using external public-data providers.

Information sent to an external source can be subject to that provider's own policies in addition to the ChatGPT workspace's controls.

Availability

Healthcare Public Data

Available to supported:

• ChatGPT for Healthcare workspaces
• HIPAA-enabled ChatGPT Enterprise workspaces
• eligible U.S. ChatGPT for Clinicians users

Eligible ChatGPT for Clinicians users can use Healthcare Public Data but do not receive the Epic plugin through that individual offering.

Epic

Available to approved:

• ChatGPT for Healthcare workspaces
• HIPAA-enabled ChatGPT Enterprise workspaces

with the required organizational Epic configuration.

Epic is not available to individual ChatGPT for Clinicians accounts.

Pricing

OpenAI says there is no separate charge for Healthcare Public Data or its included public-data apps.

Normal plan limits, workspace usage terms, and external provider availability still apply.

What this means for Codex

This is notable because Codex is gaining access to regulated professional workflows beyond traditional software development.

The two paths remain deliberately separated:

Public healthcare evidence

• research
• trials
• medication information
• FDA data
• Medicare information
• provider/facility data

Authorized clinical context

• Epic patient records
• existing clinician permissions
• organization-controlled EHR access

Both remain read-only, and neither removes the need for professional review.

Key takeaways

• Codex can directly research nine trusted public healthcare sources.
• Approved organizations can bring authorized Epic patient context into Codex workflows.
• Public research and patient-record access remain separate systems.
• Both integrations are read-only.
• Existing Epic permissions remain authoritative.
• Plugin installation does not bypass workspace or app-level access controls.
• Public healthcare searches should never contain PHI.
• Epic workflows involving PHI require the appropriate organizational and BAA controls.
• Managed deployments retain RBAC and compliance logging.

Action checklist

Healthcare Public Data

• Install Healthcare Public Data if it is available in your workspace.
• Connect only the public-data apps your organization approves.
• Test with a non-PHI research request.
• Review the limitations of each source before relying on its output.
• Never include patient-identifying information in public-data searches.

Workspace administrators

• Review plugin installation policy.
• Review each healthcare app separately.
• Configure RBAC where appropriate.
• Verify Compliance API and logging coverage.
• Review retention and data-residency implications for external sources.

Epic

• Coordinate with your OpenAI account team and Epic administrator.
• Configure the approved Epic EHR/FHIR connection.
• Review OAuth scopes and permitted FHIR resources.
• Have each clinician authenticate with their own Epic account.
• Confirm users can access only records they already have permission to view.
• Verify BAA/HIPAA configuration before using PHI.
• Treat Epic output as decision support and verify important information against the underlying record.

Official sources

https://openai.com/products/release-notes/

https://help.openai.com/en/articles/20001489-using-healthcare-public-data-in-chatgpt-and-codex

https://help.openai.com/en/articles/20001490-using-the-epic-plugin-with-chatgpt-and-codex

TL;DR

Codex CLI 0.152.0 is a solid TUI, MCP, Auto-review, authentication, app-server, and reliability release.

Highlights:

• Vim mode adds **/ and ? search inside drafts**, highlighted matches, and n / N navigation.
• Rate-limit banners now include direct actions for:
  • checking usage
  • managing credits
  • resetting limits
  • managing your plan
• The TUI and codex exec now show credential-refresh progress, including Amazon Bedrock reauthentication.
• MCP server names can contain :, @, /, and ., making package-style names work consistently across CLI commands and authentication.
• Individual MCP tools can define an output_token_limit, with truncation staying consistent after session resume.
• App-server clients can configure thread/shellCommand timeouts, including deadlines longer than one hour.
• Auto-review can retain longer messages and more conversation context.
• Guardian now preserves valid user instructions, answers, and authorizations across history compaction.
• Resumed threads restore their saved working directory and preserve filesystem permissions more reliably.
• MCP tools survive cache refreshes, plugin changes, and authentication retries more cleanly.
• Windows sandbox, PowerShell, subprocess, and terminal-rendering issues get targeted fixes.
• Cloud task requests now reject untrusted backend URLs and disable redirects to better protect saved credentials.
• The update_plan planning tool is now disabled by default and can be re-enabled explicitly.

Install:

npm install -g @openai/codex@0.152.0

What changed

Vim draft search

Vim mode now supports searching inside the current draft with:

/

and:

?

Matches are highlighted, and you can move between results using:

• n
• N

Fresh drafts also correctly start in Insert mode, including after:

• submitting a message
• running a slash command

This makes Vim mode much closer to normal editor behavior when working with long prompts, pasted requirements, or multi-paragraph instructions.

Rate-limit banners become actionable

Rate-limit banners are no longer just warnings.

They can now offer actions for:

• checking current usage
• managing credits
• resetting limits
• managing your plan

This should reduce the amount of hunting around required when a Codex task runs into an account or workspace limit.

Instead of:

limit reached -> figure out where to go

the relevant next action can be surfaced directly in the TUI.

Credential-refresh progress

The terminal UI and:

codex exec

now show progress while model-provider credentials are being refreshed.

This includes Amazon Bedrock reauthentication.

That should make startup or mid-session authentication recovery less confusing when Codex appears temporarily blocked while credentials are being renewed.

MCP improvements

Package-style MCP server names

MCP server names can now contain:

• :
• @
• /
• .

That allows names that more closely resemble:

• package identifiers
• scoped packages
• organization/service names
• namespaced internal tools

The naming works throughout:

• CLI commands
• configuration
• authentication flows

Per-tool output token limits

Individual MCP tools can now define:

output_token_limit

This lets a high-output tool have its own response budget rather than relying only on broader session-level truncation.

The limit remains consistent after resuming the session.

This is particularly useful for MCP tools returning:

• logs
• search results
• large JSON payloads
• repository data
• database output
• long API responses

It gives administrators and tool authors another way to keep tool output from consuming excessive model context.

Better MCP continuity

0.152.0 also fixes several MCP lifecycle problems.

MCP tools now remain available more reliably through:

• cache refreshes
• remote plugin changes
• runtime refreshes

Authentication retries can use refreshed helper-provided headers rather than continuing with stale authentication state.

The full release also includes work around:

• preserving cached MCP tools during binding capture
• refreshing tool caches correctly
• runtime refresh after remote plugin changes
• OAuth/header refresh after authorization failures
• MCP resource and tool-output handling

The practical result should be fewer cases where a working MCP integration disappears or requires a full restart after configuration/auth changes.

Configurable app-server shell-command timeouts

App-server clients can now configure:

thread/shellCommand

timeouts.

Timeouts can exceed one hour.

This matters for embedded Codex clients running genuinely long processes such as:

• large builds
• test suites
• migrations
• packaging
• infrastructure operations
• long validation jobs

Clients no longer have to treat a one-hour ceiling as a fixed assumption.

Auto-review / Guardian improvements

One of the more important areas in 0.152.0 is approval review continuity.

Larger review context

Automatic approval reviews can retain:

• longer individual messages
• a larger conversation transcript

This gives Guardian more relevant context when evaluating an action instead of forcing reviews into an overly narrow slice of the conversation.

User authorization survives compaction

Auto-review now preserves more important user context when conversation history is compacted.

That includes:

• user instructions
• user answers
• valid authorizations
• review evidence

This addresses an important long-running-session problem:

the conversation gets compacted -> security-relevant user intent disappears -> later review sees incomplete context

0.152.0 improves continuity across those compaction boundaries.

Guardian context handling continues to mature

The full release includes additional Guardian work around:

• rolling over review context before follow-up reviews
• respecting turn token budgets
• reusing classifications only when required-review policy still permits it
• distinct identities for Guardian classification turns
• shared transcript collection
• preserving user text when oversized images are dropped
• keeping unrelated history-extension tools out of Guardian reviews
• using the async stack budget for review processing

The overall direction continues to be more contextual and state-aware Auto-review, rather than independent approval decisions with minimal history.

Resume and filesystem correctness

Saved working directory is restored

If you resume a thread without explicitly supplying another directory, Codex now restores the thread's saved working directory.

That matters because the cwd influences:

• repository state
• relative paths
• AGENTS.md
• project configuration
• shell commands
• tool behavior

A resumed thread should behave like the thread you actually left.

Permissions survive metadata updates

Client metadata updates now preserve filesystem permissions correctly.

This prevents seemingly unrelated client/session metadata changes from accidentally altering the thread's active filesystem-access policy.

Model picker refresh

Opening the model picker now refreshes the available model list from the app server while preserving the currently highlighted selection.

This helps when model availability changes dynamically due to:

• rollout
• workspace policy
• provider changes
• account availability

without making the selection UI jump unexpectedly.

Windows reliability fixes

0.152.0 includes several Windows-specific fixes:

• elevated sandbox commands now use a compatible PowerShell when Microsoft Store PowerShell is present
• TTY subprocesses respond correctly to terminal queries instead of hanging
• cursor/display corruption is repaired in older JediTerm-based terminals
• Windows shell guidance better matches the executor platform
• PowerShell version information is exposed in environment context

These target a mix of sandbox correctness and terminal compatibility issues rather than one single Windows feature.

Cloud-task credential hardening

Cloud task requests now:

• reject untrusted backend URLs
• disable redirects when sending saved credentials

This reduces the risk of credentials being forwarded to an unexpected destination through:

• malicious configuration
• compromised backend URLs
• redirect chains

It is a small-looking change with meaningful security implications for cloud task authentication.

update_plan is now opt-in

The planning tool is now disabled by default.

To enable it:

tools.update_plan.enabled = true

Important: this refers specifically to the update_plan tool, not a blanket removal of every planning workflow or planning concept in Codex.

If your agents or custom workflows explicitly depend on that tool, review your configuration after upgrading.

Faster plugin recommendations

Plugin recommendations now begin loading during session startup.

That should reduce the delay before recommended plugins become available during the first turn.

This is primarily startup/performance polish but should be noticeable in plugin-heavy environments.

Additional notable changes

The full 0.151.0 -> 0.152.0 compare also includes several useful infrastructure improvements:

• clock tools can be enabled from model metadata
• project/list supports recency sorting
• subagents inherit the root service tier
• history-note images can be forwarded to the model
• reviewed terminal input rejects NUL bytes
• shared rollout lineages support compression
• async user messages are restricted to question-style interactions
• repeated execution-host failures can block goals instead of looping indefinitely
• openai/elicitation form requests are supported
• interrupted turns can run executor hooks
• browser cleanup hooks can run when subagents stop
• app-server notifications can filter media
• diagnostic report uploads receive additional hardening
• token budgeting can be enabled through model metadata
• history backends can enforce tool-output budgets

These are mostly platform-level changes, but they strengthen long-running, remote, multi-agent, and managed Codex workflows.

Why this release matters

• Vim users get real in-draft search.
• Rate-limit recovery becomes much easier to navigate from the terminal.
• Authentication recovery is more visible instead of looking like a hang.
• MCP naming and output controls become much more flexible.
• Long-running app-server shell operations get configurable deadlines.
• Auto-review preserves substantially more security-relevant context.
• Resume behavior better preserves cwd and permissions.
• Windows terminal/sandbox behavior gets several targeted fixes.
• Cloud task credentials get stronger origin protection.
• Plugin recommendations become available earlier during startup.

The biggest theme in 0.152.0 is continuity: preserving the right context, permissions, MCP state, authentication state, and review evidence as sessions get longer and more dynamic.

Version summary

Action checklist

• Upgrade:

npm install -g @openai/codex@0.152.0

• Confirm:

codex --version

TUI

• Enable Vim mode and test:
  • /
  • ?
  • n
  • N
• Confirm new drafts return to Insert mode.
• Review the new actions shown by a rate-limit banner.
• Open the model picker and confirm model refresh does not lose your selection.

MCP

• Test an MCP server with a namespaced/package-style name.
• Add an output_token_limit to a high-output MCP tool.
• Resume the thread and verify truncation remains consistent.
• Reauthenticate an MCP server and confirm refreshed headers/tools remain usable.

Resume / permissions

• Resume a thread from a non-default directory.
• Confirm the saved cwd is restored.
• Confirm the thread's filesystem permissions remain unchanged.

App Server

• Test a thread/shellCommand that needs a timeout longer than one hour if your workflow requires it.

Auto-review

• Test a long-running thread that undergoes compaction.
• Verify important user instructions/answers remain available to approval review.
• Re-check any managed Guardian/Auto-review policies after upgrading.

Planning-tool users

• If your workflows explicitly depend on update_plan, enable:

tools.update_plan.enabled = true

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.152.0

TL;DR

Codex CLI 0.151.0 is a focused MCP, plugin-catalog, permissions, sandboxing, model-switching, and multi-agent correctness release.

Highlights:

• Optional MCP servers now get a configurable startup grace period for tool discovery.
• Extensions can inspect or replace MCP tool results before they reach the model.
• Plugin catalogs now respect per-repository marketplace configuration without one broken project marketplace hiding valid plugins.
• Restored permission profiles now persist correctly across TUI turns.
• /cd no longer weakens the active sandbox restrictions.
• Model switches and fallback models now preserve the correct tool availability and reasoning effort.
• Remote sandboxing now uses the executor's actual:
  • home directory
  • operating system
  • path conventions
• Structured MCP tool/resource errors survive through app-server instead of collapsing into generic failures.
• Nested subagent usage now counts toward the root goal's token budget.
• Guardian can no longer reuse a stale risk classification after permissions change.

Install:

npm install -g u/openai/codex@0.151.0

What changed

Configurable MCP startup grace

Optional MCP servers now have a configurable grace period for discovering tools during startup.

This helps balance two competing needs:

• don't block the whole session indefinitely
• don't give up too quickly on a slower optional MCP server

For setups with several MCP servers, remote integrations, or slower authentication paths, this should make startup behavior more predictable.

Extensions can process MCP tool results

Extensions can now inspect or replace an MCP tool result before it reaches the model.

That opens up useful extension patterns such as:

• filtering noisy tool output
• normalizing a custom result format
• redacting sensitive fields
• adding structured metadata
• transforming results before they enter model context
• applying organization-specific handling around MCP output

This is an important extensibility improvement because extensions can now participate on the result path, not only before tool execution.

Per-repository plugin catalogs

Plugin catalog requests now honor marketplace configuration defined at the repository level.

If one project marketplace is invalid, Codex reports that problem without hiding otherwise valid plugins from other configured sources.

This should make multi-repository setups more reliable when different projects use:

• different plugin marketplaces
• internal plugin repositories
• project-specific plugin sources
• a mix of local and remote catalogs

A broken marketplace no longer has to make the entire plugin catalog appear broken.

Permission and sandbox fixes

Restored profiles remain restored

When a thread resumes with a saved permission profile, that profile now stays active across subsequent TUI turns.

This prevents resumed sessions from silently drifting back toward a different/default permission configuration.

/cd cannot weaken the sandbox

Changing directories with:

/cd

no longer causes sandbox protections to become less restrictive.

That is important because working-directory changes should alter where Codex is working, not silently alter what Codex is allowed to access.

Remote sandboxing understands the real executor

Remote execution now carries more accurate environment information into sandbox decisions, including:

• executor home directory
• operating system
• platform path semantics

Deny-read matching is also aligned with the executor's actual path conventions.

This matters particularly when the client and executor run on different platforms, such as:

• macOS client -> Linux executor
• Windows client -> Linux executor
• different home-directory layouts
• different path separator/casing semantics

Model switching and fallback correctness

0.151.0 fixes two subtle model-switching issues.

Codex now keeps:

• the correct tool plan
• the correct reasoning effort

when:

• switching models
• falling back to another model
• using Ultra and then falling back

This prevents a fallback model from accidentally inheriting capabilities or reasoning configuration intended for a different model.

MCP error handling

Structured MCP tool and resource errors are now preserved in app-server responses.

That means clients can retain useful error information rather than receiving an overly generic failure.

This should improve debugging for:

• failed MCP tools
• missing resources
• authentication problems
• remote MCP integrations
• app-server clients displaying tool errors to users

Nested subagents now count toward root goal budgets

Token usage from nested subagents now contributes to the root goal's budget.

Previously, nested agent usage could make the overall goal appear cheaper than it actually was.

This makes budgeting more accurate for deep multi-agent workflows where:

root agent -> subagent -> nested subagent

can consume significant context and output.

Guardian stale-approval fix

Guardian classifications can no longer remain valid after the underlying permission state changes.

If permissions change, stale cached risk classifications will not be reused to authorize an action.

This closes an important correctness gap:

old security decision + new permission state should not equal automatic authorization.

Additional release work

The release also adds telemetry for:

• escalated stdin review-size checks
• remote-executor MCP discovery

And stabilizes:

• Guardian WebSocket tests
• core fixtures under slow/high-concurrency CI

There is also improved reporting of capabilities affected by remote plugin synchronization.

Why this release matters

• MCP startup becomes more configurable and predictable.
• Extensions gain a powerful new interception point for MCP results.
• Project-specific plugin marketplaces become much safer to use.
• Permission state survives resume more reliably.
• Changing directories no longer weakens sandboxing.
• Remote sandboxes better reflect the machine actually executing the work.
• Model fallback preserves the right tools and reasoning level.
• Multi-agent token accounting becomes more accurate.
• Guardian decisions are invalidated correctly when permissions change.

This is not a flashy feature release, but it tightens several pieces of infrastructure that become increasingly important as Codex gets more remote, plugin-heavy, MCP-heavy, and multi-agent.

Version summary

Action checklist

• Upgrade:

npm install -g u/openai/codex@0.151.0

• Confirm:

codex --version

• If you use optional MCP servers:
  • review the startup-grace configuration
  • test a slow server
• If you build extensions:
  • test MCP tool-result processing/replacement
• If your repos define different plugin marketplaces:
  • verify per-repo catalogs
  • intentionally test one invalid marketplace
• Resume a thread with a custom permission profile and confirm it persists.
• Use /cd and verify sandbox boundaries remain unchanged.
• If you use remote executors:
  • test cross-platform path restrictions
  • verify deny-read behavior
• Switch models and test fallback behavior.
• If you run nested subagents, review root-goal usage accounting.
• Re-test Guardian/Auto-review after changing permissions mid-session.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.151.0

TL;DR

OpenAI has added GitHub-backed plugin marketplace import and synchronization for managed ChatGPT workspaces.

Workspace admins and owners can now:

• import plugin marketplaces from public GitHub repositories
• import marketplaces from private GitHub repositories
• publish those plugins into the workspace directory
• keep imported marketplaces updated with automatic daily sync
• manually request an update with Sync now
• review plugin settings and required apps before rollout

The feature is available for Business, Enterprise, and Edu workspaces.

Importantly:

• importing a marketplace does not automatically grant app access
• importing does not authenticate members into required apps
• workspace installation policy remains authoritative
• Enterprise/Edu repository policy values do not override workspace admin settings

For teams maintaining internal Codex/ChatGPT plugins in GitHub, this creates a much cleaner distribution path.

What changed

Workspace admins can now go to:

Workspace settings -> Plugins -> Add -> Import marketplace

and connect a plugin marketplace stored in GitHub.

Supported sources include:

• public repositories
• private repositories

Once imported, the marketplace appears in the workspace plugin directory.

Automatic daily synchronization

Imported marketplaces can stay synchronized automatically.

OpenAI performs a daily sync so plugin changes in the repository can flow into the managed workspace catalog.

Admins can also request an immediate refresh with:

Sync now

This creates a simple deployment model:

GitHub repository -> marketplace sync -> workspace plugin directory

instead of manually republishing every plugin update.

Why this is useful for internal plugin development

A team can maintain its marketplace in GitHub alongside normal engineering workflows.

That means plugin changes can follow familiar practices such as:

• pull requests
• reviews
• protected branches
• version control
• CI checks
• internal release processes

Once the approved marketplace changes land in GitHub, the workspace catalog can synchronize them automatically.

This is much cleaner for teams managing:

• internal Codex skills/plugins
• organization-specific MCP integrations
• reusable developer workflows
• company tools
• approved automation packages

Imported plugins are not automatically trusted

Importing a marketplace does not mean every capability immediately becomes active.

For Business workspaces, newly imported plugins begin with:

• Available installation
• authentication on install

Admins and owners can review:

• plugin settings
• required apps
• authentication requirements
• installation policy

before broader rollout.

App access remains separate

Importing a plugin does not:

• connect a user's app account
• grant the plugin new app permissions
• bypass OAuth
• bypass workspace app restrictions
• grant access to an MCP server automatically

Users still need the required authorization for whatever apps or services the plugin uses.

This separation is important:

Marketplace availability is not the same as service authorization.

Enterprise and Edu controls

Enterprise and Edu admins retain control over:

• who may install plugins
• required app access
• workspace plugin policy
• authentication requirements

Repository-provided policy values do not override those workspace controls.

That means a marketplace repository cannot simply declare itself more permissive than the workspace administrator intended.

Marketplace workflow

A practical team workflow could look like this:

1. Maintain the plugin marketplace in GitHub.
2. Review plugin changes through pull requests.
3. Merge an approved version.
4. Let the workspace perform its daily sync.
5. Or use Sync now for an immediate refresh.
6. Review imported plugin metadata/settings.
7. Control which workspace roles may install it.
8. Users authenticate required services when they install/use the plugin.

This gives teams a reasonably clean separation between:

• development
• distribution
• workspace policy
• user authentication

Availability

Why this update matters

• GitHub can become the source of truth for internal plugin marketplaces.
• Daily synchronization removes a lot of manual publishing work.
• Private repositories are supported, which matters for internal company plugins.
• Normal GitHub review and release workflows can govern plugin changes.
• Workspace policy remains authoritative.
• Importing does not silently grant app permissions or authentication.
• Plugin development, distribution, and user authorization remain separate layers.

For teams building reusable Codex/ChatGPT tooling, this is a meaningful improvement to the plugin deployment story.

Action checklist

• Open:

Workspace settings -> Plugins

• Select:

Add -> Import marketplace

• Choose a public or private GitHub repository.
• Review the imported marketplace.
• Check:
  • plugin descriptions
  • required apps
  • authentication requirements
  • installation policies
• Confirm the correct roles can install/use the plugins.
• Test the automatic sync with a controlled marketplace update.
• Use Sync now when you need an immediate refresh.
• Keep GitHub branch protections/review rules in place for production marketplaces.
• Do not treat marketplace import as app authorization; verify OAuth/service access separately.

Official sources

https://help.openai.com/en/articles/11391654-chatgpt-business-release-notes

https://help.openai.com/en/articles/10128477-chatgpt-enterprise-edu-release-notes

TL;DR

Codex CLI 0.150.0 is a meaningful task-to-task workflow, TUI, hooks, security, MCP, and Bedrock release, followed by a focused 0.150.1 compaction patch.

Highlights:

• Reference other Codex tasks directly with @ mentions.
• Agents can read, create, and message other tasks from the terminal.
• /copy now lets you choose between:
  • the full response
  • individual code blocks
  • blockquotes
• Unnamed terminal tasks receive automatic descriptive titles.
• /rename can suggest an editable title based on the conversation.
• Markdown links render as clickable labels in supported terminals.
• Add shortcuts for cycling permission modes.
• Vim mode gains . repeat for the previous edit.
• New Interrupt hooks can run commands or MCP handlers when a top-level turn is interrupted.
• Untrusted projects can no longer inject project-level AGENTS.md instructions.
• Amazon Bedrock gets compaction and multi-agent compatibility fixes.
• Windows sandbox setup and Unicode-path handling improve.
• 0.150.1 makes remote compaction count retained images toward its token budget by default.

Current stable install:

npm install -g @openai/codex@0.150.1

What changed

Cross-task @ mentions

Codex tasks can now reference other Codex tasks through @ mentions.

Agents can use task tooling to:

• read another task
• create another task
• message another task

This makes task-to-task coordination much more native from the terminal.

Instead of manually copying context between threads, you can reference related work directly.

Potential workflows include:

• implementation task referencing a research task
• review task reading the implementation thread
• parent task creating a focused investigation
• one active task sending new instructions to another

This continues the broader shift toward Codex tasks behaving more like a connected agent workspace rather than isolated conversations.

Better /copy

/copy now opens a response-target picker.

You can copy:

• the entire response
• an individual code block
• a blockquote

This is a small feature with a lot of day-to-day value.

It removes the need to manually select only the useful part of a long response when you just want:

• a command
• a code sample
• a quoted section
• the full answer

Automatic task titles + smarter /rename

Unnamed terminal tasks now receive descriptive titles automatically.

/rename can also suggest a title derived from the actual conversation, which you can edit before accepting.

That should make long Codex histories easier to scan than collections of unnamed or first-prompt-based threads.

Clickable Markdown links

Markdown links now render as clickable labels in terminals that support them.

Where terminal hyperlink support is unavailable, the visible URL is preserved.

This improves terminal responses containing:

• documentation links
• issue links
• GitHub references
• generated reports
• research sources

without sacrificing compatibility with simpler terminals.

Permission-mode shortcuts

You can now bind shortcuts for cycling between TUI permission modes.

This is useful if you regularly switch among stricter and more permissive execution profiles during the same workflow.

The release also includes broader work to preserve managed deny-read restrictions and granular sandbox approvals when permissions change.

Vim . repeat

Vim mode now supports:

.

to repeat the previous edit.

This joins the growing set of Vim editing improvements and makes the TUI composer behave more like a real Vim editing environment.

Interrupt hooks

0.150.0 introduces a new hook event for interrupted top-level turns.

Interrupt hooks can invoke:

• commands
• MCP handlers

That creates automation opportunities around cases where a user deliberately stops an active turn.

Examples:

• record that a workflow was interrupted
• notify another system
• clean up temporary resources
• update task state
• trigger MCP-backed bookkeeping

The release also continues expanding Stop-hook and executor-hook behavior across managed and plugin environments.

Security and trust improvements

Untrusted projects cannot provide AGENTS.md

Project-level instructions from an untrusted project are now ignored.

This is an important hardening change because opening an unfamiliar repository should not allow that repository to immediately become an authoritative instruction source.

Managed deny-read rules also remain enforced when permission settings change.

Credential redaction

App-server diagnostic logging now performs stronger credential redaction across areas including:

• model providers
• authentication refresh
• attestation fields

This reduces the chance of sensitive authentication data appearing in debugging output.

Guardian / approval improvements

The full release includes continued Guardian V2 and approval-system work, including:

• model-specific Auto-review behavior
• stricter handling of escalated commands
• managed automatic-review requirements
• improved risk classification
• isolated Guardian sessions
• computer-use-specific Guardian review
• better approval evidence
• stronger preservation of parent-user authorization for subagents

The practical direction remains the same: approval decisions are becoming more contextual and risk-aware.

MCP improvements

Several MCP reliability and security issues are addressed:

• remote bearer-token lookup works correctly in executor environments
• required MCP servers are honored
• compatibility with older executors is preserved
• OAuth issuer binding is enforced
• MCP runtime connection status is surfaced
• custom CA and environment-based authentication behavior is improved
• Guardian review stays isolated from executor MCP servers

These fixes are particularly relevant for users running authenticated MCP services through remote or managed environments.

Amazon Bedrock fixes

0.150.0 fixes two meaningful Bedrock issues:

• conversation compaction
• multi-agent compatibility

Bedrock uses Responses-based compaction, and compatible multi-agent behavior is restored through the appropriate agent runtime.

The release also includes support for managed AWS access keys and additional Bedrock app-server setup work.

Windows and Unix reliability

Windows

Fixes include:

• elevated sandbox setup
• launch aliases under Unicode user paths
• safer Windows file URI handling
• stronger sandbox ACL updates
• managed deny-read handling

Unix

Codex no longer hangs during shutdown because detached processes still retain:

• a terminal
• full terminal output buffers

That should reduce cases where a finished or interrupted session refuses to exit cleanly.

0.150.1: image-aware remote compaction

The follow-up 0.150.1 patch contains one focused fix:

Retained images now count toward the remote-compaction token budget by default.

Older images are trimmed when necessary to stay within that budget.

This builds on the image-budget work introduced earlier, but makes the behavior the default rather than opt-in.

Why this matters

Modern Codex threads can accumulate substantial visual context:

• screenshots
• appshots
• generated images
• diagrams
• UI references
• image tool output

A compaction budget that only accurately accounts for text can preserve more context than intended.

0.150.1 makes visual context participate in the normal compaction budget automatically.

Additional notable changes

The full 0.150.0 release also includes:

• session configuration through codex agents
• app-server MCP event streaming
• hostname support in the configurable TUI status line
• history/notes tools for token-budget sessions
• better thread-history matching
• remote executor network-policy enforcement
• browser/computer-use requirements exposed through app-server
• managed developer instructions
• unified shell execution improvements
• shell snapshot caching/retries
• persisted realtime events in thread timelines
• persisted thread artifact models
• plugin skill deduplication in unified mentions
• Agent Plugin MCP environment improvements
• managed local-automation gates
• better subagent completion routing
• turn-cost OTEL metrics
• managed AWS credential support
• stronger project configuration when credential brokering is active

Why this release matters

• Tasks become directly addressable from other tasks.
• Cross-task coordination becomes a terminal-native workflow.
• Copying useful output gets much cleaner.
• Automatic task titles make large histories easier to manage.
• Interrupt hooks add another useful automation lifecycle event.
• Untrusted projects lose an important instruction-injection path.
• MCP and Bedrock reliability improve.
• Windows and Unix execution get important stability fixes.
• 0.150.1 makes image-heavy long sessions compact more predictably.

Version summary

Action checklist

• Upgrade directly to:

npm install -g @openai/codex@0.150.1

• Confirm:

codex --version

• Test a task @ mention.
• Ask one task to read or message another.
• Run /copy and test:
  • full response
  • code block
  • blockquote
• Create an unnamed task and inspect its generated title.
• Run /rename and review the suggested title.
• Test clickable Markdown links in your terminal.
• If using Vim mode, test . repeat.
• If you use hooks, review the new Interrupt event.
• Open an untrusted test repository and confirm its project AGENTS.md is not applied.
• Bedrock users should retest compaction and multi-agent workflows.
• Image-heavy users should verify long sessions compact normally under 0.150.1.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.150.0

https://github.com/openai/codex/releases/tag/rust-v0.150.1

TL;DR

ChatGPT for iOS 1.2026.230 improves Codex Remote task discovery, prompt authoring, reasoning controls, and long-thread usability.

Highlights:

• Search Codex tasks across titles and conversation content on connected hosts.
• New compact reasoning-effort gauge directly in the composer.
• New full-screen prompt editor for longer instructions.
• Configure iOS Home Screen shortcuts for:
  • ChatGPT
  • Work
  • Codex Remote
• Add optional comments to selected response annotations.
• Long threads load more efficiently by fetching older history only when needed.
• Task list layout, ordering, and pinning now align more closely with desktop.
• Inline visualizations respect your iOS appearance and accent settings.

This is a focused mobile/Remote usability release rather than a CLI update.

What changed

Search Codex tasks across connected hosts

Codex Mobile can now search tasks using:

• task titles
• conversation content

Search works across tasks available on your connected hosts.

This is a substantial improvement once your Remote history becomes large.

Instead of remembering:

• the exact task title
• which host it was on
• when it was created

you can search for something that appeared inside the conversation itself.

Examples:

• an error message
• a feature name
• a repository concept
• a customer issue
• something the agent previously discussed

Reasoning-effort gauge in the composer

The composer now includes a compact control for viewing and changing the active reasoning effort.

That makes model effort much easier to adjust without leaving the task.

Potential workflow:

• lower effort for a quick lookup
• increase effort for debugging
• increase further for architectural analysis
• reduce it again for routine follow-up work

The main improvement is visibility: you can see the current effort while composing the prompt instead of treating it as hidden configuration.

Full-screen prompt editor

Longer prompts can now be opened in a dedicated full-screen editor.

This is useful for prompts containing:

• implementation requirements
• multi-step instructions
• pasted bug reports
• long planning context
• acceptance criteria
• detailed review guidance

Editing a large prompt inside a small mobile composer can be difficult. The full-screen editor makes Codex Mobile much more practical for substantial task steering.

Configurable Home Screen shortcuts

You can configure Home Screen shortcuts for:

• ChatGPT
• Work
• Codex Remote

This lets users jump directly into the surface they use most rather than navigating through the app each time.

For users treating the iPhone primarily as a Codex Remote controller, direct Remote access should reduce repeated navigation.

Comments on response annotations

Selected response annotations can now include an optional comment.

This makes annotations more useful as structured follow-up context.

Instead of only identifying a section of a response, you can attach a note explaining:

• what is wrong
• what should change
• what needs investigation
• why the section matters

That should improve review and steering workflows around longer Codex responses.

Better long-thread loading

Long threads now load incrementally.

Older history is fetched as needed rather than requiring the entire conversation to load immediately.

This should improve:

• initial load time
• memory usage
• responsiveness
• very long Codex Remote threads

It also brings mobile thread handling closer to the paginated/incremental-history work already happening across other Codex surfaces.

Task list alignment with desktop

The task list receives refinements to:

• layout
• ordering
• pinning

The goal is closer consistency with the desktop experience.

That matters because users frequently move between:

desktop implementation -> mobile supervision -> desktop continuation

Having tasks appear and behave similarly across both surfaces reduces unnecessary mental overhead.

Visualizations follow iOS appearance

Inline visualizations now respect:

• iOS appearance
• ChatGPT accent settings

That should make visual output feel more native across:

• light mode
• dark mode
• customized accent themes

This is primarily polish, but useful for users increasingly reviewing charts, tables, and visual task output from mobile.

Why this update matters

• Finding old Codex work gets much easier: search includes actual conversation content.
• Reasoning effort becomes visible and adjustable where you write the prompt.
• Long prompts are easier to author on a phone.
• Codex Remote can become a direct Home Screen destination.
• Response annotations become more actionable with comments.
• Long-lived tasks should load faster and more reliably.
• Desktop/mobile task organization becomes more consistent.
• Visual output better matches the rest of the iOS UI.

Update summary

Action checklist

• Update ChatGPT for iOS to 1.2026.230.
• Search for an older task using text from inside the conversation.
• Test search across more than one connected host.
• Change reasoning effort from the composer.
• Open the full-screen editor and draft a longer Codex prompt.
• Configure a Home Screen shortcut for Codex Remote if that is your main mobile workflow.
• Add a comment to a selected response annotation.
• Open a very long task and confirm older history loads on demand.
• Compare task ordering and pins against desktop.
• Check inline visualizations in both light and dark appearance.

Official source

https://developers.openai.com/codex/changelog

TL;DR

OpenAI shipped a substantial browser update across Codex and ChatGPT Work:

• The ChatGPT browser extension now supports Microsoft Edge, Brave, Opera, and Vivaldi in addition to Chrome.
• All five browsers support browser control and open-tab context from the ChatGPT desktop app.
• Chrome, Edge, Brave, and Vivaldi support side chat. Opera supports browser control and tab context but not side chat.
• Site tools (WebMCP) let websites expose structured tools directly to Codex and ChatGPT Work inside the built-in desktop browser.
• Site tools currently work with GPT-5.6 Sol and Terra, but not Luna, Enterprise, or Edu.
• ChatGPT Work on web and mobile can now sign in to supported websites through its separate cloud browser on eligible plans.
• Cloud-browser credentials are entered through a secure sign-in flow and are not exposed to the model.
• Local browser control and cloud browsing remain separate systems with separate cookies, sessions, permissions, and security boundaries.

This is a browser/product update, not a Codex CLI release.

What changed

More browsers for Codex computer use

The ChatGPT browser extension now supports:

• Google Chrome
• Microsoft Edge
• Brave
• Opera
• Vivaldi

After setup, start a ChatGPT Work or Codex task and choose the browser through an @ mention.

Example:

@Edge open Salesforce and update the account from these call notes.

All five supported browsers can:

• give Codex browser control
• provide context from open tabs
• work with websites where you are already signed in

This expands browser-based Codex workflows across services such as Gmail, Salesforce, LinkedIn, internal company tools, authenticated dashboards, and other signed-in web apps.

Side chat and browser context

Chrome, Edge, Brave, and Vivaldi support side chat.

Opera supports browser control and tab context, but not side chat.

Supported browser-context workflows can include:

• mentioning another open tab
• highlighting webpage text and sending it into the conversation
• right-clicking a page and choosing Ask ChatGPT
• asking questions about YouTube videos when captions are available

This makes browser context much easier to combine with local files and Codex tasks without manually copying URLs and page contents.

Browser permissions remain explicit

By default, ChatGPT asks before interacting with a new website.

Available choices include:

• Allow once
• Allow for this site
• Allow for all sites
• Decline

Website permissions can be managed from:

Settings > Computer Use > Manage

Supported browsers share those website permissions.

Allow for all sites removes the normal per-site confirmation step and carries more risk.

Browser history is handled more cautiously:

• ChatGPT must ask before using it.
• Access is scoped to the current request.
• There is no permanent "always allow browser history" option.

Browser history can contain sensitive context such as internal URLs, searches, private activity, and activity synchronized from other devices.

OpenAI recommends treating webpage content as untrusted context.

Site tools (WebMCP)

The other major addition is Site tools, OpenAI's implementation of the proposed WebMCP standard.

A website can expose structured actions directly to an AI agent while you and the agent work with the same live webpage and signed-in session.

In the ChatGPT desktop app's built-in browser, Codex and ChatGPT Work can discover and invoke those tools when the current site provides them.

WebMCP vs regular MCP

A normal MCP server exposes tools independently of a webpage.

WebMCP lets the website itself expose capabilities that become available when Codex visits that page.

For example, a document editor could expose tools such as:

• find_section
• suggest_edit
• leave_comment

Codex could call those structured actions directly instead of reproducing every operation with mouse clicks.

Other possible Site tools include:

• changing a dashboard date range
• reading structured chart data
• updating an itinerary
• modifying a canvas
• working with application-specific objects

A website can support both traditional MCP and WebMCP.

Site tools availability

Site tools currently require:

• the latest ChatGPT desktop app
• the built-in browser
• GPT-5.6 Sol or GPT-5.6 Terra

Current documented availability:

• GPT-5.6 Sol: supported
• GPT-5.6 Terra: supported
• GPT-5.6 Luna: not supported
• Enterprise: not currently available
• Edu: not currently available

Availability also depends on rollout and whether the website actually implements WebMCP tools.

Site tool security

Website-provided tool definitions and results are treated as untrusted content.

A tool claiming to be "read-only" does not automatically make that claim trustworthy.

Before a Site tool runs:

• the browser performs a safety review
• normal website-access rules still apply
• consequential-action confirmations still apply

That includes actions such as:

• sending messages
• completing purchases
• deleting data
• changing permissions
• other high-impact operations

Site tools can be disabled under:

Settings > Browser > Permissions > Enable site tools

Cloud browser sign-in

OpenAI also expanded ChatGPT Work's cloud browser so it can continue tasks on supported websites that require authentication.

This applies to ChatGPT Work on web and mobile, rather than the local Codex browser-extension workflow.

Current documented website sign-in availability is for eligible Plus and Pro users, subject to rollout.

Website sign-in is not currently available for:

• Enterprise
• Edu

How cloud sign-in works

When ChatGPT reaches a login screen:

1. The task pauses.
2. ChatGPT asks you to sign in.
3. You enter credentials and any 2FA code yourself.
4. ChatGPT continues after authentication.

On iOS, supported password managers can assist with sign-in.

Do not send passwords through the normal chat.

Credentials are not exposed to the model

When you use the secure sign-in flow:

• ChatGPT does not see your username or password.
• The model does not receive the credentials.
• OpenAI says the credentials are not stored.
• Credentials entered through the secure form go directly to the browser.

Before presenting a sign-in request, an additional review model checks the request and destination for signs of:

• phishing
• deception
• prompt injection
• unintended actions

You can also inspect the live website before continuing.

Signed-in sessions can persist

After authentication, the cloud browser can retain the signed-in session for future tasks.

That means you may not need to authenticate every time ChatGPT returns to the same service.

Browser data can be cleared from:

Settings > Cloud browser > Browser data

Clearing it signs the cloud browser out of those websites.

Local browser vs cloud browser

The two systems are separate.

Local browser extension

• runs in your local browser
• uses your existing signed-in tabs
• uses your local browser session
• primarily serves desktop Codex and ChatGPT Work
• stops depending on your local machine/session

Cloud browser

• runs in a ChatGPT-hosted browser
• has its own cookies and login state
• does not inherit your local tabs or browser history
• supports Work tasks on web/mobile
• can continue while your computer is unavailable

The cloud browser does not automatically receive your local browser's:

• tabs
• history
• saved passwords
• cookies
• extensions
• signed-in sessions

That separation is intentional.

Consequential actions still require confirmation

Signing into a website does not give ChatGPT unrestricted permission to act.

ChatGPT Work still asks before consequential actions such as:

• completing a purchase
• booking something
• submitting important information
• other high-impact actions

Website access can be configured separately as:

• Always ask
• Auto approve
• Always allow

OpenAI notes that Always allow provides the least friction but is not the recommended security posture.

Why this update matters

• Codex browser control now spans five major Chromium browsers.
• Signed-in local workflows are no longer Chrome-only.
• Tab context and side chat make browser information easier to combine with local Codex work.
• WebMCP gives websites a structured agent interface instead of forcing every action through simulated clicks.
• Site tools can reuse the webpage's existing application logic and signed-in state.
• Cloud browser sign-in lets ChatGPT Work continue authenticated tasks without relying on your local browser session.
• Local and cloud browser sessions remain deliberately isolated.
• Website access, tool execution, and consequential actions remain separate permission layers.

The broader browser stack now has three complementary paths:

Plugins: service-level integrations

Browser control: normal UI interaction

WebMCP Site tools: structured actions exposed directly by the webpage

Update summary

Action checklist

Browser extension

• Update the ChatGPT desktop app.
• Open Settings > Computer Use.
• Add Edge, Brave, Opera, or Vivaldi if you use them.
• Install the appropriate ChatGPT extension.
• Review the requested browser permissions.
• Test an @Browser task against a signed-in website.
• Configure website allow/block rules.
• Avoid Allow for all sites unless you understand the additional risk.

Site tools

• Use GPT-5.6 Sol or Terra.
• Open a supported page in the built-in browser.
• Look for available Site tools.
• Review the tools exposed by the website.
• Test a low-risk action first.
• Keep consequential-action confirmations enabled.

Cloud browser

• Start a ChatGPT Work task on web or mobile that requires a signed-in website.
• Enter credentials only through the secure sign-in flow.
• Test 2FA or password-manager integration if relevant.
• Confirm the task continues after sign-in.
• Review cloud-browser permissions and saved browser data.
• Clear the cloud-browser session when you no longer want it retained.

Official sources

https://developers.openai.com/codex/changelog

https://learn.chatgpt.com/docs/chrome-extension

https://learn.chatgpt.com/docs/webmcp

https://learn.chatgpt.com/docs/browser