OpenAI Codex desktop app adds background computer use

The flagship change is subtle but architecturally important: Codex now runs a second, virtual cursor on your Mac. Under the hood, the agent captures the screen, reasons over pixels and accessibility data, then issues mouse and keyboard events through macOS's Accessibility and Screen Recording APIs. Multiple Codex agents can run in parallel while you keep typing in other apps — the system is explicitly designed so 'multiple agents can work in parallel, without interfering with your own work in other apps,' per OpenAI's own documentation.

The caveats matter as much as the capability. Computer use is macOS-only at launch and gated out of the EU, UK, and Switzerland. It refuses to drive terminal apps, Codex itself, or any admin/security prompt — a deliberate choice to prevent the agent from sandbox-escaping or recursively controlling its own parent process. That scoping is also why OpenAI's in-app Atlas browser is currently restricted to localhost frontend and game-development work: the company is keeping the blast radius small while the behavior matures.

OpenAI's own framing, echoed by Head of Codex Thibault Sottiaux, is that it is 'building the super app out in the open.' That is not marketing gloss. Roughly half of Codex's weekly users already use it for non-coding tasks, and the 90+ new plugins — Atlassian Rovo, CircleCI, CodeRabbit, GitLab Issues, Microsoft Suite, Neon, Remotion, Render, Superpowers — are squarely aimed at the non-code half of an engineer's day: tickets, reviews, design, docs, deploys.

Product analyst Mejba Ahmed captures the shift precisely: developers 'do not suffer because code generation is impossible; they suffer because the whole loop around code is messy.' Memory preview (retaining preferences and hard-won context across sessions) and heartbeat automations (self-modifying schedules that can span days or weeks) reinforce the same thesis. Codex is being repackaged from a coding assistant into the ambient operating layer that stitches those loops together — the reason Engadget and Decrypt read this release as scaffolding for an eventual ChatGPT + Codex + Atlas super app.

The release landed roughly an hour after Anthropic unveiled Claude Opus 4.7, and neither side is pretending that is coincidence. TechCrunch notes that Claude Code 'has been dubbed the tool of choice for many businesses,' especially after Anthropic added its own Mac remote-control capabilities earlier in the year; SiliconANGLE reads the Codex update as OpenAI openly chasing a competitor 'currently perceived as the market leader among businesses.' Sam Altman punctuated the moment on X with a jab at Anthropic's rate limits and model downgrades.

The pricing context sharpens the point. A week before the update, OpenAI launched a $100/month ChatGPT Pro tier that mirrors Anthropic's Claude Max price exactly and bundles 5x Codex usage (temporarily 10x through May 31, 2026). Anthropic's Claude Code is estimated at roughly $2.5B annualized revenue in early 2026 — a target large enough to justify shipping a super-app-shaped update within an hour of your rival's flagship model release. On X, one popular framing captured the strategic split bluntly: 'Anthropic bets on raw model power, OpenAI wants your whole workflow.'

The loudest complaints in the Codex subreddit are not about the model — they are about where it runs. Computer use is macOS-only; the Windows app is reported as laggy; Linux has no GUI app at all; EU, UK, and Swiss users are locked out at launch; and there is no mobile or /remote equivalent to what Claude ships. Community reaction split almost cleanly along those lines: rapturous on macOS ('absolutely insane,' one user wrote after uninstalling Playwright), grudging elsewhere.

Safety is the other fault line. One Reddit post titled 'Codex just nuked my PC' reports destructive file deletion with only playground permissions granted; other users describe Codex spawning infinite git-for-windows instances on Windows, and the app crashing repeatedly during long runs. Even on macOS, some users report the agent is 'hilariously slow... 30+ seconds figuring out how to press a button for every single click.' Early community best practices are coalescing fast: never grant delete permission, force the agent to emit an explicit paths-to-delete list before any destructive action, and run hourly backups while computer use is enabled. The capability is real; the guardrails are still being written by users.