Codex CLI is OpenAI's terminal-based coding agent — same category as Claude Code and Gemini CLI, an agent with direct file and shell access rather than an in-editor chat panel. Its defining trait is a sandbox-first execution model: by default, it runs generated code in an isolated environment before anything touches your actual filesystem or network.
Why Codex CLI's Sandbox Model Matters (and When It's Overkill)
Most terminal agents ask permission before risky operations; Codex CLI's approach is architectural rather than just a prompt — commands execute inside a sandboxed environment with restricted filesystem and network access by default, and you explicitly grant broader access when a task actually needs it. That's a meaningfully different trust model: instead of relying on the agent to ask correctly every time, the sandbox constrains what's possible even if it doesn't ask.
It's overkill for quick, low-stakes scripting where you're going to review every line anyway — the sandbox adds a layer of configuration for a risk you were already mitigating manually. It earns its keep on tasks where you want to hand off more autonomy than you'd trust to permission-prompts alone.
Getting Started
npm install -g @openai/codex
cd your-project
codex
Authenticate with an OpenAI account or API key. Codex CLI reads your working directory on launch, same as other terminal agents, and you describe tasks in natural language from there.
Core Concepts Every Developer Should Know
1. Sandbox levels. Codex CLI offers tiers of autonomy — from fully sandboxed (no network, restricted filesystem) to full access with explicit approval — letting you dial in how much you trust a given session without re-configuring per command.
2. Approval modes. You can run in a mode that asks before every action, or a more autonomous mode that only interrupts for genuinely risky operations (deletes, network calls, pushes) — similar in spirit to Claude Code's permission settings but built around the sandbox as the primary safety layer.
3. Reasoning effort control. Codex CLI exposes a way to trade off latency for reasoning depth on harder tasks — useful for quick edits where you want a fast response versus a gnarly bug where you want the model to think longer before acting.
4. Git-aware by default. It tracks what it's changed within a session and can produce a clean summary or commit message reflecting the actual diff, not a generic description.
Common Mistakes and How to Fix Them
Mistake 1: Running everything in full-access mode out of impatience. The sandbox is the actual safety feature — bypassing it by default for convenience defeats the reason to choose this tool over a less constrained one.
Mistake 2: Expecting sandbox execution to replace code review. A sandboxed test run confirms code executes without touching your real system; it doesn't confirm the logic is correct for your actual use case. Still read the diff.
Mistake 3: No stack-specific instructions. Same trap as any agent — without a project config file describing your conventions, you re-explain your stack every session regardless of how good the sandbox model is.
When Should You Use Codex CLI?
Use it when you want to grant an agent more autonomy than a per-action approval workflow, but with an architectural safety net rather than just trusting prompts. It's a strong fit for exploratory tasks — "try three different approaches to this algorithm and benchmark them" — where sandboxed execution lets it actually run and compare without risking your real environment.
In Practice
I reach for Codex CLI specifically for tasks where I want higher autonomy but don't want to babysit every shell command — the sandbox model handles the trust problem structurally rather than through vigilance. For everyday feature work I still default to Claude Code, but Codex CLI's sandbox is worth understanding even if it's not your daily driver.
Try it on one exploratory task — a spike, a benchmark comparison — where sandboxed execution actually changes what you're comfortable delegating.