Everything so far has lived in Chat or in Work. This lesson steps onto different ground: Codex, ChatGPT's agent for code. It reads a codebase, writes and changes files, runs commands and tests, and shows you every change before you keep it. It is the most technical tool in the course, and the most powerful for one job: building and changing software.
You don't have to be a developer to get something out of this lesson. Plenty of business people now use Codex for small, useful things: a script that cleans up a spreadsheet export, a tweak to the company website, a quick internal tool. Even if you never open it yourself, knowing what it does helps you talk to the people who do.
What Codex actually is
Codex is an agent for software work. You give it a goal ("add a search box to this page", "find out why this test fails"), and it plans, reads the relevant files, makes changes, runs commands to check them, and reports back.
Three things set it apart from asking for code in a normal chat:
- It works where the code lives. You point it at a folder or a repository. It reads the real files instead of the snippet you pasted.
- It acts, not just suggests. It edits files, runs tests, installs what the project needs, and tries again when something breaks.
- It shows its work as a diff. Every change is laid out line by line: red for removed, green for added. You review, then keep or throw away.
OpenAI describes Codex as dedicated to "software development and technical work." That focus is the point. Work is the generalist for documents and office tasks; Codex is the specialist with a workshop full of developer tools.
Who it is for, and why a non-coder might still care
The main audience is obvious: developers, who use it to build features, fix bugs, write tests, and review pull requests.
But look at who else gets value:
- Analysts who need a script to reshape data every week.
- Marketers who want a small change on the website without waiting for a sprint.
- Product people who want to try an idea as a working prototype.
- Managers who want to understand what a codebase does before a meeting.
A worked example. Every Monday, Sofie in finance downloads a sales export, deletes three columns, fixes the date format, and pastes the result into a template. Twenty minutes, every week, and easy to get wrong. She opens Codex on a folder with last week's export and asks for a small script that does exactly those steps and saves a clean file next to the original. Codex writes it, runs it on the sample, and shows her the result. She checks the numbers against last week's version. From then on, Monday takes one click. She never had to read the script line by line; she only had to check the output.
A reasonable rule: if the job ends in code that runs, Codex is worth a look. If it ends in a document, a deck, or a Site, Work is usually the better fit.
Where you find it
Codex comes in several shapes, all signed in with the same ChatGPT account:
- The desktop app. Pick Codex from the menu at the top left. It has its own history, separate from your chats, and works with local folders, repositories, and the terminal.
- The Codex CLI. For people who live in a terminal. You install it, open a project folder, and type
codex. - The IDE extension. Codex inside your code editor, next to your files.
- Codex Cloud. Tasks run on machines OpenAI manages, so they keep going while your laptop sleeps. You can start or check them from desktop, web, or phone, once a cloud environment is set up.
On top of that, Codex can review pull requests on GitHub: automatically, or when someone asks it to in the PR. It posts comments; a human still decides what to merge.
Getting in: your first run
The quickest start is the desktop app:
- Open the app and sign in with your work ChatGPT account.
- Switch to Codex and choose where it works: open a folder or a repository on your computer.
- Describe the goal in plain words, and add any files or context it needs.
- Watch, answer its questions, and review what it changes.
Prefer the terminal? Install the CLI (OpenAI's quickstart gives a one-line installer for Mac and Linux), go to your project folder, and run codex. The first time, choose Sign in with ChatGPT. A few commands to know: /init writes a starter AGENTS.md for the project, /permissions sets what Codex may do, and /review checks your changes without touching your files.
One habit before you start: use Git, and save a checkpoint before and after each task. OpenAI's own docs recommend it. If a change goes wrong, you roll back in seconds.
The core loop: ask, review the diff, approve
Every Codex session runs the same loop.
1. Ask. Describe the outcome, not the steps. "The contact form doesn't send when the phone field is empty. Find out why and fix it. Run the existing tests after." The prompting lessons from Part 3 apply in full: goal, context, format, boundaries.
2. It works. Codex reads the files it needs, makes a plan, edits, and runs commands. You see what it is doing as it goes.
3. Review the diff. Before you keep anything, read the changes. You don't need to understand every line. Ask yourself: is it touching the files I expected? Is the change about the size I expected? Did the tests pass?
4. Approve, or steer. Happy? Keep it and commit. Not happy? Say what's wrong, in plain words, and let it try again. Or roll back to your checkpoint.
Keep tasks small. "Fix this bug" works far better than "rebuild the whole app." Small tasks give small diffs, and small diffs are easy to check.
Permission modes: how much it may do alone
Codex works inside a sandbox: a boundary that decides which files and network resources it can reach. On top of that sits the permission mode, which you set below the message box in the app, or with /permissions in the CLI:
- Ask for approval. Codex works inside the workspace folder. It asks before editing files outside it or using the internet. OpenAI recommends starting here for most work.
- Approve for me. The same boundary, but requests to cross it go to an automatic review first. Only actions flagged as possibly unsafe come back to you.
- Full access. No restrictions: the internet and any file on your computer. Powerful, and rarely what you want.
- Custom. Rules set in a configuration file, often by your IT team.
A detail worth knowing: changing who reviews a request doesn't widen the sandbox. Approve for me still keeps Codex in your folder; it only changes who says yes at the border. Your workspace admin may also lock some modes away.
Give it standing context: AGENTS.md, skills, and plugins
Codex starts every task fresh. Without help, you'd re-explain your project every time. Three things fix that.
AGENTS.md is a plain Markdown file in your project that Codex reads before it starts. Put your working agreements in it: which test command to run, which package manager to use, when to ask before adding a dependency, how you name things. Files deeper in the folder tree can add more specific rules for that part of the project. A personal one in your Codex home folder carries your own preferences everywhere. /init gets you a first draft.
Skills (lesson 4.2) work in Codex too: a packaged way of doing one job, like "write release notes from the last ten commits."
Plugins and apps (lesson 4.5) connect Codex to the rest of your tools: GitHub, an issue tracker, your documentation.
Where it fits: Chat, Work, or Codex
A quick way to choose:
- Chat for a question, an explanation, or a short snippet you'll paste yourself. "What does this error mean?"
- Work for multi-step jobs that end in a document, spreadsheet, deck, report, or Site. "Turn these survey results into a summary deck."
- Codex for jobs that end in code that runs, inside a real codebase, with tests, diffs, and Git. "Add CSV export to our reporting page and write a test for it."
They overlap at the edges. Work can build a Site; Codex can write a document. Pick the one whose tools match the job.
Staying safe and in control
An agent that edits files and runs commands deserves the same care as a new colleague with access to your laptop. The habits:
- Start on Ask for approval and loosen only with good reason.
- Use Git checkpoints so every task can be undone.
- Read the diff before you keep anything. Check the tests ran.
- Keep secrets out. No passwords or API keys in prompts or in AGENTS.md.
- Be careful with outside content. Web pages, issues, or files from strangers can carry hidden instructions: the prompt injection risk from lesson 4.4. Scope tasks and stay within trusted sources.
- Follow your company's rules on which repositories may be opened with AI, and on Codex Local versus Codex Cloud, which admins control separately.
Cost and plans
Codex comes with your ChatGPT plan: signing in with ChatGPT uses your plan's usage allowance, the same pool as Work. How much a task uses depends on its size, the length of what goes in and out, the reasoning level, and the speed setting. Bigger models and faster settings use the allowance faster. On Business, Premium seats get the most room; Standard seats include a limited amount of the strongest model, with optional credits after that. Developers can also sign in with an API key, which is billed at API prices instead.
Try it
Make a new folder with one small file in it, for example a CSV export or a simple web page. Open the desktop app, switch to Codex, and point it at that folder. Leave it on Ask for approval.
Ask for something small and checkable: "Write a short script that reads this CSV and prints the total of the amount column. Explain how to run it." Watch what it does, read the diff, run the script, and check the total yourself. That first small win is how everyone starts.
(General exercise. Role and industry versions come once accounts are in.)