Codex Auto-Review Is Now Free: What It Blocks, How to Enable

§ 01What changed on October 6#

The change is about price, not capability. Auto-review has existed since late April. Until now, running it drew on the same usage as the coding agent itself, so the safer mode cost more than the riskier one. Tibo’s pitch for the free version was short: “Use auto-review instead of full-access. Not a trade-off anymore and you’ll sleep more peacefully”.

In config terms, Auto-review keeps the standard sandbox (sandbox mode workspace-write, approval policy on-request) and changes who answers the prompt: the approvals_reviewer setting moves from user, the default, to auto_review. From the CLI, that is -c approvals_reviewer=auto_review. OpenAI’s docs are explicit that nothing inside the sandbox gets an extra step: “Actions that stay inside the sandbox continue without an extra review step.”

§ 02How the reviewer works#

Codex runs in a sandbox that lets it read files, edit inside a writable root and run local commands. When it needs to cross that line, for a network call, a script outside the root or a tool with side effects, it asks for an escalation. Normally that request lands on your screen. With Auto-review, a second Codex agent grades it first, weighing what you asked for, the environment, the security policy and the likely impact.

OpenAI’s note argues the split matters. The main agent is built to finish your task, so an approval prompt can look like one more obstacle to get past. The reviewer has one job: decide whether this boundary-crossing action should run. “A rejection does not merely say no.” A denial comes with a reason, and Codex often finds a safer way to continue without asking you; internally, OpenAI says that happens in more than half of denials. After repeated denials, Codex stops the run, so an agent cannot keep rephrasing until the reviewer gives in.

The reviewer also reads intent. An action that looks risky in the abstract, such as deleting a directory, is approved when you explicitly asked for it. At launch in April, OpenAI said the reviewer ran on GPT-5.4 Thinking at low reasoning and that stronger models were better at both catching risk and reading intent. The October 6 posts do not say which model reviews now.

§ 03OpenAI’s numbers#

Every figure below comes from OpenAI’s April 30 note. The usability rows are measured on OpenAI’s own internal Codex traffic from March 2026; the safety rows are synthetic test sets, built because real internal traffic rarely contains dangerous cases. OpenAI says the ratios depend on use case, environment and sandbox configuration.

The overeagerness row is the one to read twice. It is the everyday failure, an agent doing more than you meant in order to finish the job, and the reviewer misses about one case in ten. OpenAI says many of the misses in the broader attack set were let through because they were not serious enough, often in line with its researchers’ own judgment.

OpenAI also published an illustrative snapshot of 10,000 actions from its internal deployment:

In manual mode, all 720 of those boundary crossings would have interrupted a person. With Auto-review, three did.

§ 04Why free matters#

OpenAI’s own note makes the case that approval friction is a security problem, not just an annoyance. When every network call waits for a click, people route around it: “Users switch to Full Access mode, where there are no rules enforced by the environment.” Others write prefix rules so broad they defeat the sandbox; OpenAI found a sizable minority of internal users allowing every command that starts with python, and adds: “Our favorite discovery was a config file with codex exec –yolo set to always allow.” The rest approve prompts they no longer read.

That is why the price change counts. A safer mode that also costs usage gives people one more reason to pick full access. Free removes that reason. Tibo framed the old default the same way: “Auto-review improves upon the default sandbox setting that requires you to approve everything, which is prone to decision fatigue unless you spend a lot of time configuring specific rules.”

§ 05What OpenAI says it does not do#

The note is plain about the limits. “Auto-review should not be treated as a guarantee of security.” In automated and human red-teaming, OpenAI found cases where the reviewer could be misled into approving commands without the user’s approval, and it does not expect this kind of system to ever give deterministic guarantees.

It also says the reviewer is not a defense against a model that hides its intent: “it should not be understood as a mechanism for protecting against model scheming.” Auto-review sees each escalation request at the moment it is made. A model acting strategically could make a request look harmless, or do things inside the sandbox the reviewer never sees. OpenAI points to separate monitoring, including chain-of-thought monitoring, for that risk.

§ 06Codex Auto-review vs Claude Code auto mode#

Anthropic made a similar move in August, when auto mode became the default permission mode for new Claude Code sessions on Pro, Max and Team plans. Both companies replace most approval prompts with a model-based check. They differ in where the check sits and what is on by default.

The numbers are not comparable head to head: each company built its own test sets. What they share is the conclusion that a model checking each risky action does better than a tired person clicking yes.

§ 07What this means if you run agents#

For Codex users, the practical answer is simple: if you were on full access to avoid prompts, Auto-review now does that job for free, and OpenAI’s own data says it stops a run for a person only a handful of times per thousand boundary crossings. Keep your own rules for anything that must never happen, since the reviewer is a judgment call, not a lock.

CellCog’s AI employees approach the same problem differently. Each employee works on its own secure computer with its own file system, browser and logins, and work it does there runs freely. Every command that reaches your world, your computer, your Chrome or your connected tools, is classified by the employee as safe, moderate or dangerous, and the platform rejects any command that arrives unclassified. You set one auto-approve level, from none to dangerous; anything above it needs your yes, live in the app or as a standing approval you granted for that class of work. There is no second reviewer model: the line is drawn by you.

§ 08The 28-day series so far#

Tibo opened the series on October 4: for 28 days, Codex ships either one clear improvement for most Codex and Work users each day, or what he calls a full reset.

§ 09What we are watching#

• Day 3 onward of the 28-day series, and whether any day touches permissions again.
• API-key sessions: the announcement covers ChatGPT sign-in and says nothing about Codex runs billed through an API key.
• The reviewer model: OpenAI named GPT-5.4 Thinking in April and has not said what reviews today.
• Red-team fixes: OpenAI said it is working on the cases where the reviewer could be misled.

§ 10Sources#

• Tibo (Thibault Sottiaux) on X, Day 2.1 post, October 6, 2026; Day 1 post, October 5, 2026; full-access post, October 6, 2026
• OpenAI Alignment Research Blog, “Auto-review of agent actions without synchronous human oversight”, April 30, 2026
• OpenAI, Codex agent approvals and security, read October 6, 2026
• OpenAI Developer Community, 28 days of quality of life improvements thread, read October 6, 2026
• OpenAI, Codex repository, read October 6, 2026
• Anthropic, auto mode default announcement, August 7, 2026, and Claude Code permission modes, read October 6, 2026