I’ve been digging into the security models of Codex and Claude, especially around sandboxing, and wanted to share a clear comparison for anyone using them in development workflows.
Core Difference
The biggest distinction is philosophical:
- Codex → sandbox-first (enforced isolation)
- Claude → control-first (runs in your environment unless you isolate it)
Default Behavior
Codex
- Runs commands inside a real sandbox by default
- Filesystem, network, and execution are restricted
- Even things like
npm install,pytest, or shell scripts stay inside that boundary
Docs: https://developers.openai.com/codex/concepts/sandboxing/
Claude (CLI / VS Code)
- Runs as a normal process on your machine
- No inherent sandbox
- Same permissions as your user unless you explicitly restrict it
Docs: https://docs.anthropic.com/en/docs/agents-and-tools/claude-code/overview
Security Model Comparison
| Aspect | Codex | Claude |
|---|---|---|
| Default sandbox |  Yes |
 No |
| Isolation type | OS-level | Config / optional |
| Execution boundary | Enforced | Depends on setup |
| Access outside project | Restricted | Possible |
| Safe by default | |
 |
Real-World Impact
Codex
-
If something goes wrong, damage is contained
-
Good for:
- automated workflows
- running generated code
- untrusted inputs
Claude
-
If something goes wrong, it happens on your actual system
-
Without isolation, it’s effectively:
your terminal, but AI-controlled
Sandbox Quality
Codex
- All spawned processes stay inside the sandbox
- Acts as a true execution boundary
Details: https://developers.openai.com/codex/concepts/sandboxing/
Claude
-
Can be sandboxed (e.g. Docker, devcontainers, OS sandboxing)
-
But:
- not default
- not guaranteed
- can fall back to full access
Sandbox notes: https://docs.anthropic.com/en/docs/agents-and-tools/claude-code/sandboxing
When to Use What
Use Codex when:
- you want safe automation
- you run commands you didn’t fully inspect
- you need a “contained agent”
Use Claude when:
- you need deep system context
- you’re debugging real environments
- you want tight integration with your setup
Best Practice
-
Codex → often safe out of the box
-
Claude → always combine with isolation, e.g.:
- Docker → https://docs.docker.com/get-started/
- Dev Containers → https://containers.dev/
- VS Code Remote → https://code.visualstudio.com/docs/remote/containers
TL;DR
- Codex limits what can happen
- Claude relies on you to limit it