Version 14

What

Why it matters

Open questions

• OX Security identifies architectural flaws in Anthropic's MCP and CSA research confirms RCE via MCP is 'by design' across the ecosystem [12][11] — does the previously tracked 'Codex MCP security gap' [21] stem from these protocol-level issues, from a Codex-specific implementation flaw on top of them, or both?

• CVE-2025-59532, CVE-2025-61260, and ZDI-26-305 remain without confirmed OpenAI remediation — has the reported supply chain patch [22] addressed any of these, and what is OpenAI's official disclosure timeline?

• GovCloud availability [1] places Codex in government-adjacent infrastructure — what security accreditations or controls accompany deployment given unresolved CVEs and structural MCP protocol risks confirmed by CSA [12]?

• SemiAnalysis argues Codex UX already rivals Claude Code CLI and base model quality at design is the only remaining gap [14] — do independent benchmarks beyond VibeMAX confirm this assessment across the broader knowledge-work use cases OpenAI is now targeting?

Narrative

Timeline

• 2026-04-21: OpenAI reports 4M+ weekly active developers, launches Codex Labs, and names seven GSI partners (Accenture, Capgemini, CGI, Cognizant, Infosys, PwC, TCS) [2][45]
• 2026-05-08: OpenAI publishes 'Running Codex safely at OpenAI' as an enterprise security reference documenting sandboxing, approvals, and agentic telemetry [31]
• 2026-05-14: Codex launches in ChatGPT mobile app on iOS and Android in preview; Sea Limited case study published [25][46][47]
• 2026-05-15: OpenAI publishes engineering retrospective on the Windows sandbox, detailing rejected security primitives and the final composed architecture [32]
• 2026-05-16: Codex Windows app launches in Microsoft Store; community user reports Codex wiped files on their machine [48][49]
• 2026-05-18: OpenAI and Dell Technologies announce partnership for hybrid and on-premises enterprise Codex deployment [26][50][51]
• 2026-05-20: UiPath treats Codex, Claude Code, and GitHub Copilot as interchangeable selectable components; Infosys publicly positions as model-agnostic [17][18][20]
• 2026-05-21: GitHub formally launches Claude and Codex as selectable agents in Agent HQ; GPT-5.3-Codex reported as new Copilot Business/Enterprise base model [19][37][52]
• 2026-05-22: Gartner 2026 Magic Quadrant names OpenAI, GitHub, and Cursor as Leaders (Cursor furthest right); CVE-2025-59532 disclosed; Virgin Atlantic case study published [23][44][36][53][54][27]
• 2026-05-23: Check Point Research characterizes CVE-2025-59532 as command injection with a public Docker-based proof-of-concept; Codex Security research preview announced [6][35][55]
• 2026-05-25: Multiple sources report OpenAI Q1 2026 revenue at ~$5.7B with critically reported –122% Non-GAAP operating margin; Ramp AI Index reports Anthropic overtook OpenAI in business AI adoption [42][43][56][15][16]
• 2026-05-29: Braintrust case study published; Codex Computer Use launches on Windows; widespread sandbox setup failures and CLI tmux escape documented immediately [30][57][58][59]
• 2026-05-30: ZDI publishes ZDI-26-305 as a zero-day; BeyondTrust documents GitHub token exposure via command injection; Cymulate names 'Configuration-Based Sandbox Escape' (CBSE) as an AI coding tool vulnerability category [34][10][39][8][9]
• 2026-05-31: CVE-2025-61260 (RCE) disclosed by SentinelOne; Windows Computer Use UAC and spawn failures continue with no confirmed stable release [7][60][61]
• 2026-06-01: Codex launches on AWS/Amazon Bedrock covering Commercial and GovCloud regions; 5 million weekly users reported; Daybreak cybersecurity suite planned for future AWS availability [1]
• 2026-06-02: Codex repositioned as general knowledge-work platform with 'Sites' feature and new plugins for analysts, marketers, designers, and investors [5][3][4]
• 2026-06-03: SemiAnalysis rates Codex Desktop App UX as competitive with Claude Code CLI, which holds S-tier on VibeMAX; OpenAI base model weakness at design identified as primary gap [14]

Perspectives

Tensions

• OpenAI published 'Running Codex safely at OpenAI' as an enterprise security reference [31] and expanded into GovCloud [1], but CVE-2025-59532, CVE-2025-61260, and ZDI-26-305 remain publicly disclosed without confirmed remediation, and CSA research confirms RCE via MCP is by design across the AI agent ecosystem [12] — compounding exposure in regulated infrastructure. [31][34][7][8][1][12]
• OX Security and CSA frame MCP RCE as structural to the protocol and Anthropic's SDK design [11][12][13], but BeyondTrust specifically documents GitHub token exposure via Codex's own command injection in enterprise deployments [9] — meaning Codex carries both ecosystem-level and implementation-specific risk simultaneously. [11][12][13][9]
• OpenAI claims 5M+ weekly users and ~$5.7B Q1 2026 revenue with Codex as a driver [1][42], while Ramp's AI Index reports Anthropic has overtaken OpenAI in business AI adoption [15][16] and a critical analysis reports a –122% Non-GAAP operating margin [43]. [1][42][43][15][16]
• SemiAnalysis argues Codex Desktop UX already rivals Claude Code CLI with model quality at design as the only remaining gap [14], while Ramp adoption data and the Gartner Magic Quadrant show GitHub (three-year incumbent) and Cursor (furthest right on vision) as the primary competitive reference points [36][44][15]. [14][36][44][15]
• OpenAI markets Codex as a uniquely positioned enterprise platform, but Infosys — one of its seven named GSI partners — publicly positions as model-agnostic [20], UiPath bundles Codex alongside Claude Code and GitHub Copilot as interchangeable components [17][18], and Dell simultaneously deploys Grok 2.5 on identical infrastructure [41]. [17][18][20][41]
• All named enterprise performance claims — Virgin Atlantic's 78–80% codebase reduction [27], Cisco's 10–15x defect throughput [28], Warp's 90% agent-created PRs [29], Braintrust's 50% adoption in one month [30] — originate exclusively from OpenAI-controlled or co-published materials with no independent technical verification. [27][28][29][30]