OpenAI Codex Masterclass — Vaibhav Srivastav & Katia Gil Guzman

Key Concepts

• Codex: OpenAI’s software engineering agent capable of running commands, tests, and exploring codebases.
• Unified Agent Harness: The infrastructure wrapper managing tool execution, environment setup, and safety.
• Sub-agents: Decomposable, parallel, and independent agents spawned from a master task.
• Plugins: Bundles of skills, apps, and MCP (Model Context Protocol) servers for reusable workflows.
• Automations: Scheduled background tasks (cron jobs) for Codex.
• Guardian Approvals: An experimental safety feature requiring sub-agent verification for privileged tasks.
• Hooks: Programmatic triggers (start, stop, post-tool use) for custom workflows.

1. Codex Overview and Architecture

Codex is designed to function as a full-stack software engineer. It operates on a foundation of OpenAI models (GPT-5.3, GPT-5.4, and "Mini/Nano" variants).

• Performance: The team introduced WebSockets for 1.75x faster token delivery and a "Fast Mode" for an additional 2x speed boost.
• Surfaces: Users interact with Codex via the App, IDE extensions, CLI, Slack, and GitHub.
• Environment: The app supports native Windows sandboxing and "Work Trees" to manage multiple features or bug fixes within a single project without context switching.

2. Plugins and Automations

Plugins simplify complex setups by bundling three core components:

• Skills: Reusable instructions and scripts for specific processes.
• Apps: Direct connections to external services (e.g., Notion, Linear, Google Drive).
• MCP Servers: External system tools that extend agent capabilities.

Real-World Application: Katya demonstrated using a Google Drive plugin to sync YAML-based event data from a codebase to a spreadsheet, and a Game Studio plugin (utilizing Playwright for browser interaction and ImageGen for assets) to build a platformer game from a single prompt.

Automations: These allow for background execution. Users can set up daily tasks, such as summarizing Slack messages or triaging emails, by defining a schedule and the required plugins.

3. Code Review and Security

Codex provides automated code review, which is now standard practice at OpenAI for all internal pull requests.

• Functionality: It analyzes diffs and contextualizes them against the entire repository, identifying second-order effects in modules not directly touched by the PR.
• Integration: Available via GitHub (automated PR comments), CLI (/review), and the new Cloud Code plugin.
• Security: The "Codex Security" model scans commits for vulnerabilities and generates automated patches.

4. Sub-agents: Methodology and Framework

Sub-agents allow for the parallelization of complex tasks.

• Process: A master task is decomposed into smaller, independent slices. Each slice is assigned to a sub-agent that operates in its own environment.
• Personas: Users can define custom personas (e.g., "Docs Reviewer," "Accessibility Auditor") using TOML files.
• Configuration: Each sub-agent can be configured with specific models, reasoning effort, and sandbox modes (Read-only vs. Write-access).
• Example: A user can spawn 20 sub-agents to audit 45 persona files simultaneously, with the master agent collating the findings into a final report.

5. Bleeding Edge Features

• Guardian Approvals: An experimental feature that mitigates "YOLO mode" (unfettered access). When a privileged task is requested (e.g., deleting a directory), a sub-agent verifies the necessity before human intervention is required.
• Hooks: Programmatic event triggers.
  • Start Hook: Pulls latest code from GitHub upon session launch.
  • Stop Hook: Enables long-running tasks by instructing the agent to "keep going" until a goal is met.
• Personalization: Users can adjust the agent's "personality" (e.g., pragmatic vs. friendly) and add custom instructions to ensure consistent output.

Synthesis and Conclusion

Codex has evolved from a simple code-writing tool into a comprehensive agentic ecosystem. By leveraging sub-agents for parallel processing, plugins for modular integration, and hooks/automations for background maintenance, developers can offload significant portions of their software engineering lifecycle. The platform's focus on safety (Guardian Approvals) and speed (WebSockets/Mini models) positions it as a scalable solution for both individual developers and enterprise teams, as evidenced by the milestone of 3 million weekly active users.