Codex web (chatgpt.com/codex) runs in an isolated OpenAI-managed container against a clone of your repository, so it works with your laptop off but cannot see uncommitted work. The CLI, the ChatGPT desktop app and the IDE extension all run on your machine and see everything local. Codex Remote drives a connected computer from your phone. Checked against OpenAI docs in August 2026.
- Codex web runs on OpenAI infrastructure. Laptop closed: yes. Uncommitted work: no.
- Codex app (
codex app) is the ChatGPT desktop app running local chats. - CLI sees everything local and is the only scriptable one.
- IDE extension is the same agent plus your open files and selection.
- Codex Remote is your phone driving a computer you own.
- Codex cloud needs a ChatGPT sign-in. An API key does not include it.
The five surfaces
Where each one runs, which is the fact everything else follows from.
| Surface | Runs on | Reach it at |
|---|---|---|
| Codex web (cloud) | An isolated OpenAI-managed container | chatgpt.com/codex |
| Codex CLI | Your machine | codex in a terminal |
| ChatGPT desktop app | Your machine | codex app, macOS and Windows |
| IDE extension | Your machine | VS Code, Cursor, Windsurf, Xcode, JetBrains |
| Codex Remote | A computer you connect, driven from your phone | ChatGPT mobile app |
What each one can actually reach
| CLI | Desktop app | IDE extension | Cloud | |
|---|---|---|---|---|
| Runs on | Your machine | Your machine | Your machine | OpenAI infrastructure |
| Uncommitted work | Yes | Yes | Yes | No |
| A local database or service | Yes | Yes | Yes | No |
| Your environment variables | Yes | Yes | Yes | Only what the environment declares |
| Works with the laptop closed | No | No | No | Yes |
| Diff review | Terminal | In-app | Editor diff | Web diff |
| Parallel work | Worktrees | Worktrees, built in | Awkward | Easy |
| Scriptable | codex exec | No | No | codex cloud exec |
| Available with an API key | Yes | Yes | Yes | No |
How Codex cloud actually runs a task
Understanding the two-phase model explains most cloud surprises, particularly the network ones.
Connect GitHub and pick repositories
Codex cloud works from a clone. It needs repository access before it can do anything, and that access is the boundary of what it can see.
Create an environment
An environment declares dependencies, tools, environment variables and setup steps for one repository. This is the part people skip and then wonder why the tests will not run.
Setup phase runs, with network and secrets
The setup phase can reach the network to install what you declared. Secrets configured for the environment are available here.
Agent phase runs, offline by default
Then the agent phase starts. It is offline unless you have enabled internet access for that environment, and the secrets are removed before it begins. An agent reading a hostile file therefore has neither your secrets nor a way out.
Review the summary and diff
Ask for a follow-up, or open a pull request. You can also drive the whole loop from the terminal.
# interactive picker over your cloud chats
codex cloud
# submit a task to a configured environment and return to what you were doing
codex cloud exec "add pagination to the admin users list"
# machine-readable list, for a dashboard or a script
codex cloud list --json | jq '.tasks[] | {title, status, url}'Choosing per task
| Task | Surface | Why |
|---|---|---|
| Debugging with a local service running | CLI or desktop app | Only a local process can reach the service |
| Reviewing a large agent-written change | IDE extension | The editor diff is genuinely easier to read |
| A ticket you can describe completely | Cloud | It runs while you do something else |
| Anything scripted or in CI | CLI | codex exec, with --json when a script consumes it |
| Several independent changes at once | Cloud, or local worktrees | Both parallelise; only one keeps local access |
| Exploring an unfamiliar repository | CLI, read-only | Fast, safe, and sees everything including untracked files |
| Approving a step while you are away from your desk | Codex Remote | The work stays on your machine; only the control moves |
| Work that starts in a pull request or an issue | Cloud, from GitHub, Linear or Slack | No context switch to start it |
Most people converge on two surfaces rather than one: the CLI or the app for real work, and the cloud for well-specified tickets they can hand off and forget.
The thing none of them do well
Once you are running several agents, the difficulty stops being any individual agent. It becomes bookkeeping: which is running, which finished, which is waiting on you, what each of them changed, and how much of the shared allowance they have collectively spent.
- The cloud list shows cloud chats. It does not show the three CLI sessions on your desk.
- The CLI shows one session per terminal, and nothing about the others.
- Every surface reports usage against a plan, and none of them reports it next to a second vendor.
- Nothing here shows one view across Codex and whatever else you run.
Questions people ask
Codex web runs in an isolated OpenAI-managed container against a clone of your repository, so it works while your machine is off but sees only pushed code. The CLI runs on your machine and can see uncommitted work, your environment and local services.
The ChatGPT desktop app running Codex chats locally, on macOS and Windows. Run codex app from the terminal to open it, or start the installer if it is not present. It is a local surface, closer to the CLI than to the cloud.
No. It works from a clone of your repository, so anything you have not pushed is invisible to it. That single fact decides most surface choices.
Its setup phase does, so it can install the dependencies you declare. The agent phase is offline by default unless you enable internet access for that environment, and environment secrets are removed before the agent phase starts.
No. Codex cloud requires signing in with ChatGPT. An API key covers the CLI, the SDK, the desktop app and the IDE extension, but not cloud or the cloud-attached features such as GitHub code review and Slack.
No. On ChatGPT Plus, local messages and cloud chats share the same five-hour window, and weekly limits can apply on top. Run /usage in the CLI to see where you stand before delegating a batch.
The CLI or the desktop app for exploratory and local work, the IDE extension when reviewing a large change, and the cloud for well-specified tickets you want running while you do something else.
Yes. In the cloud each task gets its own environment. Locally, give each session its own git worktree so two agents are never editing the same files, which the desktop app exposes as a Worktree option on a new chat.
Sources
Every figure above was read from these pages on August 2026. Vendors reprice without notice; if you find a stale number, tell us.