Give each Codex session its own git worktree and launch Codex there with codex -C <path>. Because the workspace-write sandbox is scoped to the working directory, a session in one worktree cannot write into another, and that is enforced by the operating system rather than by the model behaving. As of August 2026 the CLI has no built-in worktree flag, so you create them with git; the Codex app in ChatGPT desktop manages worktrees for you under $CODEX_HOME/worktrees. Three ceilings then apply: attention, quota, and review.
- One worktree per session, then
codex -C <path>. No subshell needed. - The sandbox is scoped to the launch directory, so isolation is enforced by the OS.
workspace-writehas network off by default. That is a feature at four sessions.- The CLI has no
--worktreeflag as of August 2026. The desktop app manages them. - Quota scales linearly. Four sessions consume four times the allowance.
- The ceiling that binds is review capacity, not tooling.
The setup
git worktree add -b feature/auth ../app-auth
git worktree add -b feature/search ../app-search
# -C sets the agent working directory; no cd, no subshell
codex -C ../app-auth -s workspace-write -a on-request
codex -C ../app-search -s workspace-write -a on-request
The sandbox root is the working directory Codex starts in, which is why -C is the flag that matters here. Point two sessions at two worktrees and each one's writable region is a different directory. Point them at the same directory and you are back to two agents editing one tree with no coordination.
Why Codex parallelises unusually well
Most agents ask you to trust that they will stay in their directory. Codex runs model-generated commands inside a platform sandbox, so staying in the directory is not a decision the model gets to make.
The three sandbox policies, set with -s or --sandbox.
| Policy | The agent can | Use for |
|---|---|---|
read-only | Inspect files; no edits or commands without approval | Unfamiliar or untrusted repositories |
workspace-write | Read, edit inside the workspace, run routine local commands there | Parallel worktree sessions |
danger-full-access | Anything, with no sandbox restrictions | A container that is itself the boundary |
How the boundary is enforced, per platform, as documented in August 2026.
| Platform | Mechanism |
|---|---|
| macOS | The built-in Seatbelt framework, out of the box |
| Linux and WSL2 | bubblewrap, a user-namespace sandbox |
| Windows | The native Windows sandbox, or the Linux path inside WSL2 |
Approvals do not scale, so set them deliberately
Four sessions each asking permission produces a stream of interruptions you will start approving without reading, at which point the prompts have stopped providing safety and are only costing you attention. Decide the policy up front instead.
Approval policies, set with -a or --ask-for-approval.
| Value | Codex pauses |
|---|---|
untrusted | For anything not on the trusted list |
on-request | When it needs to go beyond the sandbox boundary |
never | Never. The sandbox is still enforced |
What to actually run, by how many sessions you have open.
| Sessions | Sensible setting | Because |
|---|---|---|
| 1, supervised | -a on-request | You are watching anyway |
| 2 to 4, in worktrees | -a never, after committing | The sandbox plus git is the boundary |
| Any, on unread code | -s read-only | Never write from a repository you have not read |
| In a container | -a never | The container is the boundary |
| Anywhere else | Not --yolo | It removes the sandbox as well as the prompts |
The desktop app manages worktrees for you
If you use Codex in the ChatGPT desktop app rather than the CLI, the worktree management already exists and is worth knowing about before you build your own.
Codex-managed worktrees in the ChatGPT desktop app, August 2026.
| Behaviour | Detail |
|---|---|
| Location | $CODEX_HOME/worktrees by default |
| Changing it | Settings, then Worktrees, then Worktree root |
| Checkout state | Detached HEAD from the branch you picked, not a named branch |
| Retention | The most recent 15 Codex-managed worktrees |
| Protected | Pinned chats, in-progress chats, and permanent worktrees |
| Before deleting | Codex saves a snapshot of the work on it |
A launcher worth writing once
Three commands per session is enough friction that you will stop after a week. Collapse it.
#!/usr/bin/env bash
# cx <branch> [prompt...] - start a Codex session in its own worktree
set -euo pipefail
name="$1"; shift
repo="$(basename "$PWD")"
dir="../${repo}-${name//\//-}"
[ -d "$dir" ] || git worktree add -b "$name" "$dir"
for f in .env .env.local; do [ -f "$f" ] && cp "$f" "$dir/"; done
( cd "$dir"
if [ -f pnpm-lock.yaml ]; then pnpm install --prefer-offline
elif [ -f package-lock.json ]; then npm ci
fi )
exec codex -C "$dir" -s workspace-write -a on-request "$@"
cx feature/auth "add JWT middleware to the admin routes"
The three ceilings
- Attention. Around four sessions, terminal tabs stop being a usable index of what is running and which one is blocked waiting on you. You start tabbing through them to find out, which is the moment parallelism starts costing more than it returns.
- Quota. Consumption scales linearly with sessions. Four parallel sessions drain a ChatGPT allowance roughly four times as fast, and the failure mode is not a warning, it is four agents stopping at once in the middle of four different tasks.
- Review. The one that actually binds. Four agents generate more diff than one person can read carefully, and unreviewed agent output is a liability rather than an asset.
Mixing Codex and Claude Code
Running both is the cheapest way to raise the quota ceiling, because the two bill against different subscriptions. It is also the fastest way to get a second opinion on the same task: two agents on two worktrees, one branch each, and you pick the diff you prefer.
What differs when you run the two side by side.
| Codex CLI | Claude Code | |
|---|---|---|
| Worktree creation | You, with git | claude -w <name> built in |
| Default worktree path | Wherever you put it | .claude/worktrees/<name>/ |
Carrying .env | Your script | .worktreeinclude |
| Isolation mechanism | OS sandbox on the launch directory | Tool-layer checks on edits, cwd, and git redirects |
| Network in the default mode | Off | On |
| Cleanup | You, with git worktree remove | Prompted on exit |
| Billing | ChatGPT plan or API key | Claude plan or API key |
Questions people ask
Yes. Give each one its own git worktree and start it with codex -C <path>. Because the sandbox is scoped to the working directory Codex was launched in, the sessions are isolated at the operating-system level rather than by convention.
Not as of August 2026. There is an open feature request for one mirroring the Claude Code flag. Until it lands, create worktrees with git worktree add and point Codex at them with -C. Worktrees are managed for you only in Codex in the ChatGPT desktop app.
In workspace-write, yes. Writes are confined to the working directory by Seatbelt on macOS and bubblewrap on Linux and WSL2, so a session in one worktree cannot write into another. read-only prevents writes entirely; danger-full-access removes the boundary.
Setting -a never is reasonable in worktrees after you have committed, because the sandbox and git are the boundary. It stops the prompts but keeps the sandbox. Do not confuse it with --yolo, which removes the sandbox as well.
Not in workspace-write by default. Network access is disabled unless you enable it in config, which is a good default for unattended parallel sessions and something you will have to change deliberately if a task needs to install packages.
Three or four. Beyond that, terminal tabs stop being a usable index of what is waiting on you, quota drains proportionally faster, and review becomes the real bottleneck.
Yes, roughly linearly. Four sessions consume about four times the allowance of one, and they tend to hit the limit together because you started them together.
Yes, and it is the cheapest way to raise the quota ceiling because the two bill against different subscriptions. Each still needs its own worktree, and only Claude Code will copy your gitignored config in for you.
Sources
Every figure above was read from these pages on August 2026. Vendors reprice without notice; if you find a stale number, tell us.