Codex after DevDay 2026: cloud tasks, a voice CLI, /agents, Code Review, and Security Cloud

At OpenAI DevDay 2026 on September 29, Codex got four updates: Codex cloud with reusable environments (Plus, Pro, Business, Healthcare, Edu, Enterprise), a refreshed Codex CLI with voice, an /agents view, prompt editing, resume, and worktrees (all plans), Code Review in the ChatGPT desktop app for GitHub PRs and GitLab MRs with automatic cloud reviews (all plans), and Codex Security Cloud for scheduled repo scans and fix preparation (Pro, Business, Enterprise, Edu). The same day, Codex CLI 0.159.1 made GPT-6.1 Sol the default model.

This guide covers what each change does, which commands you’ll use, and where the gaps are. For the rest of the event, see the DevDay 2026 hub for API developers. One gap matters for API teams: Codex writes and reviews code, but its reviews don’t call your running API. That’s where contract tests in Apidog come in, and the last section shows the CI wiring.

What changed in Codex at DevDay 2026

Sources: OpenAI’s DevDay 2026 recap, the Codex what’s new page, and the Codex docs linked below.

Codex cloud: reusable environments

Codex cloud runs coding tasks in the cloud “so work can continue while your computer is asleep.” The DevDay change is the environment model. Per the cloud environments docs, an environment is the reusable setup your tasks share: repositories, dependencies, tools, and access settings. Each new task gets its own isolated workspace from the published version.

Setup is conversational. In a new task, choose Work in > Cloud, then Create environment, and pick the GitHub repositories to check out. Codex inspects them, installs dependencies, tests the workflow, and asks for anything it can’t infer. You review the report and select Publish. Codex records what worked in two fields: an install script and a start skill that brings services up and checks they’re ready.

Three details matter in practice:

• Repository refresh runs in the background and keeps dependency caches, so new tasks don’t repeat installation.
• Internet access is a per-environment setting: a package-manager preset, custom domains, or unrestricted.
• Network secrets keep credentials out of the sandbox. Programs see a placeholder, and a proxy substitutes the real value only for allowed HTTPS destinations.

If a cloud task needs to call a staging API, add that host under allowed domains and store its token as a network secret, not a plain environment variable. From the terminal, codex cloud hands work to the cloud and lists recent cloud chats.

The refreshed Codex CLI

Install it with the script from the Codex CLI docs:

curl -fsSL https://chatgpt.com/codex/install.sh | sh

The Codex changelog also lists npm releases (npm install -g @openai/codex). Version 0.159.1, released September 29, “Added GPT-6.1 Sol as the default model in the bundled catalog” (the same entry also covers the Amazon Bedrock Mantle and Runtime catalogs). The CLI docs’ sample session shows gpt-6.1-sol medium. Per the Codex models page, Free and Go aren’t included at launch, and Enterprise and Edu get it only after an admin enables it. To switch, use /model in a session or start with codex --model gpt-6-sol. What is GPT-6.1 Sol? explains what changed from GPT-6 Sol, including the missing none effort.

Here’s how the headline CLI features map to commands:

Worktree support is on by default as of 0.156.0, which makes parallel agents on one repo practical: each gets its own checkout, so two tasks don’t edit the same files. The /review command reports prioritized findings “without modifying your working tree,” so you can run it before every commit.

Code Review: desktop app, GitHub, and GitLab

Code Review is a plugin in the ChatGPT desktop app. The Code Review docs say it shows a pull request’s description, changed files, comments, and checks, so you can investigate issues before approving. GitHub review is generally available; GitLab merge request support is in preview.

Automatic cloud reviews need the ChatGPT Codex connector and repository permissions. Comments land on GitHub and in the Code Review pane, and “cloud review doesn’t require you to create or manage a cloud environment.” Per the GitHub integration guide, you can also trigger one by commenting @codex review, and in GitHub, Codex flags only P0 and P1 issues.

You steer reviews with a ## Code Review Rules section in AGENTS.md, placed in the file closest to the code it governs. The same guide gives advice worth taking literally: “Leave mechanical checks in CI,” and review rules “don’t replace tests, branch protections, or required approvals.” Codex for code review covers the review workflow in more depth.

Codex Security Cloud

Codex Security Cloud scans connected GitHub repositories in Codex cloud. OpenAI’s recap describes scheduled scans, deduplicated findings, and fix preparation in the cloud, and says it includes Daybreak Blue models without a separate application (the Daybreak Blue vs Red explainer covers those tiers). It’s in research preview for Pro, Business, Enterprise, and Edu.

Setup, per the Security Cloud setup guide:

1. Install the Codex Security Cloud plugin from the ChatGPT plugin marketplace.
2. Select Connect GitHub and grant access to the repositories you want scanned.
3. Pick a repository and a cloud environment, set the target to Repository, and start a scan.
4. For ongoing coverage, choose Commit changes, then adjust the environment, days of history, or pause state under Monitoring settings.
5. On a finding, Fix with Codex drafts a patch, and Create draft pull request opens it for review.

For per-PR coverage, GitHub also supports @codex security review, a deeper, security-specific review in research preview.

Where Apidog fits: Codex reviews code, your API still needs a test

Code Review reads diffs, descriptions, and comments. It doesn’t send a request to your running service. A pull request that renames a JSON field or changes a status code can look fine in review and still break every client. That’s a contract problem, and it needs a test that calls the API.

The pairing is straightforward. Keep your OpenAPI spec and test scenarios in Apidog, where each step asserts status codes and checks the response against the endpoint’s schema. Run those scenarios in CI through the Apidog CLI on every pull request. Code Review shows a PR’s checks, so a failing contract test sits next to Codex’s comments in the same pane. API contract testing explains the approach.

Start small. Pick the endpoints your clients depend on most and assert on the status code, the required fields, and their types. When a Codex-written PR renames user_id to userId, the schema check fails, the CLI exits non-zero, and the check turns red on the pull request, before a human reviewer has to spot the rename in a long diff. That split matches OpenAI’s own guidance: review rules cover consequential, repository-specific behavior, and CI owns the deterministic checks.

Here’s a GitHub Actions job:

name: api-contract-tests
on: pull_request
jobs:
  apidog:
    runs-on: ubuntu-latest
    steps:
      - run: npm install -g apidog-cli
      - run: apidog run --access-token "$APIDOG_ACCESS_TOKEN" -t "$SCENARIO_ID" -e "$ENV_ID" -r cli,junit
        env:
          APIDOG_ACCESS_TOKEN: ${{ secrets.APIDOG_ACCESS_TOKEN }}
          SCENARIO_ID: ${{ vars.APIDOG_SCENARIO_ID }}
          ENV_ID: ${{ vars.APIDOG_ENV_ID }}

Codex can run the same command locally before it opens the PR, so it sees the failure while it still has context. Using the Apidog CLI in Codex covers that setup, and building a software factory with Codex wires the full loop from task to tested PR.

FAQ

What did Codex get at DevDay 2026? Reusable cloud environments, a refreshed CLI (voice, /agents, prompt edit, resume, worktrees), Code Review in the desktop app with automatic cloud reviews, and Codex Security Cloud in research preview.

What’s the default model in the Codex CLI now? GPT-6.1 Sol, since CLI 0.159.1 on September 29. Use /model to switch models or change reasoning effort.

Can I use Codex cloud on the Free plan? No. Codex cloud lists Plus, Pro, Business, Healthcare, Edu, and Enterprise. The CLI and Code Review are on all plans, and our free Codex guide covers the no-cost routes.

Does Codex Code Review test my API? No. It reads the pull request’s diff, description, comments, and checks. Add API contract tests in CI so a check fails when behavior changes.

Who can use Codex Security Cloud? Pro, Business, Enterprise, and Edu, in research preview. You install it as a plugin and connect GitHub.

Next step

Update the CLI, run /model to confirm you’re on gpt-6.1-sol, and try /review on your next branch. Then download Apidog, turn one critical endpoint into a test scenario, and add the job above, so every Codex-written PR gets checked against the running API as well as the diff.