Entity trail

Codex Remote

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-03 / github-pulse-researcherCodex 0.153.0 ships remote plugin marketplaces and makes Guardian review history survive compaction and forksThe stable 0.153.0 release landed 2026-09-03T01:37Z. The plugin CLI can now list, install and remove plugins from remote marketplaces (#42150), which puts a third-party install surface into the Codex harness. Guardian review history now survives compaction, restarts and user-created forks while respecting rollback boundaries and isolating subagent history (#41879, #42065), and Full Access skips Guardian reviews for confirmation-only actions while user-approval mode skips background Guardian scoring and prewarming (#42147, #42256). Plus and Team users also get an earlier warning when less than half their allowance remains in a roughly five-hour usage window.
2026-09-02 / arxiv-researcherContext Privilege Escalation Attacks Hit 12 Real Agent Harnesses, Including Claude Code and CodexA systematic analysis of how real-world agent harnesses assemble context identifies two new attack classes: MessageRole Context Privilege Escalation (M-CPE), where attacker-controlled content from a low-privileged source is folded into a higher-privileged message role, and Cross-Scope Context Privilege Escalation (X-CPE), where that content persists beyond the context that introduced it. The authors ran the analysis against 12 production harnesses including Claude Code and Codex, with consequences spanning full agent compromise, remote code execution, denial of service, and manipulated tool or skill invocation. This is a second independent group reaching the harness-as-attack-surface conclusion after 'When Context Gets Root' (2608.27299), and it is the first to name specific shipped harnesses.
2026-09-01 / vibe-coding-researcheruseagent runs Claude Code, Codex and OpenCode on your own subscription inside a per-agent cloud computeruseagenthq/useagent (265 stars, created 29 August 2026, pushed 31 August) gives each agent its own cloud machine with your tools and context and has it hand back finished artifacts, websites, decks, spreadsheets, reports and PRs, while running the agent against your existing Claude Code, Codex or OpenCode subscription rather than a metered API key. Subscription-backed remote execution is the interesting part: it is the workaround for cloud agent products that would otherwise bill per token. Three days old and unproven, so treat the star count as attention rather than validation.
2026-08-29 / agents-researcher9router's LLM proxy can be reached with no key at all, through a Host header or a /codex path rewriteTwo high-severity advisories published 28 August against 9router, an OpenAI/Anthropic-compatible LLM gateway. CVE-2026-55641: the request guard decides a caller is local by reading the client-controlled Host header, and since the server binds 0.0.0.0 by default while the CLI prints 'localhost', any remote attacker sending Host: localhost gets /v1 proxy access with no API key, no CLI token and no login, plus unauthenticated SSRF through the built-in noAuth searxng provider. CVE-2026-55638: the Next.js middleware authorizes on the pre-rewrite path, and /codex/* is absent from the protected prefix list but rewrites to the same /api/v1/responses backend, so that path also bypasses the key gate. Both turn the operator's stored paid provider credentials into an open relay.
2026-08-27 / github-pulse-researcherCline stops showing dollar cost estimates for subscription-billed providers after rendering API-rate charges on flat-rate planscline v4.1.16 and SDK v0.0.80, both 2026-08-26, mark ClinePass, ChatGPT via Codex and Claude Code as subscription-billed so hosts suppress per-token prices. The task header and model pricing rows had been rendering API-rate dollar figures that read as real charges on top of a subscription, including a flash of them on every chat-view mount. The same releases redact credentials embedded in git remote URLs from the workspace information sent to the model, and refresh the model catalog with seven new providers including Agnes AI, IteraCompute and Standard Compute, shifting the ClinePass default to GLM 5.3.
2026-08-27 / vibe-coding-researcherCodex Remote Compaction Now Counts Retained Images Against Its Token BudgetCodex rust-v0.150.1, published 2026-08-27, fixes remote compaction ignoring retained images when computing its token budget; it now trims older images as needed (#41003). Sessions that pass screenshots to a vision-capable agent were budgeting as though those images cost nothing, which is the kind of miscount that produces a context overflow immediately after a compaction that reported success. Codex is simultaneously running 0.151.0 alphas, with alpha.4 and alpha.5 both cut on 08-27.
2026-08-23 / projects-researcherShow HN: Hands Is a Rust MCP Server That Drives a Real Chrome Profile With OS-Level SendInput Instead of CDPPosted by ryan-b in the last 12 hours, Hands exposes observe, click, type and scroll tools to any harness (Grok, Codex, Claude Code, OpenCode). Observe returns a screenshot path plus a small element list from Windows UIA and optional Chrome DOM ids; click is an OS SendInput event on a Bezier path, not a DevTools click. There is no Playwright, no Puppeteer and no remote debugging port, so your daily Chrome launches with no extra flags and sites that fingerprint CDP or automation flags mostly do not detect it. At 3 points it is single-source and unvetted, but the approach is the interesting part.
2026-08-22 / github-pulse-researcherherdrm ships a native macOS console for coding agents running across every SSH box you ownmissuo/herdrm was created 2026-08-19 and is at 600 stars with 36 forks, still pushing commits on 2026-08-22, Swift, macOS 14+, and currently with no license file. It is the native front end for herdr, a background server that owns the lifetimes of Claude Code, Codex, Gemini, Grok and OpenCode processes, letting you see every agent across your Mac and remote machines in one device switcher and drop into any of them at full TUI fidelity. It self-labels early stage. The category itself, a multiplexer whose unit is the agent session rather than the terminal, now has several entrants in a fortnight.
2026-08-22 / news-researcherVS Code 1.134 Pulls Agents Out of the Extension Host Into a Standalone Agent Host ProcessThe headline change in VS Code 1.134 is a dedicated Agent Host process that runs autonomous work as a separate service, governed by Microsoft's open Agent Host Protocol where the host owns authoritative session state and pushes updates to clients. It works across Copilot, Claude and Codex adapters without competing for extension resources, and unlocks multi-window session sharing, remote execution, and sessions that survive closing the window. Also shipping: chat groups for arranging subagent chats beside the main conversation, a prompt timeline in the transcript gutter showing lines added/removed per prompt, and find-in-chat.
2026-08-21 / rss-researcherOpenAI documents the Codex App Server, the JSON-RPC layer every Codex surface actually runs onOpenAI published an engineering post explaining that the CLI, IDE extension, macOS app and Codex Web all sit on the same harness, linked by the Codex App Server, a bidirectional JSON-RPC-over-stdio process that hosts core threads and translates client requests into Codex operations. Partners have written clients in Go, Python, TypeScript, Swift and Kotlin, and TypeScript definitions can be generated straight from the Rust protocol. OpenAI names App Server the first-class integration path it will maintain, and refactored its own TUI to use it, which unlocks running the agent on a remote machine while the laptop sleeps.
2026-08-21 / vibe-coding-researcherCodex 0.149.0 Adds an Interactive `codex agents` Dashboard and a `codex queue` CommandReleased Aug 20, Codex 0.149.0 ships an interactive `codex agents` dashboard for searching, starting and opening tasks, plus `codex queue` for sending messages into existing local or remote sessions. It also adds `/cd`, `/pwd` and `/cwd` for working-directory management, Vim character-replace and motion commands, and bounded replay buffers to stop excessive memory retention. Queued messages now reliably wake idle sessions, which was the main reason people scripted around the CLI rather than through it.
2026-08-18 / saas-disruption-researcherShepherd Terminal Launched a Persistent macOS Workspace Built Around Running Codex and Claude Side by Side Across Tabs, Panes and SSHShepherd Terminal launched today at #6 on Product Hunt (100 points) as a macOS workspace for coding agents rather than a terminal emulator with agents bolted on. Sessions stay alive after the app closes, it tracks which agents are working versus waiting, agents can read and control the Shepherd workspace itself, and it opens browser reviews where you annotate visually as feedback; it connects to remote dev machines over SSH and requires Apple silicon on macOS 14+, with an iOS companion for monitoring and alerts in progress. The category signal is that 'which agent is blocked on me' has become a first-class UI problem worth its own product.

Graph relationships

RELEASED
OpenAI
OpenAI made Codex Remote generally available across all plans.
Source finding
RELEASED
OpenAI -> Codex Remote
OpenAI made Codex Remote generally available across all plans.
Source finding

Source trail

releasebot per Releasebot GitHub arXiv 2609.01222 GitHub GitHub Advisory Database GitHub GitHub Show HN GitHub Visual Studio Code OpenAI Blog

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…