OpenAI puts a GPT-5.4 reviewer where Codex used to stop and ask a human

The sandbox still enforces the boundary. Auto-review rules on requests to cross it. Default mode limits Codex to reading files, editing under a pre-specified writable root, and running local commands inside that boundary, with programmatic exceptions granted through config.toml or custom .rules files ^[7]. When Codex reaches the edge it can ask to escalate. In Auto-review mode a separate Codex agent grades that request against the user's intent, the environment, the security policy and the likely impact of the action ^[6]. The grader is GPT-5.4 Thinking at low reasoning ^[5].

OpenAI's stated reason for splitting the roles is that the main agent is optimised to finish the task. "This creates pressure to treat an approval boundary as just another obstacle to overcome," the company wrote ^[11].

The baseline being replaced is not a careful reviewer. In manual mode, mundane network calls and simple python scripts wait on authorisation ^[8]. OpenAI says that friction pushes users two ways. Some switch to Full Access, where the environment enforces no rules and the sandbox will not block malicious code execution, data exfiltration or credential probing ^[9]. Others write blanket prefix rules: in internal traffic the company detected a sizable minority of users who allow every command beginning with the word python ^[10]. It also lists reviewer fatigue among the reasons approvals get clicked through ^[23].

The two headline numbers are consistent with each other. Around 99 percent of the actions that reach Auto-review are approved ^[4], so roughly one in a hundred is refused ^[19]. A rejection returns a rationale, and in OpenAI's internal deployment Codex finds an acceptable path on its own in more than half of those cases without going back to the user ^[21][14]. That leaves under one in two hundred boundary crossings producing a human decision point ^[20], which is where the 200x reduction in stops comes from ^[3].

Auto-review is scoped to block the serious and hard-to-reverse: exfiltrating data, exposing secrets, deleting data, weakening security settings, running untrusted code, and following instructions from untrusted content that conflict with the user's instructions ^[12]. The same policy approves nominally risky actions when the user explicitly asked for them ^[13]. Those two rules push against each other, and the reviewer's accuracy depends on distinguishing a user's instruction from content that imitates one.

OpenAI says Auto-review performed well on its dangerous actions evaluations and is conservative enough for its security teams ^[16]. The post does not publish the eval results or a miss rate ^[18].

Inside OpenAI a majority of Codex Desktop token usage now comes from Auto-review mode, and the company says that share is growing ^[17]. OpenAI also monitors for Codex attempting to game the reviewer, and automatically stops the trajectory after repeated denials ^[15].