Guide

OpenAI Codex Cloud: a guide to cloud environments and tasks

By Atlas AI Resources · Published November 4, 2026

Codex Cloud runs coding tasks on OpenAI-managed machines, so work keeps going while your computer is asleep, and you review the result from the web, the ChatGPT desktop app, or mobile. This page starts with our own setup checklist, then summarizes what OpenAI's docs pages Codex Cloud, Cloud environments, and Agent approvals & security say.

1. Our advice: a first safe setup

One repository, one boring task. Build your first environment around a single repository and a task you can check in minutes, such as adding missing tests or fixing a lint warning.
Start with the narrowest network. Leave full public internet access off. Allow the package managers preset, then add only the extra hosts your build actually fails without.
Prefer network secrets for tokens. If a credential only needs to reach one HTTPS service, store it as a network secret tied to that domain, so programs see a placeholder instead of the real value. Use a plain environment variable only when a program must read the raw value.
Read the setup report before you publish. Every new task starts from what you publish, so a wrong install step or an overly broad setting gets copied into all of them.
Point it at trusted inputs. An issue, web page, or README can carry hidden instructions. Keep the human review on every change, and don't let a confident summary stand in for reading the diff.
Commit what matters. Saved task state expires and doesn't replace source control. Open a pull request or commit once a change is worth keeping.
Judge by kept work. Count changes merged and not reverted, not tasks started.

2. Per the docs: how it works

A cloud environment is the reusable setup tasks start from: repositories, dependencies, tools, and access settings. Each new task gets its own isolated workspace from the published environment.

Create: on the web or in the desktop app, choose Work in, then Cloud, open Select environment, and select Create environment. Pick your GitHub repositories (connect GitHub if prompted) and select Get started.
Prepare: Codex inspects the repositories, installs dependencies and tools, tests the workflow, and asks for any access or information it can't work out. You don't need to write an install script yourself; Codex can record the tested setup as an Install script and a Start skill.
Publish: review the setup report, configuration, and files, save, and select Publish. Wait for Environment published, then select Start a new task.
Review: inspect changed files and test results, ask for follow-ups, and commit or open a pull request when ready.
Update: edit the environment from Settings, then Codex Cloud, then Environments, let Codex prepare and test the change, and Republish. Only new tasks use the update; existing tasks keep their own state.

Tasks can be continued across devices by reopening the same task. On mobile you open Codex and pick an existing environment; new environments are created on the web or in the desktop app. There is also a codex cloud command in the Codex CLI for starting a task from the terminal or listing recent cloud tasks and their status (see the CLI command reference).

3. Per the docs: network access

Each environment sets how much of the public internet its machine can reach: full public access, or a restricted list made of the Package managers preset (npm, PyPI, crates.io, Maven, GitHub downloads, and other common registries) plus any Additional allowed domains.
Allowing a domain doesn't supply credentials or grant permissions in that service.
A private network can be reached through a VPN connection; Tailscale is the supported provider. VPN access and public internet settings are independent, so restricting the public internet doesn't turn off the VPN.
In Enterprise workspaces, admins can set workspace-wide Agent Security requirements that apply alongside each environment's own domain settings.
OpenAI's page on internet access for the older Codex Cloud (Legacy) lists the risks of opening the network: prompt injection from untrusted web content, code or secret exfiltration, malware or vulnerable dependencies, and content with license restrictions. Its advice is to allow only what you need and review the output and work log (legacy internet access page).

4. Per the docs: variables, secrets, and sharing

Environment variables are passed directly to programs.
Network secrets are tied to allowed domains. Programs get a placeholder and the network proxy swaps in the real value only for those destinations, over HTTPS on port 443, so the raw credential isn't placed in a local process or file.
Personal vault holds your own values. A shared environment can ask each person for their own values; sharing it shares the requirement, not your credentials.
Sharing (Enterprise workspaces): under Privacy, Who can use, choose your workspace or Only me. Each person's tasks keep separate working files, and access to the setup doesn't let someone see another person's task or edit the environment. The docs advise reviewing prepared files and environment-owned credentials before sharing, since cloud identities and VPN connections can also give shared access to services.
Cloud resources: an OIDC connection lets a task get short-lived credentials from a supported cloud provider. The connection's own permissions decide access; yours don't transfer. The docs suggest testing one allowed and one denied operation after you attach it.

5. Per the docs: limits and what changed

Computer and browser use aren't supported in cloud environments yet, and neither are GitLab or self-hosted GitHub Enterprise Server.
Skills stored in your repository are available in cloud tasks; personal skills from your own computer aren't synced.
By default, a task's saved machine state can be recovered for up to seven days after you last start a turn or resume it.
Default machine size depends on your ChatGPT plan; the docs list the specs per plan, and larger machines are available for Enterprise through OpenAI's account team.
Codex Cloud (Legacy) still handles Code Review and the Linear and GitHub integrations, and OpenAI says it plans to deprecate that experience.
In Enterprise workspaces with Cloud delegation turned on, you can ask @ChatGPT in Slack or Microsoft Teams to work on a repository. Follow-ups must come from the same connected account; another participant's request doesn't automatically continue your task.
The security page notes that safety monitoring can pause a task if it detects potentially unsafe model behavior, and that monitoring doesn't replace sandboxing, permissions, or review of the result.

6. How this compares

Cursor and GitHub Copilot run their cloud agents on the same basic pattern: an isolated machine, a prepared environment, and a change that waits for a person. See our Cursor Cloud Agents guide and GitHub Copilot cloud agent guide. Whichever you use, keep the real gate in your repository settings (branch protection and required reviews), not in the task description.