1440 12.5 credits1440 12.5 credits
1441 750 credits1441 750 credits
1442 1442
1443 Daybreak Blue
1444 125 credits
1445 12.5 credits
1446 750 credits
1447
1448 Daybreak Red
1449 312.5 credits
1450 31.25 credits
1451 1875 credits
1452
1443 GPT-5.6 Terra1453 GPT-5.6 Terra
1444 50 credits1454 50 credits
1445 5 credits1455 5 credits
1484 Fast mode consumes credits at a higher rate for supported models. See1494 Fast mode consumes credits at a higher rate for supported models. See
1485 Speed for rates.1495 Speed for rates.
1486 1496
1497 Daybreak access requires [Trusted Access for
1498 Cyber](https://learn.chatgpt.com/docs/cyber-safety#trusted-access-for-cyber) approval.
1499 Daybreak Blue uses GPT-5.6 Sol credit rates. Daybreak Red requires
1500 separate approval and provisioning.
1501
1487Speed configurations will increase credit consumption for all models that apply.1502Speed configurations will increase credit consumption for all models that apply.
1488Fast mode consumes credits at a higher rate for supported models. See1503Fast mode consumes credits at a higher rate for supported models. See
1489[Speed](https://learn.chatgpt.com/docs/agent-configuration/speed) for supported models and rates.1504[Speed](https://learn.chatgpt.com/docs/agent-configuration/speed) for supported models and rates.
3520 3535
3521#### Who can use the CLI3536#### Who can use the CLI
3522 3537
3523The `@openai/codex-security` package is public. Install the CLI and SDK:3538The `@openai/codex-security` package is public.
3524
3525```bash
3526npm install @openai/codex-security
3527```
3528 3539
3529Running scans requires Codex Security access. For best results, use an account3540Running scans requires Codex Security access. For best results, use an account
3530verified for [Trusted Access for Cyber](https://chatgpt.com/cyber).3541verified for [Trusted Access for Cyber](https://chatgpt.com/cyber).
3795 3806
3796#### Set up and verify the CLI3807#### Set up and verify the CLI
3797 3808
3798Install the published package:3809Run the CLI with `npx` and check its version:
3799 3810
3800```bash3811```bash
3801npm install @openai/codex-security3812npx @openai/codex-security --version
3802```3813```
3803 3814
3804List the available commands:3815List the available commands:
4170The `@openai/codex-security` package is public. Running scans requires Codex4181The `@openai/codex-security` package is public. Running scans requires Codex
4171Security access.4182Security access.
4172 4183
4173Install the published package in your project:4184Run the CLI with `npx @openai/codex-security`.
4174
4175```bash
4176npm install @openai/codex-security
4177```
4178
4179Invoke the installed package as `npx @openai/codex-security`. You can use
4180`codex-security` directly when the executable is available on your `PATH`.
4181 4185
4182#### Command overview4186#### Command overview
4183 4187
5261Use this changelog to see what changed in Codex Security and which plugin5265Use this changelog to see what changed in Codex Security and which plugin
5262versions are available from each installation source.5266versions are available from each installation source.
5263 5267
5264**Latest release in the hosted Codex Security catalog:** `0.1.17`.5268**Latest release in the hosted Codex Security catalog:** `0.1.18`.
5265 5269
5266Check the plugin version in your current Codex environment before you use a5270Check the plugin version in your current Codex environment before you use a
5267feature from a newer release. Reopening or rerunning a saved scan doesn't pin5271feature from a newer release. Reopening or rerunning a saved scan doesn't pin
5270These versions apply to the Codex Security plugin. The Codex app, Codex CLI,5274These versions apply to the Codex Security plugin. The Codex app, Codex CLI,
5271TypeScript SDK, and plugin app have separate version numbers.5275TypeScript SDK, and plugin app have separate version numbers.
5272 5276
5277#### 0.1.18 (August 7, 2026)
5278
5279#### Use Amazon Bedrock for security scans
5280
5281- Run scans with Amazon Bedrock bearer tokens and AWS profiles, regional
5282 settings, web identity, or container credentials.
5283- Keep AWS authentication available to delegated deep-scan workers.
5284
5285#### Run standard scans with less coordination
5286
5287- Use a simpler workflow for standard repository and scoped-path scans.
5288- Preserve nested `SECURITY.md` guidance, exact scan scope, progress updates,
5289 and final scan reports.
5290
5291#### Start and complete scans more reliably
5292
5293- Give prompt-started scans up to five minutes to initialize large
5294 repositories instead of timing out after 30 seconds.
5295- Complete standard and deep scans when a host enforces tool-name length
5296 limits.
5297
5298#### Keep remediation available after filesystem changes
5299
5300- Remediate findings from completed scans after a filesystem remount changes
5301 its device identifier.
5302- Continue requiring the original checkout and Git revision before applying a
5303 fix.
5304
5273#### 0.1.17 (August 5, 2026)5305#### 0.1.17 (August 5, 2026)
5274 5306
5275#### Follow scan progress as it happens5307#### Follow scan progress as it happens
8705still surfaces the relevant prompt category. With `approval_policy = "never"`,8737still surfaces the relevant prompt category. With `approval_policy = "never"`,
8706there is nothing to review.8738there is nothing to review.
8707 8739
8740In the ChatGPT desktop app, selecting an approved Daybreak model
8741automatically switches the permissions control to **Approve for me** when that
8742mode is available for your account and allowed by organization policy. This
8743also applies when you use the desktop app's `/model` command. If that mode
8744isn't available, the current permission mode stays unchanged. Model selection
8745never overrides managed organization requirements.
8746
8747Before enabling **Full Access** for an approved security model, the
8748ChatGPT desktop app shows a model-specific warning about dangerous actions. The
8749warning recommends **Approve for me** instead and links to
8750[reviewer-policy configuration](#configuration). The warning doesn't restore
8751the sandbox boundary or override organization policy.
8752
8708#### How auto-review works8753#### How auto-review works
8709 8754
8710At a high level, the flow is:8755At a high level, the flow is:
8826To customize the policy, copy the whole default policy wording first, then8871To customize the policy, copy the whole default policy wording first, then
8827iterate based on your individual risk profile.8872iterate based on your individual risk profile.
8828 8873
8874#### Configure an authorized cybersecurity engagement
8875
8876For authorized security work, combine automatic review with a written
8877engagement scope and a least-privilege [permission profile](https://learn.chatgpt.com/docs/permissions).
8878Use an approved lab target, document the actions and engagement window, and
8879keep production systems, unrelated hosts, credentials, and persistent changes
8880out of scope unless explicitly authorized.
8881
8882Both `[auto_review].policy` and `guardian_policy_config` replace your current
8883reviewer policy. They don't merge with policies bundled with your model or
8884managed by your organization. The built-in review instructions and response
8885format still apply. Before using either example, copy the complete current
8886policy, keep every existing rule, and add the rules for your approved work.
8887Replace the uppercase placeholder with that complete policy. If you can't
8888access the current policy, don't override it.
8889
8890The following local `config.toml` template enables review and adds scoped
8891conditions after the existing reviewer policy:
8892
8893```toml
8894approval_policy = "on-request"
8895approvals_reviewer = "auto_review"
8896default_permissions = ":workspace"
8897
8898[auto_review]
8899policy = """
8900PASTE THE COMPLETE ACTIVE REVIEWER POLICY HERE BEFORE USING THIS EXAMPLE.
8901
8902## Environment Profile
8903- Authorized target: lab.example.com.
8904- Approved actions: inspect the target, reproduce authorized vulnerabilities,
8905 and validate fixes within the documented engagement window.
8906
8907## Tenant Risk Taxonomy and Allow/Deny Rules
8908- Allow only actions against the approved target that match the documented
8909 engagement scope and approved actions.
8910- Deny out-of-scope or unknown hosts, production access, credential theft,
8911 persistence, data exfiltration, destructive operations, and policy bypass.
8912- Deny ambiguous actions and high-impact changes until a human explicitly
8913 approves the exact target, action, and side effects.
8914"""
8915```
8916
8917Replace the example target and allowed actions with the actual approved scope.
8918Enforce target restrictions with independent filesystem and network rules;
8919reviewer instructions don't replace those boundaries.
8920
8921Organizations can enforce the same conditions in managed `requirements.toml`:
8922
8923```toml
8924allowed_approval_policies = ["on-request"]
8925allowed_approvals_reviewers = ["auto_review"]
8926allowed_sandbox_modes = ["read-only", "workspace-write"]
8927default_permissions = ":workspace"
8928
8929guardian_policy_config = """
8930PASTE THE COMPLETE ACTIVE REVIEWER POLICY HERE BEFORE USING THIS EXAMPLE.
8931
8932## Environment Profile
8933- Authorized target: lab.example.com.
8934
8935## Tenant Risk Taxonomy and Allow/Deny Rules
8936- Allow only approved actions against the documented engagement target.
8937- Deny out-of-scope hosts, production access, credential theft, persistence,
8938 data exfiltration, destructive operations, and attempts to bypass policy.
8939- Deny ambiguous or high-impact actions until a human explicitly approves the
8940 exact target, action, and side effects.
8941"""
8942
8943[allowed_permission_profiles]
8944":read-only" = true
8945":workspace" = true
8946# ":danger-full-access" is omitted, so it is denied.
8947```
8948
8949`allowed_permission_profiles` controls current permission profiles.
8950`allowed_sandbox_modes` also prevents full access in deployments that still use
8951legacy `sandbox_mode`.
8952
8953Managed `guardian_policy_config` takes precedence over a user's local
8954`[auto_review].policy`. Keep `approval_policy = "on-request"` or another
8955eligible interactive approval policy and keep an enforceable sandbox boundary.
8956With `approval_policy = "never"`, `:danger-full-access`, or `--yolo`, an action
8957can avoid creating the boundary-crossing approval request that review requires.
8958
8959A network destination on the allowlist doesn't trigger review by itself. Add
8960explicit [command rules](https://learn.chatgpt.com/docs/agent-configuration/rules) with
8961`decision = "prompt"`, or configure sensitive MCP tools to require approval,
8962when actions inside the sandbox must still reach the reviewer.
8963
8964See [Cyber Safety](https://learn.chatgpt.com/docs/cyber-safety) for model access, engagement setup, and
8965custom agent workflows, and [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy)
8966for enterprise precedence and supported client versions. For custom API or
8967Agents SDK harnesses, use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution).
8968
8829#### Reduce review volume without weakening security8969#### Reduce review volume without weakening security
8830 8970
8831Auto-review works best when the sandbox already covers your common safe8971Auto-review works best when the sandbox already covers your common safe
8863 9003
8864Source: [Cyber Safety](https://learn.chatgpt.com/docs/cyber-safety.md)9004Source: [Cyber Safety](https://learn.chatgpt.com/docs/cyber-safety.md)
8865 9005
8866[GPT-5.3-Codex](https://openai.com/index/introducing-gpt-5-3-codex/) is the first model we are treating as High cybersecurity capability under our [Preparedness Framework](https://cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf), which requires additional safeguards. These safeguards include training the model to refuse clearly malicious requests like stealing credentials.9006Daybreak Blue and Daybreak Red help approved users move from findings to validated fixes during authorized defensive cybersecurity work. Combine the right model with a controlled environment, a written engagement scope, least-privilege permissions, and automatic review before sensitive actions run.
8867 9007
8868In addition to safety training, automated classifier-based monitors detect signals of suspicious cyber activity and route high-risk traffic to a less cyber-capable model (GPT-5.2). We expect a very small portion of traffic to be affected by these mitigations, and are working to refine our policies, classifiers, and in-product notifications.9008#### Choose the right access tier
8869 9009
8870#### Why we’re doing this9010Start with **Daybreak Blue**, which provides access to frontier models such as GPT-5.6 Sol, for most authorized defensive work, including:
8871 9011
8872Over recent months, we’ve seen meaningful gains in model performance on cybersecurity tasks, benefiting both developers and security professionals. As our models improve at cybersecurity-related tasks like vulnerability discovery, we’re taking a precautionary approach: expanding protections and enforcement to support legitimate research while slowing misuse.9012- Vulnerability discovery and triage.
9013- Secure code review and threat modeling.
9014- Detection engineering and incident response.
9015- Malware analysis in a controlled environment.
9016- Remediation and patch validation.
8873 9017
8874Cyber capabilities are inherently dual-use. The same knowledge and techniques that underpin important defensive work — penetration testing, vulnerability research, high-scale scanning, malware analysis, and threat intelligence — can also enable real-world harm.9018**Daybreak Red** provides separately approved access to purpose-trained cybersecurity models such as GPT-5.6 Cyber for explicitly authorized specialist workflows, including controlled vulnerability reproduction, proof-of-concept or exploit validation, penetration testing, red teaming, and complex system analysis. It isn't the default choice for routine security work, and access isn't available automatically or on every surface.
8875 9019
8876These capabilities and techniques need to be available and easier to use in contexts where they can be used to improve security. Our [Trusted Access for Cyber](https://openai.com/index/trusted-access-for-cyber/) pilot enables individuals and organizations to continue using models for potentially high-risk cybersecurity activity without disruption.9020These advanced workflows can resemble malicious activity without the authorized engagement context. Use the approved model and surface only for systems you own or are explicitly authorized to assess, and keep appropriate human oversight in place.
8877 9021
8878#### How it works9022For example:
8879 9023
8880Developers and security professionals doing cybersecurity-related work or similar activity that could be [mistaken](#false-positives) by automated detection systems may have requests rerouted to GPT-5.2 as a fallback. We expect a very small portion of traffic to affected by mitigations, and are actively working to calibrate our policies and classifiers.9024- **Daybreak Blue:** Review the approved lab repository for authentication weaknesses, rank findings by evidence and impact, and propose patches without accessing external systems.
9025- **Daybreak Red:** Within the approved lab and engagement window, reproduce the documented authentication flaw, validate a minimal proof of concept, and stop before credential access, persistence, or production changes.
8881 9026
8882The latest alpha version of the Codex CLI includes in-product messaging for9027#### Trusted Access for Cyber
8883when requests are rerouted. This messaging will be supported in all clients in
8884the next few days.
8885 9028
8886Accounts impacted by mitigations can regain access to GPT-5.3-Codex by joining the [Trusted Access](#trusted-access-for-cyber) program below.9029[Trusted Access for Cyber](https://openai.com/index/trusted-access-for-cyber/) is the reviewed access program; Daybreak Blue and Daybreak Red are access tiers for approved models. Access depends on approval and provisioning for your specific identity or service, ChatGPT workspace or API organization and project, authorized model, and allowed product surface.
8887 9030
8888We recognize that joining Trusted Access may not be a good fit for everyone, so we plan to move from account-level safety checks to request-level checks in most cases as we scale these mitigations and [strengthen](https://openai.com/index/strengthening-cyber-resilience/) cyber resilience.9031- Individuals can request access through the [individual Trusted Access application](https://chatgpt.com/cyber).
9032- Organizations can submit the [enterprise Trusted Access request form](https://openai.com/form/enterprise-trusted-access-for-cyber/) and coordinate with their OpenAI representative.
8889 9033
8890#### Trusted Access for Cyber9034Submitting an application or completing identity verification doesn't guarantee approval.
9035
9036Applying, verifying your identity, or receiving approval for Daybreak Blue
9037doesn't grant access to Daybreak Red. Specialist access requires separate
9038approval and provisioning.
9039
9040For enterprise access, use the approved workspace, API organization, or project only for your organization's authorized internal work. Don't extend it to external users, third-party customers, externally offered services, downstream product features, or systems outside the approved engagement. If the approved identity, workspace, API organization, project, model, or surface is unclear, stop and confirm it with your OpenAI representative.
9041
9042Trusted Access doesn't automatically grant [Zero Data Retention](https://developers.openai.com/api/docs/guides/your-data#data-retention-controls-for-abuse-monitoring). Confirm any separately approved retention controls for the exact API organization and applicable endpoint before you begin.
9043
9044#### Configure a controlled cybersecurity engagement
9045
9046Trusted Access governs approved model access, but it doesn't configure your environment or enforce your engagement scope. Your team must set up the following isolation, permission, review, and human-oversight controls.
9047
9048#### Isolate the environment
9049
9050Run the engagement in a controlled lab or sandbox. Start without unrestricted internet access, access to sensitive production systems, or access to unrelated infrastructure. Keep secrets, credentials, persistent access, and durable system changes out of reach unless the written engagement explicitly requires and authorizes them.
9051
9052Test filesystem and network boundaries before beginning higher-risk work. Keep the host environment isolated even when the model or reviewer approves an individual action.
9053
9054#### Define and enforce the engagement scope
9055
9056Document the rules of engagement before the model starts. Include:
8891 9057
8892We are piloting "trusted access" which allows developers to retain advanced capabilities while we continue to calibrate policies and classifiers for general availability. Our goal is for very few users to need to join [Trusted Access for Cyber](https://openai.com/index/trusted-access-for-cyber/).9058- Approved target systems, hosts, and environments.
9059- Excluded systems, including production and unrelated infrastructure.
9060- Approved and prohibited actions.
9061- The engagement window and data-handling requirements.
9062- Vulnerability disclosure, patch approval, and maintainer coordination.
9063- Stop conditions and actions that require explicit human approval.
8893 9064
8894To use models for potentially high-risk cybersecurity work:9065Give the agent the relevant scope as task context. This written scope doesn't enforce itself: apply independent filesystem, network, identity, and tool controls to make unauthorized actions impossible whenever practical.
8895 9066
8896- Users can verify their identity at [chatgpt.com/cyber](https://chatgpt.com/cyber)9067Use Codex [permission profiles](https://learn.chatgpt.com/docs/permissions) to create a least-privilege boundary. Choose `:read-only` when the task doesn't require changes, or extend `:workspace` when the engagement needs workspace edits. For example:
8897- Enterprises can request [trusted access](https://openai.com/form/enterprise-trusted-access-for-cyber/) for their entire team by default through their OpenAI representative
8898 9068
8899Security researchers and teams who may need access to even more cyber-capable or permissive models to accelerate legitimate defensive work can express interest in our [invite-only program](https://docs.google.com/forms/d/e/1FAIpQLSea_ptovrS3xZeZ9FoZFkKtEJFWGxNrZb1c52GW4BVjB2KVNA/viewform?usp=header). Users with trusted access must still abide by our [Usage Policies](https://openai.com/policies/usage-policies/) and [Terms of Use](https://openai.com/policies/row-terms-of-use/).9069```toml
9070approval_policy = "on-request"
9071approvals_reviewer = "auto_review"
9072default_permissions = "cyber-lab"
9073
9074[permissions.cyber-lab]
9075description = "Limit security testing to the approved lab and workspace."
9076extends = ":workspace"
9077
9078[permissions.cyber-lab.filesystem]
9079glob_scan_max_depth = 3
9080
9081[permissions.cyber-lab.filesystem.":workspace_roots"]
9082"**/.env*" = "deny"
9083"**/*.pem" = "deny"
9084
9085[permissions.cyber-lab.network]
9086enabled = true
9087# Uncomment only for an approved host that resolves to a private address.
9088# allow_local_binding = true
9089
9090[permissions.cyber-lab.network.domains]
9091"lab.example.com" = "allow"
9092```
9093
9094Replace `lab.example.com` with an approved target. The bounded filesystem scan avoids searching the entire workspace on Linux, WSL, and Windows; increase the depth or use exact deny paths if sensitive files appear deeper. Don't combine permission profiles with legacy `sandbox_mode` settings; follow the [permission-profile configuration guidance](https://learn.chatgpt.com/docs/permissions#define-and-select-a-profile).
9095
9096If the approved lab host resolves to a private address, Codex blocks it by default even when the host is on the allowlist. Set `allow_local_binding = true` only for an explicitly approved private-network engagement, keep the destination allowlist narrow, and review the [local and private network guidance](https://learn.chatgpt.com/docs/permissions#local-and-private-networks). You can also allowlist the exact approved private IP address.
9097
9098Avoid `:danger-full-access` and `--yolo` for cybersecurity engagements. Full Access removes the enforceable sandbox boundary that automatic review depends on. Managed organizations can exclude `:danger-full-access`, limit allowed approval policies, and require automatic review through [enterprise-managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).
9099
9100Before enabling **Full Access** for an approved security model, the
9101ChatGPT desktop app shows a model-specific warning about dangerous actions. The
9102warning recommends **Approve for me** instead and links to
9103[reviewer-policy configuration](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration).
9104The warning doesn't restore the sandbox boundary or override organization
9105policy.
9106
9107#### Review sensitive actions before execution
9108
9109[Auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review) routes eligible sandbox-boundary approval requests to a separate reviewer before the proposed action runs. The reviewer considers the proposed action, bounded task context, and applicable policy, then allows or denies the request. Organizations can customize that policy for their approved targets, prohibited actions, and required human-review conditions.
9110
9111In the ChatGPT desktop app, selecting an approved Daybreak model
9112automatically switches the permissions control to **Approve for me** when that
9113mode is available for your account and allowed by organization policy. This
9114also applies when you use the desktop app's `/model` command. If that mode
9115isn't available, the current permission mode stays unchanged. Model selection
9116never overrides managed organization requirements.
9117
9118For automatic review to run, keep all three controls in place:
9119
91201. Use an interactive approval policy such as `approval_policy = "on-request"`.
91212. Set `approvals_reviewer = "auto_review"`.
91223. Keep an enforceable sandbox or permission-profile boundary.
9123
9124Requests to a target on the network allowlist stay inside the network boundary and don't automatically trigger Auto-review. To review a sensitive command even when its destination is on the allowlist, create an explicit [command rule](https://learn.chatgpt.com/docs/agent-configuration/rules) under `~/.codex/rules/`:
9125
9126```python
9127prefix_rule(
9128 pattern = ["curl"],
9129 decision = "prompt",
9130 justification = "Review requests to the approved cybersecurity target.",
9131)
9132```
9133
9134Restart Codex after adding the rule. With `approvals_reviewer = "auto_review"`, matching commands go to the reviewer before execution. Add corresponding prompt rules for every sensitive command, or use `approval_mode = "prompt"` for individual [MCP tools](https://learn.chatgpt.com/docs/extend/mcp). Actions that require a person's decision still need explicit human approval.
9135
9136Auto-review doesn't inspect routine actions that are already permitted inside the sandbox. With `approval_policy = "never"` or Full Access, a sensitive action might not create a reviewable approval request. Automatic review can make mistakes and doesn't replace isolation, written scope, monitoring, or explicit human oversight.
9137
9138For a scoped policy and organization-wide enforcement, see [Configure an authorized cybersecurity engagement](https://learn.chatgpt.com/docs/sandboxing/auto-review#configure-an-authorized-cybersecurity-engagement).
9139
9140#### Apply the same controls in custom agent workflows
9141
9142If you build with the Responses API, the Agents SDK, or another harness, add review at the tool-execution boundary. Check sensitive proposed actions against the approved engagement scope before execution, route ambiguous or high-risk actions to a person, enforce independent filesystem and network restrictions, keep audit logs, and fail closed if the reviewer or policy is unavailable.
9143
9144Codex Auto-review doesn't automatically protect custom tools or external harnesses. Use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution) for the Agents SDK pattern and the [open-source reviewer policy](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md) as a reference.
9145
9146Codex product-side sandboxing and review are separate from [API cybersecurity checks](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity). API safeguards can return `cyber_policy` errors, and per-user `safety_identifier` values can help limit the impact of a safeguard action.
8900 9147
8901#### False positives9148#### False positives
8902 9149
8903Legitimate or non-cybersecurity activity may occasionally be flagged. When rerouting occurs, the responding model will be visible in API request logs and in with an in-product notice in the CLI, soon all surfaces. If you're experiencing rerouting that you believe is incorrect, please report via `/feedback` for false positives.9150Legitimate cybersecurity or unrelated activity can still trigger a safeguard. If a safeguard blocks, reroutes, or limits a request, inspect the available client notice and request logs. Report suspected Codex false positives through `/feedback` when available. For API access restrictions and appeals, follow the [API cybersecurity checks guidance](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity#appeals).
9151
9152All users remain subject to the [Usage Policies](https://openai.com/policies/usage-policies/) and [Terms of Use](https://openai.com/policies/row-terms-of-use/).
8904 9153
8905### Permissions9154### Permissions
8906 9155
9817 10066
9818The CLI and TypeScript SDK are available as the public10067The CLI and TypeScript SDK are available as the public
9819[`@openai/codex-security`](https://github.com/openai/codex-security) package.10068[`@openai/codex-security`](https://github.com/openai/codex-security) package.
9820Install the package:10069Run the CLI with `npx`:
9821 10070
9822```bash10071```bash
9823npm install @openai/codex-security10072npx @openai/codex-security --help
9824```10073```
9825 10074
9826Running scans requires Codex Security access. For best results, use an account10075Running scans requires Codex Security access. For best results, use an account
14031inspect rendered state, take screenshots, and verify the result of its work in14280inspect rendered state, take screenshots, and verify the result of its work in
14032the page.14281the page.
14033 14282
14034Select ChatGPT and turn on Work in the switcher, or select Codex. Open the Plugins14283Open the **Plugins** tab and install **Browser**. Then ask ChatGPT or Codex to
14035Directory and install **Browser**. Then ask ChatGPT or Codex to use the browser14284use the browser in your task, or reference it directly with `@Browser`.
14036in your task, or reference it directly with `@Browser`.
14037 14285
14038For example:14286For example:
14039 14287
14675 14923
14676#### Set up the Chrome extension14924#### Set up the Chrome extension
14677 14925
14678In the ChatGPT desktop app, open the Plugins Directory and install **Chrome**.14926Open the **Plugins** tab and install **Chrome**. Other Chromium-based browsers
14679Other Chromium-based browsers aren't currently supported. Follow the setup flow14927aren't currently supported. Follow the setup flow to:
14680to:
14681 14928
146821. Install the [Chrome149291. Install the [Chrome
14683 extension](https://chromewebstore.google.com/detail/chatgpt/hehggadaopoacecdllhhajmbjkdcmajg).14930 extension](https://chromewebstore.google.com/detail/chatgpt/hehggadaopoacecdllhhajmbjkdcmajg).
14686 14933
14687#### Start a Chrome task from ChatGPT14934#### Start a Chrome task from ChatGPT
14688 14935
14689After the plugin setup is complete, start a new ChatGPT Work or Codex chat. ChatGPT14936After the plugin setup is complete, start a new ChatGPT Work or Codex chat.
14690can use Chrome automatically when a task needs a website and you're already14937ChatGPT can use Chrome automatically when a task needs a website and you're
14691signed in to Chrome. You can also invoke it directly in a prompt:14938already signed in to Chrome. You can also invoke it directly in a prompt:
14692 14939
14693```text14940```text
14694@Chrome open Salesforce and update the account from these call notes.14941@Chrome open Salesforce and update the account from these call notes.
19116- If your provider advertises OIDC scopes (for example, `openid`, `email`, `profile`) in `scopes_supported` of its `.well-known/oauth-authorization-server` or `.well-known/openid-configuration` document, ChatGPT requests those scopes by default during the OAuth flow.19363- If your provider advertises OIDC scopes (for example, `openid`, `email`, `profile`) in `scopes_supported` of its `.well-known/oauth-authorization-server` or `.well-known/openid-configuration` document, ChatGPT requests those scopes by default during the OAuth flow.
19117- Some identity providers may not enable advertised OIDC scopes by default. Check your provider's configuration settings and make sure every advertised scope is enabled for the OAuth client, whether it uses CIMD, was created manually, or was created through DCR.19364- Some identity providers may not enable advertised OIDC scopes by default. Check your provider's configuration settings and make sure every advertised scope is enabled for the OAuth client, whether it uses CIMD, was created manually, or was created through DCR.
19118 19365
19366#### Support workspace domain restrictions
19367
19368ChatGPT Enterprise workspaces can verify ownership of email domains. When an
19369OAuth-linked plugin provides the user's verified email address, ChatGPT can use
19370the email domain to prevent that corporate identity from linking the plugin in
19371a personal workspace or another workspace outside the organization.
19372
19373To support this protection, configure your authorization server to:
19374
19375- Publish OpenID Connect discovery metadata.
19376- Advertise and enable the `openid` and `email` scopes.
19377- Advertise a UserInfo Endpoint that returns the user's `email` claim and
19378 `email_verified: true`.
19379
19380You can also return these claims in an ID token during the OAuth flow, but the
19381UserInfo Endpoint is required for workspace domain restrictions.
19382
19383The Enterprise workspace must also verify its domain. Your authorization server
19384provides the user identity that ChatGPT compares with verified domains
19385configured for the workspace; it does not verify workspace ownership of a
19386domain.
19387
19119#### Preserve login context during reauthorization19388#### Preserve login context during reauthorization
19120 19389
19121When ChatGPT reauthorizes an existing link, including to request additional OAuth scopes, it may include the prior OIDC ID token in the authorization request as the standard `id_token_hint` parameter. To let users grant additional scopes without starting login from scratch, configure your authorization server to issue an ID token during the original OAuth flow and honor `id_token_hint` during authorization.19390When ChatGPT reauthorizes an existing link, including to request additional OAuth scopes, it may include the prior OIDC ID token in the authorization request as the standard `id_token_hint` parameter. To let users grant additional scopes without starting login from scratch, configure your authorization server to issue an ID token during the original OAuth flow and honor `id_token_hint` during authorization.
20009 20278
20010Skills are the authoring format for reusable workflows. Plugins distribute20279Skills are the authoring format for reusable workflows. Plugins distribute
20011reusable skills and connectors through the universal plugin directory shared20280reusable skills and connectors through the universal plugin directory shared
20012by ChatGPT and Codex. Plugins are available with ChatGPT Work on the web, with20281by ChatGPT and Codex. Plugins work in Chat and Work across ChatGPT on the web,
20013ChatGPT Work and Codex in the ChatGPT desktop app, and through Codex CLI. Use20282desktop, and mobile, in Codex in the ChatGPT desktop app, and through Codex
20014skills to design the workflow itself, then package it as a20283CLI. Use skills to design the workflow itself, then package it as a
20015[plugin](https://developers.openai.com/plugins/build/plugins) when you want20284[plugin](https://developers.openai.com/plugins/build/plugins) when you want
20016other people to install it.20285other people to install it.
20017 20286
20018Standalone skills are available in the ChatGPT desktop app, Codex CLI, and IDE20287Standalone skills are available in the ChatGPT desktop app, Codex CLI, and IDE
20019extension. Skills bundled in plugins are also available through supported20288extension. Skills bundled in plugins are also available in Chat and Work across
20020plugin surfaces, including ChatGPT Work on the web.20289ChatGPT on the web, desktop, and mobile.
20021 20290
20022In the ChatGPT desktop app, open **Skills** in the sidebar to view and explore skills20291In the ChatGPT desktop app, open **Skills** in the sidebar to view and explore skills
20023created across your projects.20292created across your projects.
23471 23740
23472#### Use MCP-backed tools in ChatGPT web23741#### Use MCP-backed tools in ChatGPT web
23473 23742
23474In a hosted ChatGPT Work chat, install a [plugin](https://learn.chatgpt.com/docs/plugins) to use23743In a hosted ChatGPT Work chat, install a [plugin](https://learn.chatgpt.com/docs/plugins) to use its
23475its bundled connectors and remote MCP tools. Workspace administrators can23744bundled connectors and remote MCP tools. After installation, Chat and Work can
23476control which plugins and tools are available.23745use those tools. Workspace administrators can control which plugins and tools
23746are available.
23477 23747
23478ChatGPT web doesn't read local Codex configuration files or expose the local23748ChatGPT web doesn't read local Codex configuration files or expose the local
23479Codex command menu. Browse and manage available tools through **Plugins** in23749Codex command menu. Open the **Plugins** tab to browse and manage available
23480ChatGPT Work.23750tools.
23481 23751
23482#### Configure with the CLI23752#### Configure with the CLI
23483 23753
24324entry points to and restart the ChatGPT desktop app so the local install picks24594entry points to and restart the ChatGPT desktop app so the local install picks
24325up the new files.24595up the new files.
24326 24596
24327#### Share a local plugin with your workspace24597#### Publish a local plugin to your workspace
24598
24599You must be a workspace admin to publish a plugin to your workspace.
24328 24600
24329After you create a plugin, add it from the ChatGPT desktop app. Select ChatGPT24601After you create and add a plugin, you can publish it to your ChatGPT workspace:
24330and switch to Work mode, or select Codex, then open **Plugins**. You can then
24331share it with other members of your ChatGPT workspace.
24332 24602
243331. Open **Plugins** in the ChatGPT desktop app.246031. Go to [ChatGPT Plugins](https://chatgpt.com/plugins).
243342. Go to **Created by you** and open the plugin details page.246042. Select **Personal**.
243353. Select **Share**.246053. Find the plugin you want to publish and open its three-dot menu.
243364. Add workspace members or workspace groups, or copy a share link.246064. Select **Publish**.
243375. Choose who has access, then send the invitation or link.246075. Specify the workspace roles that should have access to the plugin.
24338 24608
24339People you share with can find the plugin under **Shared with you** in the24609Publishing a local plugin to your workspace doesn't publish it to the universal
24340Plugins Directory. Sharing a local plugin with your workspace doesn't publish24610public Plugins Directory shared by ChatGPT and Codex. Workspace-published
24341it to the universal public Plugins Directory shared by ChatGPT and Codex.24611plugins stay within your workspace and organization boundary; accounts that
24342Shared plugins stay within your workspace and organization boundary; accounts24612aren't signed in to that workspace can't access them. Use a marketplace for
24343that aren't signed in to that workspace can't access them. Use groups when a24613repo or CLI distribution, and publish to your workspace when you want to make a
24344team or role should share the same plugin access. Use a marketplace when you24614plugin available to selected roles.
24345want repo or CLI distribution, and use workspace sharing when you want selected
24346teammates to install a plugin from the ChatGPT desktop app.
24347 24615
24348Workspace admins can disable plugin sharing from cloud-managed requirements by24616Workspace admins can disable workspace plugin publishing through cloud-managed
24349adding `features.plugin_sharing = false` to `requirements.toml`:24617requirements by adding `features.plugin_sharing = false` to `requirements.toml`:
24350 24618
24351```toml24619```toml
24352features.plugin_sharing = false24620features.plugin_sharing = false
26732 and tool metadata.27000 and tool metadata.
267338. Fix server, skill, or metadata issues, deploy the fix, then scan again.270018. Fix server, skill, or metadata issues, deploy the fix, then scan again.
26734 27002
27003To support workspace domain restrictions for a plugin that uses OAuth,
27004configure the authorization server to advertise a UserInfo Endpoint that
27005returns the user's `email` claim and `email_verified: true`. Before submitting,
27006confirm that the provider also advertises and enables the `openid` and `email`
27007scopes. You can also return these claims in an ID token, but the UserInfo
27008Endpoint is required for workspace domain restrictions. If the provider doesn't
27009support these requirements, work with the provider to add support. See
27010[Support workspace domain restrictions](https://developers.openai.com/plugins/build/auth#support-workspace-domain-restrictions).
27011
26735#### Template MCP server URLs27012#### Template MCP server URLs
26736 27013
26737Most plugins should use **Universal**. Template MCP server URLs are available27014Most plugins should use **Universal**. Template MCP server URLs are available
27465directory, so the same public plugins are discoverable from their supported27742directory, so the same public plugins are discoverable from their supported
27466surfaces.27743surfaces.
27467 27744
27468Plugins are available with ChatGPT Work on the web and with ChatGPT Work or27745Plugins work in Chat and Work across ChatGPT on the web, desktop, and mobile,
27469Codex in the ChatGPT desktop app. Codex27746and in Codex in the ChatGPT desktop app. Codex CLI also has a plugin browser
27470CLI also has a plugin browser for Codex environments. Plugins aren't available27747for Codex environments. The IDE extension doesn't support plugins.
27471in Chat, the IDE extension, or mobile.
27472 27748
27473In the ChatGPT desktop app, select ChatGPT and turn on Work in the switcher, or select27749On mobile, you can use plugins available to your account in Chat or Work.
27474Codex. Then open **Plugins** to browse, install, and use plugins. Installed
27475plugins can add skills, connectors, and MCP tools to new chats.
27476 27750
27477In ChatGPT web, turn on Work in the switcher and open **Plugins** to browse, install, and27751Open the **Plugins** tab to browse and install plugins. After installation, you
27478use plugins. A plugin can prompt you to connect an external service before its27752can use plugins in Chat or Work in ChatGPT, or in Codex. Installed plugins can
27479tools become available.27753add skills, connectors, and MCP tools to new chats.
27754
27755Open the **Plugins** tab to browse and install plugins. After installation, you
27756can use plugins in Chat or Work. A plugin can prompt you to connect an external
27757service before its tools become available.
27480 27758
27481In Codex CLI, enter `/plugins` to open the plugin browser. Install a plugin from27759In Codex CLI, enter `/plugins` to open the plugin browser. Install a plugin from
27482a configured marketplace, then start a new session before using its bundled27760a configured marketplace, then start a new session before using its bundled
27528 27806
27529#### Universal plugin directory27807#### Universal plugin directory
27530 27808
27531ChatGPT and Codex use the same public plugin catalog. To browse and install27809ChatGPT and Codex use the same public plugin catalog. On the web or in the
27532plugins from a supported graphical surface:27810ChatGPT desktop app, open the **Plugins** tab to browse and install plugins.
27533
27534- On the web, turn on Work in the switcher and open **Plugins**.
27535- In the ChatGPT desktop app, select ChatGPT and turn on Work in the switcher, or select
27536 Codex. Then open **Plugins**.
27537 27811
27538The Plugins Directory organizes plugins into tabs:27812The Plugins Directory organizes plugins into tabs:
27539 27813
27611 27885
27612#### How permissions and data sharing work27886#### How permissions and data sharing work
27613 27887
27614On ChatGPT web, ChatGPT Work chats use the workspace permissions and27888In ChatGPT on the web, Chat and Work use the workspace permissions and tools
27615tools available to that chat. Connectors still require their own sign-in27889available to that chat. Connectors still require their own sign-in and access.
27616and access.
27617 27890
27618When a plugin capability runs through a Codex host, the host's [sandbox and27891When a plugin capability runs through a Codex host, the host's [sandbox and
27619approval policy](https://learn.chatgpt.com/docs/agent-approvals-security) applies.27892approval policy](https://learn.chatgpt.com/docs/agent-approvals-security) applies.
30828directory. You can have the same scheduled task run on more than one project.31101directory. You can have the same scheduled task run on more than one project.
30829 31102
30830Scheduled tasks created with ChatGPT Work on the web, or with ChatGPT Work or31103Scheduled tasks created with ChatGPT Work on the web, or with ChatGPT Work or
30831Codex in the desktop app, can use plugins. Scheduled tasks can also use31104Codex in the desktop app, can use plugins. Scheduled tasks can also use skills.
30832skills. To keep scheduled tasks maintainable and shareable across teams, use31105To keep scheduled tasks maintainable and shareable across teams, use
30833[skills](https://learn.chatgpt.com/docs/build-skills) to define the action and provide tools and context.31106[skills](https://learn.chatgpt.com/docs/build-skills) to define the action and provide tools and context.
30834Select or invoke a specific skill in the task prompt when the workflow shouldn't31107Select or invoke a specific skill in the task prompt when the workflow shouldn't
30835rely on automatic tool selection.31108rely on automatic tool selection.
316653. Test it with non-sensitive data and the least access it needs.319383. Test it with non-sensitive data and the least access it needs.
316664. Record who owns re-review and retirement.319394. Record who owns re-review and retirement.
31667 31940
31668Plugins are available with ChatGPT Work on the web, with ChatGPT Work and Codex31941Plugins work in Chat and Work across ChatGPT on the web, desktop, and mobile,
31669in the ChatGPT desktop app, and through the Codex CLI plugin browser. They31942in Codex in the ChatGPT desktop app, and through the Codex CLI plugin browser.
31670aren't available in Chat, the IDE extension, or mobile.31943They aren't available in the IDE extension.
31671ChatGPT and Codex share one universal public plugin directory; workspace31944ChatGPT and Codex share one universal public plugin directory; workspace
31672controls determine which of those plugins members can access.31945controls determine which of those plugins members can access.
31673 31946
33262marketplaces or their plugins at runtime.33535marketplaces or their plugins at runtime.
33263 33536
33264These source restrictions apply only where a local client supports plugin33537These source restrictions apply only where a local client supports plugin
33265marketplace operations: ChatGPT Work and Codex in the desktop app, and33538marketplace operations: ChatGPT and Codex in the desktop app, and Codex CLI.
33266Codex CLI. They don't add plugins to Chat, the IDE extension, or mobile.33539They don't control plugin use in ChatGPT on the web or mobile, and they don't
33540add plugins to the IDE extension.
33267 33541
33268#### Managed defaults (`managed_config.toml`)33542#### Managed defaults (`managed_config.toml`)
33269 33543
33371available through plugin controls and configure connector access before members33645available through plugin controls and configure connector access before members
33372can use the connector-backed capability.33646can use the connector-backed capability.
33373 33647
33374Plugins are available with ChatGPT Work on the web, and with ChatGPT Work and Codex33648Plugins work in Chat and Work across ChatGPT on the web, desktop, and mobile,
33375in the ChatGPT desktop app, and through the Codex CLI plugin browser.33649in Codex in the ChatGPT desktop app, and through the Codex CLI plugin browser.
33376Availability on those surfaces doesn't make plugins available in Chat,33650They aren't available in the IDE extension.
33377the IDE extension, or mobile.
33378 33651
33379For the complete administration model, see33652For the complete administration model, see
33380[Roles and workspace permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).33653[Roles and workspace permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).
33677transfer ChatGPT workspace ownership, sharing, role assignments, plugin33950transfer ChatGPT workspace ownership, sharing, role assignments, plugin
33678installation state, or connector authorization.33951installation state, or connector authorization.
33679 33952
33680Plugins are available with ChatGPT Work on the web, with ChatGPT Work and Codex33953Plugins work in Chat and Work across ChatGPT on the web, desktop, and mobile,
33681in the ChatGPT desktop app, and through the Codex CLI plugin browser. They33954in Codex in the ChatGPT desktop app, and through the Codex CLI plugin browser.
33682aren't available in Chat, the IDE extension, or mobile.33955They aren't available in the IDE extension.
33683Those supported surfaces draw public plugins from one universal directory33956Those supported surfaces draw public plugins from one universal directory
33684shared by ChatGPT and Codex.33957shared by ChatGPT and Codex.
33685 33958
