OpenAI updated Codex Cloud with reusable cloud environments that teams can share in Enterprise, while legacy workflows continue during the transition.
OpenAI has updated the Codex Cloud service, enabling the coding agent Codex to perform development work on OpenAI-managed cloud computers, and supporting the creation of a reusable cloud development environment that can then be applied directly to subsequent tasks.[1] This environment can be preconfigured with code repositories, development tools, and dependency packages, and developers can prepare it from the desktop app or web app and then publish it so later tasks use the same settings.[1]
This update also makes team collaboration a core design element. ChatGPT Enterprise can share the same development environment with authorized members, allowing them to run their own Codex tasks with identical settings.[1] However, each task still retains its own working files and code changes, and members do not directly access modifications that have not yet been committed to the version control system.[1]
From an architectural perspective, the change in Codex Cloud is not about moving tasks out of the cloud, but about strengthening cloud task environment lifecycle management.[1] The old version tended to create a separate environment for each task, while the new version allows a prepared environment to be published and reused repeatedly, effectively consolidating the repository, toolchain, dependencies, and some settings into a reproducible working baseline.[1]
This design can reduce environment drift, shorten task startup time, and help teams maintain more consistent development conditions.[1] At the same time, it raises the importance of environment-level configuration, because files, credentials, or connection settings placed in a shared environment may give team members access to shared resources.[1]
OpenAI also preserves the virtual machine state for individual tasks, allowing developers to return later and continue unfinished work in the original task; new tasks create a separate workspace.[1] By default, the virtual machine state is retained for recovery for up to 7 days after the last action is started or the task is resumed, which means temporary task state and rollback capability are now explicitly part of the cloud development workflow.[1]
The shared-permission design for Enterprise workspaces also has clear boundaries: authorized members can use the shared environment, but that does not give them access to other users’ Codex tasks, nor does it automatically grant them permission to modify the environment.[1] In addition, credentials in the Personal vault are not copied to other members, showing that OpenAI is trying to separate personal credentials from shared environments to reduce lateral exposure risk.[1]
It is also noteworthy that OpenAI labels the previous Codex cloud environment as Codex Cloud (Legacy), and during the transition, code review, security review, and the existing Linear and GitHub integrations continue to use the legacy workflow.[1] This indicates that, although the new version has been introduced, the overall ecosystem is still operating in parallel tracks, and migration pace will affect operational consistency and management costs for enterprises.[1]
This update mainly affects workspaces that use Codex Cloud, with the shared-environment capability in Enterprise carrying the greatest organizational risk and governance value.[1] For development teams, this makes standardized environments easier to implement; for security teams, it means environment sharing, credential configuration, and permission separation need to be reviewed again.[1]
If a team places internal tools, connection settings, or sensitive credentials into a shared environment, members may still be able to access common resources through the shared environment even if they cannot directly see each other’s task content.[1] Therefore, the risk is not cross-reading of tasks, but the expanded attack surface created by shared baseline settings.[1]
In addition, because the legacy Codex Cloud (Legacy) still handles Code Review, Security Review, and existing GitHub and Linear integrations during the transition, organizations will need to maintain two workflows at the same time in the short term.[1] Without governance, this dual-track operation can easily lead to inconsistent settings, fragmented audits, and blurred accountability boundaries.[1]
For cloud development environments like this, the core principle is to treat a shared environment as infrastructure that multiple people can access, not as a private sandbox for a single developer.[1] It is recommended to classify files, credentials, and connection settings in the environment first, and avoid placing highly sensitive resources directly into shared configurations.[1]
Enterprises should also separate permissions for environment creation, publishing, sharing, and modification, and grant administrative rights only to the members who need them in order to reduce misconfiguration and over-authorization.[1] At the same time, the boundary between Personal vault and shared environments should be confirmed to avoid assuming that personal credentials automatically isolate all shared resources.[1]
For workspaces still using Codex Cloud (Legacy), it is advisable to inventory which workflows still depend on the older integrations and then plan the migration order to avoid control gaps caused by parallel old and new environments.[1] Before and after migration, traceability of task history and configuration records should be preserved so that security audits and development operations can map to the same asset lineage.[1]
Finally, shared environments should be included in routine inspections, with a focus on checking for unnecessary connection settings, expired credentials, or files unrelated to the team.[1] This can reduce the likelihood of abuse of the shared baseline and prevent a single environment configuration from becoming a shared risk for the entire workspace.[1]