OpenAI quietly relaunches Codex Cloud, its remote coding agent service
Day 3 (encore)/ We silently re-shipped codex cloud. It’s pretty good now
Context
Developers can hand coding work to agents running in the cloud, and those agents can now reach private services over Tailscale.
Codex Cloud runs Codex sessions that are not tied to any device and work on your GitHub repositories. According to Tailscale, it is rolling out to paid ChatGPT accounts (Plus and higher) over time and supports Tailscale as its only VPN provider for now. Tibo, who works on Codex at OpenAI, posted it as an encore to the third day of OpenAI's announcements.
Deep dive
Tibo posted early on October 8 that the team had shipped Codex Cloud again without fanfare and that it is "pretty good now." The post became one of the most liked AI posts of the morning, with close to a thousand replies.
Tailscale described how the product works in an October 6 blog post. Users pick Work in, then Cloud, on a new task in the ChatGPT web or desktop app, choose GitHub repositories to check out, and create a cloud environment. In that environment's VPN settings they can select Tailscale and supply an auth key, so cloud tasks can reach internal APIs and test services on a private network.
Tailscale says it did not work with OpenAI on the integration. Its CEO Avery Pennarun wrote that there was no partnership agreement or custom API and that OpenAI "just built it using the same Tailscale that everyone else gets."
There are limits. Tailscale says Codex Cloud can reach only HTTP and HTTPS destinations, plus arbitrary TCP through an HTTP CONNECT proxy. It needs IPv4 addresses, does not support MagicDNS, UDP or ICMP, and does not accept inbound connections or SSH. Because Codex could reach nearly everything on a network by default, Tailscale advises tagging agents, using grants, keeping key expiry and turning on flow logs.
What to expect next
Tailscale says the rollout to paid ChatGPT plans happens over time, so availability will widen gradually. OpenAI has not published a separate launch announcement or pricing for the relaunch.
Watch for official OpenAI documentation, for VPN providers beyond Tailscale, and for whether the current network limits such as no SSH, no UDP and no inbound connections are lifted. Security teams will also need to decide how much of their private networks cloud coding agents should be allowed to reach.