Claude MAX vs Codex: The Real Operating Model

How We Got Here

Tuesday, 11 PM. Six active projects. Claude MAX hits the weekly wall – "Usage limit reached. Try again in a few hours." Except it's not hours. It's two days until the quota renews.

We'd been meaning to benchmark Codex anyway. This was the push.

Spun up Codex with GPT-5.3 – their most capable agentic coding model, released February 4, 2026. Handed off three of them to Codex: a security investigation with protocol analysis, a game dev MVP needing proof-of-concept capture, and a CLI tool with a live outreach campaign. Real work. Active codebases. Deadlines.

The 5-hour Codex limit exhausted in under 2 hours. GPT-5.3 burns tokens fast. So we slowed down – mixed in GPT-5.1 and 5.2 for lighter tasks, kept 5.3 for the heavy lifts. Built a workflow across all three models to stretch the budget.

Then we looked at the results.

Claude Opus 4.6: ~95% accuracy on production tasks. Codex with GPT-5.3: ~35%. The cheaper models were worse. The expensive model was still wrong two-thirds of the time.

That gap is not a rounding error. It is the entire conversation.

The Accuracy Gap

Codex's failures fall into three categories.

Structural misunderstanding. Codex reads the codebase, generates a plan that sounds plausible, then writes code that violates the project's actual patterns. It sees a middleware chain and bolts on a new handler that breaks the request lifecycle. It spots a database abstraction and writes raw SQL queries alongside it. The plan looks good. The code doesn't work.

Silent regressions. Codex modifies the target function correctly but breaks three other functions that depend on the same interface. Claude catches these dependencies. Codex doesn't – or catches them 40% of the time at best.

Confidence without correctness. Codex commits harder to wrong answers. When it generates broken code, it generates it with beautiful formatting, clear comments, and a persuasive explanation of why it works. The code reviews well. It just doesn't run.

Here are the public benchmarks for context:

Benchmark	Claude Opus 4.6	GPT-5.3-Codex
SWE-bench Verified	~80.8%	~75%*
Terminal-Bench 2.0	~70%	~77.3%

*GPT-5.3-Codex SWE-bench score is estimated from OpenAI's release claims. No independent verification at time of writing.

These numbers look close. They're not what matters. Synthetic benchmarks test isolated problems with clean specifications. Production work has ambiguous requirements, implicit constraints, and codebases with ten years of accumulated decisions. That's where the 95% vs 35% gap lives – in the messy reality of actual engineering.

Process without accuracy is performance art.

The Orchestration Problem: What Codex Drops

Writing code is one thing. Running a project is another. We tested both tools across three active projects simultaneously – a security investigation, a game dev MVP, and a CLI tool with an outreach campaign. Each project had multi-track execution: code tasks, operational tasks, security-sensitive tasks, documentation. The kind of workload a real engineering workflow produces.

Codex wrote code. It dropped everything else.

Project 1: Security Investigation

Claude handed off a complex protocol reverse-engineering task on a live target server. Constraints included VM-only execution, VPN rotation, credential handling with shell-expansion pitfalls, and strict OPSEC procedures.

Codex ran the determinism probes. Six runs, fourteen reports, proper file storage. The raw analysis was competent.

Then it hit a wall. Deeper security work – the kind requiring judgment about engagement tiers, exploit feasibility assessment, and coordinated operational decisions – Codex declined. Not failed. Declined. It refused to engage with security-sensitive fields that Claude had been working on for weeks.

The handoff back to Claude listed "continue protocol branch discrimination" as the next step. Codex had done the safe, repeatable part. It left the actual thinking on the table.

Project 2: Game Dev MVP

Claude handed off a proof-of-concept capture workflow. The task had two parts: build Docker images for the mission flow, then run the Match-Orchestrator-driven capture to produce the actual deliverable.

Codex built the images. Ran the manual preflight. Proved the individual steps worked.

Then stopped.

The orchestrator-driven capture – the actual deliverable – was listed as a "current blocker" in the handoff back to Claude. Codex completed the preparation but not the execution. It built the stage and forgot the performance.

Project 3: CLI Tool

This one is the clearest. Claude handed off two explicit tracks:

Product track: Fix config bugs, add URL-based generation, improve search failures, add platform integrations.
Campaign track: Execute a batch of time-sensitive outreach tasks using the tool's own pipeline.

Codex completed the product track. Five solid bug fixes. Tests passing. Binary rebuilds clean. Good code.

The campaign track? Zero. Not attempted. Not mentioned. Not declined with explanation. The codex-to-claude handoff lists five completed code tasks and three "Immediate Next Actions for Claude" – all code tasks. The outreach tasks that were explicitly requested in the kickoff brief simply vanished from the scope.

The Editing Test

We also handed Codex an editorial task: take a technical comparison draft and polish it for publication. Match the house style. Cut the filler. Ship a clean Markdown file.

Fifteen exchanges. That's how many it took to go nowhere.

The draft had two filler sections – an "Operator Checklist" and a "Next Steps" block that read like a project management template. We told Codex to cut them. It rewrote them instead. We told it again. It suggested three alternative formats for the same filler. We said the sections were pointless. It apologized, kept them, and added a TL;DR nobody asked for.

When told to adopt the publication's voice – direct, opinionated, data-first – Codex produced lines like: "To keep this comparison honest, adopt a repeating operating cadence. These rituals tie the narrative back to the platform behaviors described in the main body." Corporate consulting prose. The opposite of what was asked.

Each exchange followed the same loop: clear instruction, apology, same mistake with different words. When pushed harder, Codex started offering menus – "Pick one: (1) I can treat this as near-final, (2) We can add formatting, (3) You point out areas" – instead of doing the work. Fifteen rounds of that.

Claude handled the same editorial task in one pass. Read the draft, identified the bias, cut the filler, rewrote the voice, added the missing sections. Done.

The pattern holds beyond code. Codex can't edit. It can't follow editorial direction. It can't distinguish filler from substance. It generates polished-sounding advice that completely misses the point – the same "confidence without correctness" failure mode, applied to prose instead of code.

The Pattern

Codex writes code. That's it.

Security-sensitive work? Declined. Multi-step orchestration? Incomplete. Non-code operational tasks? Silently dropped. Editorial work? Fifteen exchanges to produce the same mistake with better apologies. Even within completed code, Codex forgot to commit files and required multiple iterations to produce what Claude generates in one pass.

147 skill files. 61 agent configurations. 62 command primitives. And it can't cut a filler section when you tell it to.

Economics: Tracking Every Cent of Broken Code

The original version of this article – written by Codex, which should tell you something – framed Claude MAX's opaque billing as a weakness and Codex's transparent pricing as a strength. Let me reframe that.

The Pricing Table

Model	Input $/M	Output $/M
Claude Opus 4.6	$5.00	$25.00
Claude Sonnet 4.5	$3.00	$15.00
GPT-5.1-Codex	$1.25	$10.00
GPT-5.3-Codex	~$1.75*	~$14.00*
Claude MAX	$200/month flat	–

*GPT-5.3-Codex pricing estimated from observed API billing. OpenAI has not published official per-token rates at time of writing.

Codex is cheaper per token. That is true and completely irrelevant.

The Accuracy Tax

When Codex produces broken code 65% of the time, someone has to fix it. That someone is an engineer who costs $75-150/hour.

A typical coding task takes 20 minutes with a working AI assistant. When the output is broken, debugging and rewriting takes 45-90 minutes. Let's be conservative and call it 45 minutes of human rework per failed task.

Metric	Claude	Codex
Tasks per month	200	200
Success rate	95%	35%
Failed tasks needing rework	10	130
Rework time per failure	45 min	45 min
Total rework hours	7.5	97.5
Rework cost at $100/hr	$750	$9,750
Tool cost	$200	~$775 (API)
Total cost	$950	$10,525

You can track every cent with Codex and still ship broken code. Claude costs $200/month and works.

Cost Simulation at Scale

The Codex-written version of this article presented an API cost comparison: 200M input tokens and 40M output tokens per month, showing Codex at $775 and Claude at $1,500. That math is correct in isolation.

Now add the human cost.

At 200 tasks per month with the accuracy rates from our testing, Claude's total cost of ownership is roughly $950/month. Codex's is over $10,000. The cheaper tokens produce more expensive outcomes.

Agent Architecture

Both platforms support agent definitions and tool routing. The Codex-written version of this article spent considerable ink on Codex's 147 skill files, 61 agent configurations, and 62 command primitives. It described Claude as having "20 agents" and "only 10 skill files."

Those numbers are accurate. They're also beside the point.

Claude Code ships with --permission-mode plan, --permission-mode delegate, default, acceptEdits, and bypassPermissions. Session management includes --continue, --fork-session, and --resume. Tool access is controlled through --allowed-tools and --disallowed-tools.

Codex ships with codex exec, codex review, codex apply, and codex cloud. Skills live in AGENTS.md and SKILL.md manifests. The CLI exposes --sandbox and --ask-for-approval for execution control.

Here's the difference: Codex has 147 skill files that produce code you have to fix. Claude has 20 agents that produce code you can ship.

Skill count is not a feature. It is configuration overhead. Every skill file needs maintenance, versioning, and auditing. If the underlying model gets the answer right 95% of the time, you need fewer orchestration layers. If it gets the answer right 35% of the time, no amount of skill files will save you.

MCP: Same Protocol, Same Surface

Both tools support Model Context Protocol. In our workspace:

Claude: 19 MCP servers configured via ~/.claude/settings.json
Codex: 19 registered servers, 4 currently enabled (chroma, shodan, virustotal, linear)

Codex provides codex mcp list for status visibility. Claude requires checking JSON config or using CLI flags (--mcp-config, --strict-mcp-config).

That's a minor UX difference. MCP is a protocol, not a differentiator. Both platforms consume the same server definitions. Both pass tool calls through the same JSON-RPC interface. The server doesn't know or care which client called it.

Guardrails: Controlling What the Agent Touches

Codex has more granular runtime controls. Credit where due.

Codex

--sandbox {read-only, workspace-write, danger-full-access}
--ask-for-approval {untrusted, on-failure, on-request, never}
--full-auto as shorthand for write access + approval on request

Claude

--permission-mode plan (agent proposes, human approves)
--permission-mode delegate (agent executes autonomously)
Tool allow/deny lists in .claude/settings.json
--max-budget-usd for session cost caps

Codex wins on granularity. The sandbox tiers map cleanly to least-privilege principles. The approval modes give operators fine control over when the agent pauses for human review. For compliance-heavy environments, this matters.

But guardrails control what the agent touches. Accuracy controls what it produces.

A read-only sandbox means nothing if the code the agent writes is wrong. An on-request approval policy means nothing if the reviewer can't tell the output is broken because it looks correct. Codex's guardrails protect the filesystem. They don't protect the codebase from bad code that passes review.

Claude's simpler model – plan mode for research, delegate mode for execution – works because the underlying model gets the answer right. You need fewer safety nets when the trapeze artist doesn't fall.

Telemetry: Perfect Audit Trails for Imperfect Code

Feature	Claude	Codex
History log	`~/.claude/history.jsonl`	`~/.codex/history.jsonl`
Checkpoints	`~/.claude/checkpoints/`	`~/.codex/checkpoints/`
Session stats	`~/.claude/stats-cache.json`	Per-session in checkpoints
Cost tracking	`/cost`, `/usage`, `--max-budget-usd`	Explicit API billing
Session replay	`--continue`, `--resume`, `--fork-session`	`codex resume --session-id <id>`
JSON output	`--print --output-format json`	Checkpoint includes `tools`, `prompt`, `sandbox`
MCP audit	Config in `settings.json`	`codex mcp list` with status

Codex checkpoints include tools, prompt, scale, and sandbox fields. You can trace the exact moment it escalated from read-only to workspace-write. That's good telemetry design.

Claude logs permissionMode, sessionId, and tool-call allow/block status. Less granular, but functional for audit.

For compliance teams that need to answer "what did the agent do and why" – both platforms provide sufficient artifacts. Codex's are more structured. Claude's produce better code to audit.

Which Stack Wins?

Claude wins. Not close.

Here's the full scorecard:

Dimension	Claude	Codex	Winner
Accuracy on real tasks	~95%	~35%	Claude
Orchestration completeness	Full scope	Code-only	Claude
SWE-bench Verified	~80.8%	~75%*	Claude
Terminal-Bench 2.0	~70%	~77.3%	Codex
Per-token API cost	Higher	Lower	Codex
Total cost of ownership	Lower	Higher	Claude
Guardrail granularity	Simpler	More granular	Codex
Telemetry structure	Functional	More detailed	Codex
MCP support	Equivalent	Equivalent	Tied
Security-sensitive tasks	Yes	Declined	Claude
Non-code task execution	Yes	Silently dropped	Claude
Code you can ship	Yes	Rarely	Claude

Codex wins on process. Sandbox tiers, approval policies, skill manifests, telemetry granularity – it's a better-engineered control plane. If you're building a compliance framework around AI-assisted development, Codex gives you more knobs to turn.

Claude wins on the only thing that matters: the code works. And the non-code work gets done. And the security-sensitive tasks don't get silently declined.

The Codex-written version of this article concluded that "the most resilient teams run both." That's diplomatic nonsense. The most resilient teams use the tool that produces correct output and doesn't drop half the scope. They don't maintain two toolchains so they can have prettier audit logs for broken code.

Where Codex Makes Sense

Codex has two legitimate use cases:

Compliance theater. If your primary concern is proving every AI action was sandboxed and approved, Codex's policy infrastructure is superior. Terminal-Bench 2.0 scores suggest it handles terminal-heavy DevOps tasks well.
Isolated coding tasks. When requirements are crystal clear, scope is narrow, and you don't need the agent to think beyond the immediate code change – Codex is a competent code generator. It wrote five solid bug fixes for a CLI tool in one of our test projects. It just couldn't execute the outreach campaign that was the actual point of that project.

For everything else – production engineering, multi-track orchestration, security work, ambiguous requirements, and the full spectrum of tasks that make up real software development – Claude is the only serious option.

The Central Argument

Process without accuracy is performance art.

You can have 147 skill files, three sandbox tiers, four approval modes, structured checkpoint telemetry, and a perfect compliance audit trail. If the model produces wrong code 65% of the time and drops non-code tasks entirely, you've built a sophisticated factory for manufacturing defects.

Claude produces working code. It completes full project scopes. It doesn't flinch at security work.

That's the article. That's the comparison. Everything else is set dressing.

Sources (checked 2026-02-12)

Pricing:

Anthropic: https://www.anthropic.com/pricing
OpenAI: https://openai.com/chatgpt/pricing/
OpenAI Codex pricing: https://developers.openai.com/codex/pricing

Benchmarks:

SWE-bench Verified leaderboard: https://www.swebench.com
Terminal-Bench 2.0: https://tbench.ai/leaderboard/terminal-bench/2.0 (Feb 2026 results)
GPT-5.3-Codex release: OpenAI blog, Feb 4-5, 2026

Platform documentation:

Claude Code: https://www.anthropic.com/claude-code
Claude Code usage limits: https://support.anthropic.com/en/articles/12096837-what-are-the-usage-limits-for-claude-code
Claude MAX plan: https://support.anthropic.com/en/articles/11403636-max-plan-usage-limits
Codex CLI reference: https://developers.openai.com/codex/cli/reference/
Codex security: https://developers.openai.com/codex/security
Codex agents: https://developers.openai.com/codex/agents
Codex MCP: https://developers.openai.com/codex/mcp

Local verification:

codex --help, codex mcp list, claude --help, claude --version
~/.claude/settings.json, ~/.codex/skills, ~/.claude/agents
.agent/handoff/ directories across three active projects

Share this article

Help spread the word about security best practices.