OpenAI Lets Codex Drive Your Mac While It Sits Locked — A Background Agent in Your Pocket

OpenAI quietly pushed one of the most consequential updates to Codex yet on May 21, 2026. With version 26.519 of the Mac desktop app, Codex can now operate any app you have approved — clicking, typing, navigating menus, reading the clipboard — even when the screen is off and the machine is locked. OpenAI calls it “Locked Use,” and it is the clearest sign so far that the company sees Codex less as an IDE assistant and more as an always-on personal worker that happens to live on your laptop.

The trigger is the ChatGPT mobile app. With your Mac signed in and connected, you can fire off a multi-step task from your phone — “refactor that PR, run the tests, then file the build report in Linear” — and Codex will wake the Mac, run through your approved apps, and stop when it is done. Coverage from MacRumors, Macworld and The Mac Observer framed it as the moment Codex jumped from a desktop tool to a remote-controlled agent, and reactions from developers on X were a mix of giddy and uneasy.

The capability ships with a stack of safeguards that look designed to pre-empt that unease. Each app has to be explicitly allowed; Terminal, Codex itself and system admin prompts are excluded by default; authorization tokens are short-lived; any local keystroke or trackpad input forces an immediate relock; and the display stays covered while the agent works. Codex 26.519 also brings Appshots — a double-tap on either Command key grabs the foreground window into the conversation — and promotes Goal Mode to general availability across the desktop app, the IDE extension and the CLI, letting a single objective span hours or days. The feature is rolling out everywhere except the EU, UK and Switzerland at launch.

Strategically, Locked Use lands in the middle of a fight OpenAI is having with Anthropic for the “agent runtime” layer of the stack. Anthropic has been pushing Claude Code as the default coding agent inside enterprises like KPMG and PwC, while OpenAI has spent May 2026 wiring Codex into AWS Bedrock, the Dell on-prem stack and the ChatGPT mobile app. Letting that same agent run unattended on a locked laptop closes the last gap: developers no longer have to leave their Mac open and screensaver-disabled to use Codex like an employee.

The harder question — and one OpenAI sidesteps in its release notes — is what it means for your Mac to be running a model-driven agent against your real apps while you sleep. The safeguards are real, but the threat surface (clipboard access, file-system reach, app-level mutations) is now permanently larger. For developers, Locked Use is a clear productivity unlock; for security teams, it is one more piece of agent infrastructure to put behind policy. Either way, the line between “chatbot in the browser” and “background worker on your machine” just got blurrier — and Codex is on the worker side of it.