OpenAI Codex Can Now Use Your Mac Even When It's Locked

OpenAI just shipped one of the more aggressive autonomy upgrades the industry has seen this year: its Codex coding agent can now keep working on your Mac after you've locked it. The update, which rolled out late last week and is being widely reported as of May 25, 2026, turns Codex from a desktop helper into something closer to a remote worker — one that doesn't stop when you close the laptop lid.

The capability is built on a new Apple authorization plug-in that briefly unlocks the machine for the agent under tightly scoped conditions. You can now kick off a long-running Codex task from your phone, lock your MacBook, and come back hours later to find the work finished.

What Actually Shipped

Until now, Codex's computer-use mode was bounded by a hard limitation: if the Mac was locked, the agent stopped. That made it impractical for any task longer than a coffee break. As of this update, that wall is gone.

From the new changelog: "Your Mac doesn't have to be unlocked for Codex to use your computer — from your phone, Codex can securely use apps on your Mac, even when the screen is off and locked."

The agent can click through windows, type into fields, navigate application menus, and read or write the clipboard. It can do this across any app that the user has explicitly authorized. There is no general "let Codex do anything" mode — every new app prompts for permission, and users can flag specific apps as "Always allow" if they're confident the agent should have standing access.

OpenAI is positioning this as a way to make agents practically useful, not just demoable. The shift matters because a huge fraction of real work — building a slide deck, running a multi-step research task, processing a queue of files — takes longer than a typical untouched-laptop timeout.

How the Locked-Mode Trick Works

OpenAI is using a previously underused Apple capability: authorization plug-ins. These let an approved process briefly hold authentication credentials and unlock the machine under defined conditions. Codex uses this only during "active, trusted computer use turns" — meaning it can only unlock the Mac while it's in the middle of an authorized agent task.

The safeguards are deliberately conservative. Authorizations are short-lived. Displays stay covered (Codex is not lighting up your screen so passers-by can watch). Any local input — a keystroke, a mouse movement — instantly relocks the device. And users can fall back to manual unlock at any point.

What Codex cannot do, even with this update: automate the Terminal, automate itself, or click through system-level admin prompts. That last one matters. The agent cannot grant itself broader system permissions while you're not looking, which has been a persistent worry about computer-use agents.

The feature is also unavailable in the European Economic Area, the UK, and Switzerland at launch — a sign that OpenAI is still working through regulatory questions around remote control of personal devices.

Why This Matters

For the past year, the AI industry has been promising "agents" that handle real workflows end-to-end. The reality, until now, has been a mess of half-finished demos: tasks that work in a sandbox but stall on a real Mac because the screen locked, the session timed out, or the user happened to step away.

OpenAI just closed one of the largest of those gaps. A developer can now hand Codex a multi-step task — "find this bug, write a fix, run the tests, push a branch, draft a PR description" — and walk away with the laptop on the desk. The agent keeps working, the screen stays dark, and the work shows up when they're back.

That's a substantial behavioral change. It means coding agents finally fit into the rhythm of a workday rather than competing for your attention.

It also raises the stakes on access control. A locked machine has historically been an implicit "do not touch" signal. With Codex able to operate one, the trust boundary is no longer the lock screen — it's the permission a user gave at setup. Organizations are going to need new playbooks for what "Always allow" actually means.

The Wider Codex Push

The locked-Mac feature is part of a broader Codex update this month. OpenAI also shipped "Appshots" for instant window context (so Codex can grab a quick snapshot of an app to understand what it's looking at), graduated Goal Mode to general availability, and improved the in-app browser. Codex is also now usable from mobile — you can dispatch tasks to your Mac from your phone and monitor progress remotely.

Taken together, the changes turn Codex into something closer to a desktop teammate than a coding tool. It can see, click, type, and persist through your absence.

Industry Implications

Anthropic, Google, and xAI all have computer-use agents in the field. None of them, to date, have shipped this specific capability — running on a locked personal device. OpenAI now has a real differentiator for power users who treat the agent as a second worker.

Enterprise buyers will be watching the security model closely. The Apple authorization plug-in architecture is novel, and IT teams will want to confirm what audit trails exist when Codex unlocks a managed device. Expect MDM (mobile device management) vendors to start publishing guidance within weeks.

For competitors, the question is whether they can match this on Windows. Microsoft's Copilot Studio computer-use agent went generally available earlier this month, but Windows has different authentication architecture and the same trick won't translate directly.

What's Next

The feature is rolling out now to Codex users globally, excluding the EEA, UK, and Switzerland. OpenAI says Mac support is the first platform, with Windows and Linux on the roadmap but no commitment on timing.

For developers, the practical next step is auditing which apps to flag as "Always allow." For everyone else, it's worth asking: what's the longest task you've ever wanted to hand off to an AI? Codex can now actually do it overnight.

Bottom Line

The lock screen used to be a hard floor for AI agents. OpenAI just lowered it. Codex on a locked Mac is the clearest signal yet that the agent era is moving from demos to daily use — and that the trust boundary has shifted from "is the machine awake?" to "what did I let it do?"