Codex CLI vs Claude Code vs Cursor: 2026 Architecture Deep-Dive (Sandboxing, Context, Plugins, Scheduling)

The 2026 AI coding tool conversation usually defaults to "which one has the smartest model". That is the wrong question. Codex CLI, Claude Code, and Cursor draw on the same few frontier labs -- Anthropic's Claude Opus 5.5, OpenAI's GPT-6.1 Sol, Google's Gemini 3.1 Pro -- and the model is increasingly a parameter you choose, not a property of the tool. The real differences are architectural: how each tool sandboxes the agent and with what defaults, how it manages context, how it composes with other tools, and how it lets a team govern what the agent can do.

This guide unpacks those architectural differences and gives a decision framework for which fits your shape of work. If you want a feature-by-feature surface comparison instead, our Cursor vs Claude Code piece covers that for those two; this guide goes deeper on the architecture and adds Codex CLI to the mix.

Key Takeaways

• Sandboxing: All three confine local shell commands with OS-level enforcement. Codex sandboxes by default (Seatbelt on macOS, bubblewrap on Linux and WSL2, a native Windows sandbox). Claude Code's Bash sandbox (Seatbelt, bubblewrap) is off until you turn it on. Cursor uses Seatbelt or Landlock plus seccomp and sandboxes commands under Auto-review.
• Hooks: All three run your scripts on agent events -- Claude Code hooks, Codex hooks, and Cursor's hooks.json -- so programmable governance is no longer a Claude Code exclusive.
• Configuration: Codex reads AGENTS.md. Claude Code reads CLAUDE.md, and reads AGENTS.md instead when a repository has no CLAUDE.md (v2.1.277 or later). Cursor reads .cursor/rules .mdc files plus a root AGENTS.md or CLAUDE.md, and adds Cursor Skills. Cursor's own help docs call the older .cursorrules file legacy.
• Composition: Claude Code's subagents and Routines and Codex's thread automations are the strongest patterns for parallel and long-running work; Cursor's Cloud Agents (formerly Background Agents), Automations and Canvases solve different problems.
• MCP support: All three implement MCP. The same server runs across them with minor config tweaks.
• Best fit by team shape: Solo developer leaning visual → Cursor. Solo developer leaning terminal → Claude Code. Team that wants sandboxing on by default with no setup → Codex CLI.

Why Architecture Beats Model Choice in 2026

The October 2026 model landscape is still convergent. Claude Opus 5.5, released September 22, is Anthropic's default for agentic coding at $4 input and $20 output per million tokens. GPT-6.1 Sol, released September 29, is OpenAI's new default coding model. Gemini 3.1 Pro is still the newest Pro model on Google's Gemini API models page. None of them is a category killer.

Model access does differ by tool. Codex runs OpenAI models by default and can point at a custom model provider or gateway. Claude Code runs Anthropic models. Cursor lets you pick across labs per session; its models and pricing page lists Anthropic, Google, OpenAI and SpaceXAI models, with GPT-5.6 as its newest OpenAI family. That cross-lab choice has an expiry risk: OpenAI plans to end Cursor's direct access to OpenAI models, with November 12, 2026 proposed and not yet confirmed.

What is divergent is what the tool does around the model. Sandboxing decides whether an agent can wreck your machine. The configuration system decides how a team encodes house rules. The plugin system decides what the agent can reach for. The composition primitives decide how multi-step work actually runs. These are the choices that lock you in for the next year of work, and they are the ones the model-vs-model framing skips entirely.

The Three Architectures at a Glance

Sandboxing: Same Mechanism, Different Defaults

Sandboxing is the single most consequential architectural decision a coding agent makes. It determines what happens when the agent goes off the rails -- a hallucinated rm -rf, a runaway shell loop, a silently scoped-up chmod. In 2026 all three tools enforce that boundary in the operating system rather than in the agent's own code, so the useful questions are whether the sandbox is on by default, which platforms it covers, and what runs outside it.

Codex CLI: OS-enforced, on by default

Codex uses "platform-native enforcement on each OS", according to OpenAI's sandboxing docs. On macOS it uses the built-in Seatbelt framework. On Linux and WSL2 it uses bubblewrap, which you install with your package manager. On native Windows it uses a Windows sandbox when you run in PowerShell. The boundary applies to spawned commands as well as built-in file operations, so git, package managers and test runners inherit it, and the default permissions mode applies sandboxing automatically.

The practical effect: a Codex agent can read files, edit, and run routine project commands inside the boundary without asking, and stops to ask when it needs to step outside. For teams that run Codex on shared machines, against untrusted PRs, or as part of CI, the on-by-default posture is the strongest argument for Codex. The trade-off is that the sandbox policy is the source of truth -- if it is too tight, the agent fails; if too loose, the guarantee is hollow.

Claude Code: an opt-in OS sandbox plus hooks

Claude Code's Bash sandbox is also enforced by the operating system: Seatbelt on macOS, bubblewrap on Linux and WSL2. It covers Bash, PowerShell and Monitor commands and the processes they start, limits writes to the working directory and directories you add, and routes network traffic through a proxy that checks each host against your allowed domains. Two caveats matter. The sandbox is off by default; you turn it on with /sandbox or sandbox.enabled in settings. And on native Windows, Claude Code runs commands unsandboxed, so Windows users need WSL2. Managed deployments can set sandbox.failIfUnavailable so Claude Code refuses to start rather than run unsandboxed.

On top of the sandbox, Claude Code has a hook system and a permission-prompt pattern. Hooks are scripts you write that run on agent events; a PreToolUse hook, for example, runs before a tool call and can block it. The sandbox covers shell commands only: Claude's file tools, MCP servers and hooks themselves run outside it, so hooks and permission rules are what govern those. Our Claude Code hooks guide walks through the common patterns.

The practical effect: a team can block any shell command containing rm -rf, require approval before HTTP calls, or log every file write to a SIEM, and pair that with an OS boundary on the shell. This is the right shape for teams that want to encode their own house rules in code and are willing to switch the sandbox on.

Cursor: sandbox under Auto-review, plus hooks

Cursor also sandboxes terminal commands in the operating system. Its Run Modes docs say it uses Seatbelt through sandbox-exec on macOS and Landlock plus seccomp on Linux (kernel 6.2 or later), and Cursor's sandboxing write-up says Windows runs the Linux sandbox inside WSL2. Whether a command uses it depends on the Run Mode: Auto-review, the recommended default since Cursor 3.6 on May 29, 2026, runs allowlisted calls, runs other shell commands in the sandbox when it can, and sends the rest to a classifier. Network access from the sandbox is blocked by default and opened through sandbox.json.

Cursor has programmable hooks too: scripts defined in hooks.json that run before or after stages of the agent loop, including beforeShellExecution and beforeMCPExecution, and can observe, block, or modify behavior. Cursor can also load hooks written for Claude Code.

The trust model is still editor-first: the developer is at the keyboard and the agent is helping. The difference from April is that the agent's shell commands now run inside an OS boundary unless they need more access, in which case Cursor asks or the classifier reviews them.

What this means for your choice

The decision framework:

• Running untrusted code, doing PR review on outside contributions, or wanting a sandbox nobody has to remember to turn on: Codex CLI, which sandboxes by default on macOS, Linux and native Windows.
• Building your own governance policies, integrating with internal logging/auth systems, or running in a high-control enterprise: Claude Code for the hook system, with the sandbox enabled and made mandatory through managed settings.
• Day-to-day visual editing on your own laptop: Cursor, with Auto-review keeping shell commands in the sandbox.

Configuration: The File Where House Rules Live

Every coding agent needs a way to encode "how this project works" -- conventions, build commands, preferred libraries, things to never touch. The three tools each ship a different file, and the differences matter for portability.

CLAUDE.md (Claude Code)

CLAUDE.md is the most opinionated of the three. It supports a layered system: ~/.claude/CLAUDE.md for global rules, <project>/CLAUDE.md for project-level rules, and per-directory CLAUDE.md files. According to Anthropic's memory docs, the files are concatenated rather than overriding each other: files above the working directory load at launch, ordered from the filesystem root down, and a subdirectory's file loads once Claude works in that directory, so instructions closer to where you work are read last. The format is plain markdown with light conventions (the # Commands section is widely used for "here are the commands you can run").

The strength is the layered model -- it scales from "I write what I always want Claude to do" to "this team has 200 conventions across 50 directories" without restructuring. Because nothing overrides, contradictory instructions at two levels are a bug to fix rather than a precedence rule to rely on. Portability is better than it was: Cursor reads a root CLAUDE.md, and Claude Code itself reads AGENTS.md when there is no CLAUDE.md.

For more on Claude Code's configuration patterns, see our Claude Code context management guide.

AGENTS.md (Codex CLI, and now the others)

AGENTS.md is an open format for agent instructions, read natively by Codex CLI and by a growing list of other tools. Claude Code v2.1.277 and later reads AGENTS.md as the project instructions when a repository has no CLAUDE.md or CLAUDE.local.md, and Cursor reads a root AGENTS.md. Codex concatenates the files from the project root down to the current directory, so files closer to your current directory override earlier guidance by appearing later, and an AGENTS.override.md in a directory replaces that directory's AGENTS.md.

Codex CLI also supports SKILL.md files for reusable skill definitions -- a skill is a prompt + tool wiring that the agent can compose into other tasks. Skills are increasingly the unit of "how I do X" across the agent ecosystem.

The strength is portability: an AGENTS.md-only repository now gives the same instructions to all three tools with no extra setup. The weakness is that the extras are Codex-only: Claude Code's memory docs say it does not read AGENTS.override.md or AGENTS.local.md, so a layout built on override files behaves differently outside Codex.

Project rules + Cursor Skills (Cursor)

Cursor's rules live in .cursor/rules as .mdc files, version-controlled, each with frontmatter that sets how it applies: always, when the agent judges it relevant, when a file matches a glob, or only when you @-mention it. Plain .md files placed in that directory are ignored. Cursor also accepts a root AGENTS.md as a simpler alternative, and reads CLAUDE.md the same way. Cursor 3.x added Cursor Skills, which are reusable prompt+tool bundles installable from the Cursor Marketplace -- the closest analogue to Claude Code's skills.

The older root-level .cursorrules file is on the way out. Cursor's help docs state that "the .cursorrules file in your project root is legacy and will be deprecated," and give a migration path: create a new rule via the command palette, copy the content across, set it to Always Apply, and delete the old file. Cursor's rules reference and plan pricing page are the sources for the rule formats and plan prices on this page.

The strength is the per-rule application modes plus marketplace integration; many third-party Skills exist for common workflows (code review, refactoring, test generation). The weakness is that the marketplace's quality bar varies, and rules are scoped by glob rather than by the directory-walk hierarchy CLAUDE.md uses.

Multi-tool teams: which file should you maintain?

For a team that uses more than one tool, one AGENTS.md at the repository root is now the lowest-effort choice: Codex reads it natively, Cursor reads it at the root, and Claude Code reads it when there is no CLAUDE.md. If you already maintain a CLAUDE.md, keep it and import AGENTS.md from it with @AGENTS.md, the arrangement Anthropic's memory docs describe for sharing one file with other coding tools; adding a CLAUDE.md stops Claude Code from reading AGENTS.md directly. Either way, whichever agent a team member is using, they get the same conventions.

Composition: How Multi-Step Work Actually Runs

The interesting question in 2026 is not "can the agent write code", it is "can the agent run a four-hour project". Each tool ships different primitives for composing multi-step work.

Claude Code: subagents and Routines

Claude Code's two composition primitives are subagents and Routines. Subagents are child Claude Code sessions with their own clean context window; the parent delegates a task ("read this file and summarize the auth flow") and only the final report comes back. Subagents are the right tool for any work that would otherwise pollute the parent context with noise.

Routines are saved Claude Code configurations that run on Anthropic's cloud on a schedule, an HTTP trigger, or a GitHub event. They turn Claude Code from "an agent you start" into "an agent that starts itself". For background work -- nightly sweeps, PR triage, scheduled docs sync -- Routines are the cleanest pattern in the ecosystem.

The combination is powerful: a Routine fires at 3am, spawns subagents to investigate three repos in parallel, and posts a summary to Slack before standup. No human at the keyboard.

Codex CLI: subprocesses and thread automations

Codex CLI's composition is shell-native. The agent can spawn subprocesses (other Codex sessions, other shell commands), and as of the April 16 update, Codex thread automations let a thread run continuously and react to external triggers. The pattern is similar to Claude Code Routines but lives inside the Codex App rather than as a separate cloud product.

Codex's strength is the unix-y composition story: any command-line tool composes naturally because the agent is one. Pipe the agent's output into another tool, redirect into a file, run in background, schedule via cron -- all of it works the way a developer expects.

Cursor: Cloud Agents, Remote Agents, Canvases, Automations

Cursor's composition primitives are surface-driven. Cloud Agents, which Cursor used to call Background Agents, run each task on a dedicated, sandboxed virtual machine, so you can close your laptop and check the result later; you start one from the editor, the web, mobile, or by mentioning @Cursor in Slack, GitHub or Linear. Remote Agents let Cursor drive any machine you have SSH access to. Canvases are interactive visualizations the agent can build; Automations are Cursor's scheduled-trigger product (covered in our scheduled agents comparison).

Cursor's strength is parallelism you can hand off -- several Cloud Agents working on separate branches while you keep editing locally. Scripting Cursor from outside the editor is now possible through the Cloud Agents API and the Cursor SDK, though both are newer and less shell-native than Codex.

When composition matters most

For teams shipping a real volume of work through agents:

• High-volume, scheduled, hands-off: Claude Code Routines or Codex thread automations.
• Concurrent hand-off work from the editor: Cursor Cloud Agents.
• Programmatic, scriptable: Codex CLI (the most shell-native of the three).
• Mixed: some scheduled, some in-editor, some across tools: the right answer is often "use more than one", with Claude Code or Codex for scheduled work and Cursor for in-editor work.

Plugin Systems and the MCP Layer

All three tools implement the Model Context Protocol -- the open standard for connecting agents to external tools. This is genuinely important: an MCP server you build for one works across all three with minor config tweaks.

But each tool also has its own plugin layer on top:

• Cursor Marketplace is the most consumer-friendly. It has the most third-party plugins (Skills, Canvases, integrations), browseable in the editor, one-click install. The quality bar is mixed but the volume is high.
• Claude Code Skills + Hooks is the most mature programmable layer. A Skill is a reusable prompt+tool bundle; a Hook is a script that runs on agent events. Both are file-based and version-controllable, which is the right shape for a team. Codex and Cursor now ship hooks as well, and Cursor can load Claude Code hooks directly.
• Codex Apps + MCP is the most open. Codex is open-source under Apache 2.0, the App ecosystem is built on standard MCP servers, and there is no marketplace gate. This is great for teams that want full control; less great for users who want curated discovery.

Practical rule: if you want to install other people's stuff easily, use Cursor. If you want to write your own and ship it across the team, use Claude Code or Codex.

Pricing and Lock-In

Codex plan details are from OpenAI's Codex pricing docs; Cursor's from its plan pricing page.

The pricing surface is similar but the lock-in profiles differ:

• Codex CLI is the most portable. Open-source CLI, supports custom model providers, your AGENTS.md/SKILL.md files work elsewhere. Easiest to migrate away from if needed.
• Claude Code has medium lock-in. CLAUDE.md and AGENTS.md are portable, but Routines and most of the orchestration features are Anthropic-cloud-only.
• Cursor has the most lock-in. The editor itself, the marketplace, the Canvases, the Cloud Agents -- nearly all are Cursor-specific. Strong product, but committing to Cursor is committing to Cursor.

Choose Codex CLI If...

• You want sandboxing on by default, including on native Windows, with no setup step anyone can skip.
• Your team values open source, custom model providers, and the AGENTS.md standard.
• Your composition needs are shell-native (cron jobs, pipelines, CI integration).
• You already pay for ChatGPT and want the agent that ships with it.
• You operate in a security-conscious or regulated industry.

Choose Claude Code If...

• Your work is interactive and agentic -- large refactors, multi-file investigations, long-running sessions.
• You want programmable governance (hooks, custom permissions, audit logs) plus an OS sandbox that managed settings can make mandatory.
• You want the strongest composition story for unattended work via Routines.
• You value Anthropic's safety posture and instruction-following profile (especially with Opus 5.5).
• You are willing to commit to Anthropic's cloud for the orchestration layer.

Choose Cursor If...

• Most of your day is visual editing with AI assist.
• You want the lowest friction onboarding for developers coming from VS Code.
• Your team values the marketplace's depth of third-party plugins and Skills.
• You need Canvases, Cloud Agents you can start from the editor, Slack or GitHub, or Remote Agents driving other machines.
• You want to pick models from several labs per session, allowing for OpenAI's proposed November 12 cutoff of Cursor's direct access to OpenAI models.

Or Use More Than One

The most productive teams in 2026 are not picking one. The pattern that has emerged:

• Cursor for daily coding. Visual editing, in-editor parallelism, the lowest-friction surface for the work that fills most of an hour.
• Claude Code for heavy lifting. Big refactors, debugging sessions that span many files, anything that needs the agent to plan and execute multi-step work.
• Codex CLI for sandboxed batch work. Untrusted code review, CI integration, scheduled jobs against PRs.

The integration tax is small (the same MCP servers work across all three, and one AGENTS.md now reaches all three) and the upside is that each tool is doing what it is best at. As of late 2026 this is the dominant pattern at most teams that take AI coding tools seriously, and it is likely to remain the right shape until one of the three vendors absorbs the others' strengths -- which has not happened yet.

The architectural decisions matter more than the model choice, and the sandbox gap has narrowed to defaults: all three now put an OS boundary around shell commands and all three run hooks. Pick the architectures that match how your team actually works, and let the model improve underneath them.

Corrections and Updates

• October 9, 2026: This guide said Claude Code has no kernel sandbox, Cursor has no OS-level isolation or programmable hook system, and per-directory CLAUDE.md files override the parent. All three were wrong: Claude Code's Bash sandbox uses Seatbelt and bubblewrap, Cursor sandboxes terminal commands with Seatbelt or Landlock and seccomp and runs hooks.json hooks, and CLAUDE.md files are concatenated. The MCP config file names in the FAQ are also corrected.
• October 9, 2026: This page said only Codex reads AGENTS.md, Codex has no free tier, ChatGPT Pro costs $200, and Codex's Linux sandbox uses Landlock and seccomp; now Claude Code v2.1.277+ reads AGENTS.md when there is no CLAUDE.md, Codex is in ChatGPT Free and Go, Pro is $100, $200 or $500, and Codex uses bubblewrap on Linux. Background Agents are now Cloud Agents, and the models named are current ones.
• August 14, 2026: Added that Cursor's help docs now call the root-level .cursorrules file legacy, and that Cursor reads a root CLAUDE.md the same way it reads AGENTS.md.

Sources

• Claude Code sandboxing: https://code.claude.com/docs/en/sandboxing (read 2026-10-09)
• Claude Code memory, CLAUDE.md and AGENTS.md: https://code.claude.com/docs/en/memory (read 2026-10-09)
• Claude Code hooks guide: https://code.claude.com/docs/en/hooks-guide (read 2026-10-09)
• Claude Code MCP: https://code.claude.com/docs/en/mcp (read 2026-10-09)
• Codex sandboxing: https://learn.chatgpt.com/docs/sandboxing (read 2026-10-09)
• Codex hooks: https://learn.chatgpt.com/docs/hooks (read 2026-10-09)
• Codex AGENTS.md: https://learn.chatgpt.com/docs/agent-configuration/agents-md (read 2026-10-09)
• Codex advanced configuration (custom model providers): https://learn.chatgpt.com/docs/config-file/config-advanced (read 2026-10-09)
• Codex pricing: https://learn.chatgpt.com/docs/pricing (read 2026-10-09)
• Cursor Run Modes and sandboxing: https://cursor.com/docs/agent/security/run-modes (read 2026-10-09)
• Cursor agent sandboxing engineering post: https://cursor.com/blog/agent-sandboxing (read 2026-10-09)
• Cursor hooks: https://cursor.com/docs/hooks (read 2026-10-09)
• Cursor rules: https://cursor.com/docs/rules and https://cursor.com/help/customization/rules (read 2026-10-09)
• Cursor background agents (Cloud Agents): https://cursor.com/help/ai-features/background-agents (read 2026-10-09)
• Cursor models and pricing: https://cursor.com/docs/models-and-pricing (read 2026-10-09)
• Cursor plan prices: https://cursor.com/help/account-and-billing/pricing (read 2026-10-09)
• Google Gemini API models: https://ai.google.dev/gemini-api/docs/models (read 2026-10-09)