OpenAI is preparing a new Codex Cloud with Tailscale and Azure workload identity
Desktop build 9922 separates "Cloud" from "Cloud (Legacy)" and wires an environment-drafting agent to private-network access, proxy-delivered secrets and cloud identities behind a feature gate.
By Ryan Merket · Published
RUNTIMEWIRE INVESTIGATION — Original analysis
Original reporting by RuntimeWire, based on documents, reverse engineering, data analysis.
Why it matters
If shipped, this would make environment setup and access control part of the coding agent itself, reducing the work required to deploy Codex against private repositories, networks, and cloud resources. It also shifts more of the security boundary to OpenAI, requiring enterprises to trust its handling of reusable network keys, proxy-injected secrets, workload identities, and agent-proposed configurations. That managed model may simplify adoption compared with self-hosted runners, but gives customers less direct control over execution infrastructure.
Reporting record
Finding
Production Codex desktop build 9922 contains a feature-gated replacement Cloud path that separates the existing service as “Cloud (Legacy)” and adds agent-led environment setup with Tailscale, network-secret and cloud-identity controls.
How we verified
Methods: documents, reverse engineering, data analysis.
Comparative analysis of production builds 9922 (26.915.31945) and 9275 (26.908.70816), including new Cloud labels, feature gate 375130565, environment setup states and schemas, Tailscale configuration, proxy-delivered network secrets, and Azure, AWS and Google Cloud identity controls.
RuntimeWire reverse-engineered and compared the client code and interface wiring in production builds 9922 and 9275, counted cloud-prototype references, and analyzed labels, feature gates, state handling, API schemas and configuration panels.
Tested versions:
- production build 9922 (26.915.31945)
- production build 9275 (26.908.70816)
Reproduction
RuntimeWire partially reproduced the finding.
Company response
The company was not contacted before publication.
I found evidence in OpenAI desktop build 9922 that the company is developing a new Codex Cloud service alongside its existing system. The unreleased path separates "Cloud" from "Cloud (Legacy)," lets Codex conduct an onboarding conversation, inspect selected repositories and prepare an environment draft for developer review.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.