Cursor vs OpenAI Codex (2026)

Upgraded from P: six invocation surfaces plus scheduled tasks, GitHub Action, non-interactive exec mode, and third party triggers from Slack, Linear, GitHub and GitLab. The June basis predated most of this.

Upgraded from P: a semantic codebase index plus @codebase, @file and @folder scoping, project rules, MCP data sources and agents searching past conversations is grounding on the customer's own material across several layers.

Upgraded from P: agents searching past conversations as context is a documented memory capability added since the May grid, alongside persistent rules and cloud sessions that survive across devices.

Upgraded from P: a named Memories customization surface plus Computer History, alongside persistent projects, resumable sessions, compaction and AGENTS.md. The June basis predated the Memories feature.

Upgraded from P: a documented approval framework with tiered actions, a sandbox with granular network and filesystem controls, read only enforcement for Ask mode, and enterprise agent run settings. Recorded honestly: security researchers have published sandbox escape findings including CVE-2026-22708, and auto-run remains the documented risk surface, but the shipped guardrail mechanism is real and configurable.

Held at F rather than downgraded, unlike most of this lane. The difference is that Cursor documents an AI code tracking API and audit logs as distinct enterprise products, not just usage telemetry: the API attributes which code was AI generated and the audit log records who did what. That is a retained organisation level record of agent activity, which is the axis, not a live progress view. Still short of a per action reasoning trace, which is why the basis says so.

Upgraded from P. OpenTelemetry export with a documented event catalogue covering tool decisions, tool results and approval outcomes, plus a separate Compliance API and audit events surface and an Analytics API, is a retained per action record rather than usage reporting. Same standard applied to cursor and github-copilot, both of which held at F on documented audit surfaces. Recorded honestly: telemetry is opt in and off by default, and prompt content is redacted unless explicitly enabled.

Held at P and the vendor is explicit about why: no on premises, hybrid or VPC deployment is offered, and even bring your own model keys route through Cursor's AWS infrastructure for prompt construction. Privacy Mode, CMEK and PrivateLink are strong data controls but they are not deployment or residency choice. This is the clearest cloud only posture in the lane.

Upgraded from P: local execution on the developer's own machine under an OS enforced sandbox, dev container support, Amazon Bedrock as a model provider path, and Private Link, IP allowlisting and mutual TLS for enterprise network control. Recorded honestly: cloud tasks run in OpenAI managed containers with no customer VPC or self hosted cloud option documented.

Upgraded from P: the Cursor Marketplace with /add-plugin installable bundles is a vendor operated distribution surface with named launch partners, which is the axis. It did not exist when the May grid was built; plugins shipped in 2.5 on 17 February 2026.

Upgraded from P: skills and plugins are both first class installable surfaces with build guides, enterprise plugin management and skill controls, and Codex accepts Claude Code plugin layouts. That is a distribution surface, which is the axis.

Corrected from N. The prior basis read OpenAI-only model, which describes the provider rather than the axis, the same error I corrected on anthropic-claude-code and google-jules. The model is selectable per session in config.toml, a Models page documents the choices, workspace model availability is an admin control, and Amazon Bedrock is documented as a deployment and model provider path. Held at P not F because all models are OpenAI's with no third party or BYOK option, narrower than activepieces or cline.

Held at P per the lane wide axis rule. BugBot and the agent's own test running verify the customer's code and the agent's output; no harness for evaluating or regression testing agent behaviour is documented. Consistent with coderabbit, kiro, jetbrains-ai, google-antigravity and Claude Code in this lane.

Downgraded from F, ninth application of the lane wide axis rule. Code review, the Security plugin and CI scanning all act on the customer's code. The closest thing to agent evaluation is Auto-review, which judges individual agent actions against a risk policy at runtime, but that is a runtime guardrail already credited on HITL and not a harness for testing agent behaviour. Note the platform's Evals product is an API surface for the customer's own applications, not a harness for evaluating Codex itself, so it does not count here; the same fact should not do work on two records.

Downgraded from F. The May basis carried no URL and no content, and neither pass found first party documentation of a browser or computer use tool. Background agents run in sandboxed cloud VMs and can reach the network under granular controls, but running in a sandbox is not the same as driving a browser through a human interface. Compare cline, where browser_action has its own docs page and the axis is clearly met. Recorded as not documented rather than absent.

Corrected from N. Browser and Computer use are listed as documented Capabilities in Codex's own navigation with dedicated pages, alongside a browser extension and Appshots, and the security page names browser and Computer Use activity as a distinct traffic surface requiring its own feature controls. The June basis missed this entirely.