Codex Locked Computer Use: AI Agents on a Locked Mac

TL;DR

On May 21, 2026, OpenAI shipped Locked Computer Use for the Codex Mac app — letting Codex keep clicking, typing, and navigating macOS apps after your screen turns off and locks¹². The feature works through an Apple authorization plug-in that temporarily unlocks the Mac only during active, trusted Computer Use turns, with safeguards including short-lived authorization, covered displays, and an instant relock the moment local keyboard or pointer input is detected²³. It's unavailable in the European Economic Area, the United Kingdom, and Switzerland at launch, and it cannot automate Terminal apps, Codex itself, or system-level admin prompts¹⁴. The release lands alongside Goal Mode going generally available and the new Appshots capture feature, and it pairs naturally with Codex Mobile — launched May 14, 2026 — so you can fire off a long-running agent task from your phone and walk away from your laptop⁵⁶. Anthropic brought Computer Use to the Claude Cowork and Claude Code Mac desktop apps on March 23, 2026 — but as of this post Claude still does not survive the lock screen, making OpenAI the first major coding agent to clear that barrier on macOS⁷.

What You'll Learn

• What Codex Locked Use actually does — and the exact macOS lock-screen problem it solves
• How the Apple authorization plug-in mechanism works, and what permissions Codex needs
• The four safeguards OpenAI built in (and one big admin override for the enterprise)
• Why Locked Use is unavailable in the EEA, UK, and Switzerland at launch
• How it compares to Claude Computer Use on Mac — and which agent still loses to the lock screen
• How Locked Use stacks with Codex Mobile, Goal Mode GA, and Appshots in the same release
• Practical pitfalls: the three things Locked Use refuses to automate, and why

The Lock Screen Problem

Ever since Anthropic's Computer Use API entered public beta on October 22, 2024⁸, every AI coding agent that "controlled your Mac" had the same dirty secret: the moment your screen locked, the agent died. macOS turns off display output and pauses graphical access on lock, and accessibility-API-driven agents — which is most of them — could no longer see windows to click. If you left an agent running while you stepped away for an hour, you came back to a half-finished migration or a stalled UI test. Common workarounds included caffeinate to prevent idle sleep, third-party utilities that disabled lock-screen triggers, and even hardware display dongles that fooled the Mac into thinking an external monitor was attached.

OpenAI shipped Computer Use for the Codex Mac app on April 16, 2026 as part of the broader "Codex for almost everything" update⁹. That first version used the macOS accessibility hierarchy to read window state, then sent clicks, keystrokes, and clipboard operations to apps you'd explicitly approved. It worked well — but it only worked while you were logged in with the screen awake.

The May 21, 2026 update closes that gap. Codex can now keep operating GUI apps after lock, with the screen blacked out, so a long-running agent task can finish overnight or while the laptop sits in a drawer at a coffee shop¹².

How Locked Use Actually Works

Locked Use is built on a piece of macOS infrastructure most users never see: authorization plug-ins. macOS exposes an extension point in the Security framework — the AuthorizationPluginInterface C API, surfaced through the system's SecurityAgent process — that lets developers participate in the authentication dialogs the system shows during unlock, install, and admin elevation flows¹⁰. When Codex installs the Computer Use plug-in, it registers a handler that can produce an unlock decision under tightly scoped conditions.

In practice, the flow looks like this:

1. You start a Computer Use turn — locally on your Mac, or remotely from Codex Mobile on iOS or Android⁵⁶.
2. The Computer Use plugin must already be installed in Codex, with Screen Recording and Accessibility permissions granted in System Settings → Privacy & Security³.
3. While the turn is active, Codex requests permission to operate each app it touches. You can mark trusted apps as Always allow, and remove them later from the Computer Use section of Codex settings³.
4. If the screen locks during the turn, Codex's authorization plug-in steps in and silently unlocks the session for the duration of the active Computer Use action. The display stays covered (turned off), so anyone walking past doesn't see your screen.
5. The moment macOS detects local keyboard or pointer input, the system relocks immediately and Codex pauses automatic unlock until you manually log back in².

Crucially, Locked Use is not a general-purpose remote-unlock backdoor. OpenAI's documentation is explicit that the unlock is scoped to active, trusted Computer Use turns — not to give you a way to log in to your Mac from anywhere, and not to bypass the lock screen for non-Codex purposes².

The Four Safeguards

OpenAI lists four named safeguards in the Codex changelog²:

A fifth control sits at the org level: enterprise admins and owners can disable the feature entirely by setting remote_computer_use = false in Policies & Configurations inside Codex cloud⁴. That's the right primitive for regulated industries — you don't have to choose between letting employees use Codex or letting them leave laptops unattended in unlocked states.

Three Things Locked Use Refuses to Do

Even with the plug-in installed and all permissions granted, Locked Use has hard limits. Codex cannot automate¹³:

1. Terminal apps. Automating Terminal, iTerm, or any shell session through Computer Use is blocked — that path could bypass Codex's own sandbox and approval rules for shell commands.
2. Codex itself. Codex won't drive its own UI through Computer Use, for the same security-self-reference reason.
3. System-level admin prompts. The plug-in can unlock the screen for a Computer Use turn, but it can't authenticate as an administrator or click through privacy/security permission dialogs. Anything that requires sudo-style elevation still needs you.

These aren't bugs — they're deliberate scope cuts to keep the lock-screen unlock from becoming a generic privilege-escalation primitive.

Why It's Off in the EEA, UK, and Switzerland

The Codex documentation states plainly that Computer Use, including Locked Use, is "currently available on macOS, except in the European Economic Area, the United Kingdom, and Switzerland at launch"³. OpenAI hasn't published a detailed legal rationale, but the pattern matches how the company has rolled out other agentic features: launch in the U.S. and other markets first, then expand to GDPR-and-DSA-adjacent jurisdictions after the regional compliance review is done. Expect the regional exclusion to be temporary, not permanent.

If you're a developer in those regions, the rest of Codex still works — you just won't see the Computer Use install option in settings yet.

Codex Locked Use vs. Claude Computer Use on Mac

Anthropic brought Computer Use to the Claude Mac desktop apps (Claude Cowork and Claude Code) on March 23, 2026 — about two months before OpenAI's Locked Use update⁷. (Claude's underlying Computer Use capability has existed as a public-beta API since October 22, 2024⁸, but March 2026 was the first time it shipped as a built-in Mac-app feature.) Claude's version uses a similar permission-first model — per-app approval, requires Accessibility. But Claude's Computer Use does not survive the lock screen: the agent halts when the display turns off, and there is no published Anthropic-side mechanism to unlock the Mac mid-task⁷¹¹.

The headline difference is the lock screen. For multi-hour or overnight workflows — refactoring a large codebase, running a UI test suite, scraping a desktop app for a one-time data migration — Locked Use is the only option that lets the agent keep going without someone physically guarding an unlocked laptop.

How It Stacks With the Rest of the May 21 Release

Locked Use didn't ship alone. The same May 21, 2026 release rolled out three other developer-facing features¹¹⁴:

• Goal Mode → GA. Goal Mode — Codex's mode for "give me a milestone, keep working until you reach it, across hours or days" — moved from beta to general availability in the Codex app, IDE extension, and CLI¹⁴.
• Appshots. A new Command-Command shortcut on Mac that captures the frontmost window — screenshot plus any exposed text, including content outside the visible scroll region — and injects it as an attachment into the current Codex thread. Appshots is macOS-only for now¹⁴.
• Remote / locked Computer Use from Codex Mobile. The mobile counterpart to Locked Use: fire off a Computer Use task from the ChatGPT app on your phone, walk away, and the Mac executes it under lock¹.

The combination is what makes the release meaningful as a product move, not just a feature drop. Goal Mode lets you scope a multi-hour milestone. Appshots is how you hand off rich GUI context to the agent without describing every window in prose. Locked Use is how the agent keeps working after you've closed the laptop and gone home. Codex Mobile is the trigger from anywhere.

Bottom Line

The lock screen has been the last visible failure mode for Mac coding agents since computer-use shipped industry-wide. With Locked Use, OpenAI moved Codex past that barrier by leaning on a part of macOS — authorization plug-ins — that Apple built for legitimate enterprise identity tools and exposed safely behind explicit user permission. The result is the first major coding agent that can credibly run a multi-hour task while the laptop is closed.

The interesting question now is how the rest of the field responds. Claude's Computer Use is already feature-comparable when the screen is awake, and Anthropic ships fast — a lock-screen equivalent before the end of Q3 2026 would not be surprising. Cursor's cloud agents already sidestep the problem by running in remote VMs. The local-Mac-with-lock-screen path is just one architecture, but it's the one most developers run today, and OpenAI shipped first.

If you're already running Codex on a Mac in the U.S. or a non-restricted market, installing the Computer Use plug-in and enabling Locked Use is a five-minute setup. The bigger decision is whether your team is comfortable letting an autonomous agent operate a logged-in macOS session unattended — and that's a policy question, not a technical one. For high-trust use cases (a single-developer Mac, scoped to a specific app), the safeguards are genuinely thoughtful. For multi-user or regulated environments, the remote_computer_use = false policy override is the right starting point until you've reviewed how Codex handles your data.

Locked Use is small in code and large in implications. It says: agents are not just "computer use" demos anymore. They're shift-workers.

Sources