Codex Locked Computer Use: AI Agents on a Locked Mac

[Alex]: Welcome back to Nerd Level Tech AI Cast, where we decompile the future one byte at a time. I’m Alex—

[Jamie]: —and I’m Jamie! Here to ask the obvious, the weird, and the "wait, what does that button do?" questions so you don’t have to.

[Alex]: Today we’re digging into something that, honestly, feels like a plot twist in the saga of AI coding agents: OpenAI’s Codex can now keep working on your Mac even while it’s locked. Yes, you can close your laptop, walk away, and Codex is still busy clicking, typing, and doing your bidding.

[Jamie]: That’s wild! So if I kick off a massive migration or some gnarly UI test, I don’t have to hover nervously over my laptop with a cup of coffee and a prayer anymore?

[Alex]: Exactly. And we’ll talk about how it works, what it doesn’t do, and why it’s a bigger deal than you might think. Plus, we’ll pit it against Claude, break down the new features, and, of course, air out the gotchas.

[Jamie]: All right, Alex, let’s start at the beginning. Why was this a problem in the first place? Like, what’s the big deal about using an AI agent when your Mac is locked?

[Alex]: Great place to start. So, before this update, every AI agent that could "use your computer" on macOS—whether it was OpenAI’s Codex or Anthropic’s Claude—had a secret Achilles’ heel: as soon as your Mac locked, the agent basically keeled over. macOS would turn off the display, pause graphical access, and most agents, which rely on the accessibility API, couldn’t see or interact with anything.

[Jamie]: So the second I stepped away to, I dunno, make a snack, my agent just… gave up?

[Alex]: Exactly. You’d come back to find a half-finished migration or a UI test frozen in time. People tried all sorts of hacks—using the "caffeinate" command to stop the Mac from sleeping, weird third-party utilities, or even plugging in fake display dongles to trick the Mac into thinking a monitor was attached.

[Jamie]: Okay, but… that all sounds like the digital equivalent of taping down the "door close" button on an elevator. Not super elegant.

[Alex]: Pretty much. The new Codex Locked Use feature finally solves this. Now, Codex can keep operating GUI apps even after your Mac’s screen is blacked out and locked.

[Jamie]: This sounds like magic. How does it actually work? Is Codex basically hacking the lock screen?

[Alex]: Not hacking—more like using a secret entrance that Apple built for trusted guests. It’s all thanks to an Apple authorization plug-in. macOS has this extension point in its security framework—think of it as a guest list for certain system events, like unlocking or admin installs.

[Jamie]: So Codex gets VIP access, but only under certain conditions?

[Alex]: Exactly. When you install the Codex Computer Use plug-in, it registers a handler that can quietly unlock your Mac, but—here’s the key—only during an active, trusted Computer Use "turn." The unlock is temporary, tightly scoped, and tied to tasks you’ve explicitly started, either locally or from your phone.

[Jamie]: So I can’t use this to, say, break into my own Mac from Tahiti if I forget my password?

[Alex]: Nope. This isn’t a remote-unlock backdoor. Codex unlocks the Mac just for that Computer Use session, and only for approved apps. The moment macOS detects someone—maybe you, maybe your cat—touching the keyboard or moving the mouse, it slams the lock shut again.

[Jamie]: Okay, so it’s like Codex is a babysitter who’s only allowed inside when you say so, and the second you come home, it hands back the keys.

[Alex]: Perfect analogy. And if the Mac relocks because of local input, Codex can’t just unlock it again—you have to manually log back in.

[Jamie]: I’m guessing Apple and OpenAI didn’t just leave this wide open. What kind of safeguards are baked in?

[Alex]: Four main ones, actually: 1. **Short-lived authorization:** The unlock only lasts for that specific Computer Use turn. No long-lived tokens lying around for someone to swipe. 2. **Covered displays:** The Mac’s display stays off while Codex operates, so nobody passing by can watch your AI agent do its thing. 3. **Relock on local input:** The second anyone touches the keyboard or trackpad, the Mac relocks and Codex pauses. 4. **Manual-unlock fallback:** After any local input, you have to log in yourself before Codex can get back to work.

[Jamie]: So, if someone tries to hijack my laptop while Codex is running, the system is basically like, "Nope, nice try, log in first"?

[Alex]: Exactly. And for enterprises, there’s a fifth safeguard: admins can disable the whole feature with a single policy toggle. So, in regulated industries or multi-user setups, you’re not forced to let Codex run wild.

[Jamie]: That’s a relief. I’d rather not have Codex finish my code review *and* order 500 pizzas while I’m gone.

[Alex]: Unless you’re running a startup that needs a pizza-fueled hackathon, in which case—maybe that’s a feature?

[Jamie]: [laughs] Only if Codex can clean up the boxes afterward.

[Jamie]: All right, so what *can’t* Codex do with Locked Use? Where does it draw the line?

[Alex]: Great question. Even with all permissions, there are three hard limits: 1. **Terminal apps:** Codex won’t automate Terminal, iTerm, or any shell session. That would be a huge security risk—imagine Codex running unchecked shell commands. 2. **Codex itself:** It can’t drive its own UI, to avoid self-referential security loopholes. 3. **System-level admin prompts:** Anything that requires admin authentication, like privacy or security dialogs, is off-limits. If sudo is needed, you still have to do it.

[Jamie]: So, no "infinite privilege escalation" party for Codex. That’s probably for the best.

[Alex]: Absolutely. These aren’t bugs—they’re deliberate guardrails.

[Jamie]: I heard this isn’t available everywhere yet. What’s up with the regional restrictions?

[Alex]: Yep, at launch, Locked Use is *not* available in the European Economic Area, the UK, or Switzerland. OpenAI’s following its usual playbook: roll out in the US and other markets first, then tackle the GDPR and DSA compliance before bringing it to Europe.

[Jamie]: So if I’m in London or Berlin, I just have to wait?

[Alex]: For now, yes. You’ll still get the rest of Codex’s features—just not the Computer Use plug-in. Expect that to change once the legal ducks are in a row.

[Jamie]: Let’s compare this to Claude—Anthropic’s rival agent. Didn’t Claude get Computer Use first?

[Alex]: Sort of! Claude shipped Computer Use on Mac in March 2026, but their agent still can’t operate while the Mac is locked. Claude’s version uses a similar per-app approval model, but the agent halts the moment the screen turns off.

[Jamie]: So, if I want my AI to finish a big job while my Mac is locked and safe, Codex is literally the only show in town?

[Alex]: As of right now, yes. For multi-hour jobs—think overnight codebase refactors or scraping desktop apps—Codex with Locked Use is the only agent that keeps going after you close the lid.

[Jamie]: Sorry, Claude! Maybe next quarter.

[Alex]: Given Anthropic’s pace, I wouldn’t be surprised if a lock-screen workaround shows up soon.

[Jamie]: There were a couple of other features in this update, right? Give me the quick tour.

[Alex]: Sure! The May 21st release was a triple whammy: - **Goal Mode** went from beta to general availability. You give Codex a milestone, and it works toward it across hours or even days. - **Appshots:** Command-Command gives you a screenshot plus extracted text from the frontmost window, so Codex gets richer context. - **Codex Mobile:** You can trigger Computer Use tasks from your phone and let your Mac handle them—even while it’s locked.

[Jamie]: So, in theory, I could be at the grocery store, realize I forgot to kick off a big task, fire it off from my phone, and Codex just… does it while my Mac sits at home locked?

[Alex]: Exactly. It’s like having an AI assistant that doesn’t care if you’re physically there. As long as you’re in an allowed region and you’ve set things up, you’re golden.

[Jamie]: All right, lightning round! Is this a remote-unlock for my Mac?

[Alex]: Nope. Codex only unlocks during an active, trusted Computer Use turn. No sneaky remote logins.

[Jamie]: What permissions does Codex need on macOS?

[Alex]: Two system permissions: Screen Recording and Accessibility. Plus, you have to approve each app individually.

[Jamie]: Can I use this on Windows?

[Alex]: Not yet. The Codex desktop app is on Windows, but Computer Use—including Locked Use—is macOS-only for now.

[Jamie]: Can my IT department turn this off?

[Alex]: Yes! Enterprise admins can disable it org-wide with a quick policy change.

[Jamie]: And, again, Claude can’t do this yet?

[Alex]: Right. As of now, only Codex can work through the lock screen on Mac.

[Jamie]: So, bottom line: if I’m a developer in the US or another supported region, is this worth setting up?

[Alex]: If you need your AI agent to keep working while you’re away—absolutely. The setup is quick, but the bigger question is policy: are you comfortable letting an agent run on a locked Mac, even with all these safeguards? For solo devs or tightly scoped tasks, it’s awesome. For teams with stricter rules, maybe wait and review.

[Jamie]: And if you’re worried, just remember: one toggle, and your admin can pull the plug.

[Alex]: Exactly. It’s a small feature code-wise, but a big shift in what AI agents can actually do. Agents aren’t just demo toys anymore—they’re shift-workers.

[Jamie]: All right, that’s a wrap for today’s Nerd Level Tech AI Cast! If you enjoyed this deep dive, subscribe, leave us a review, and let us know what wild AI feature you want us to tackle next.

[Alex]: Thanks for tuning in, and remember: don’t leave your Mac unlocked… unless your AI agent is on the clock.

[Jamie]: See you next time, nerds! [OUTRO MUSIC]