--- title: 'Codex Locked Computer Use: AI Agents on a Locked Mac' description: OpenAI's Codex now drives macOS apps with your Mac locked, via an Apple authorization plug-in. How Locked Use works, what it can't do, and how it beats Claude. url: https://nerdleveltech.com/codex-locked-computer-use-mac language: en date: '2026-05-27' category: ai-ml tags: - OpenAI Codex - Codex Locked Use - Mac AI agent - computer use - macOS automation - Apple authorization plug-in - Claude Computer Use - AI agents - Codex Mobile markdown_url: https://nerdleveltech.com/codex-locked-computer-use-mac.md attribution: 'Source: NerdLevelTech — https://nerdleveltech.com/codex-locked-computer-use-mac' terms: https://nerdleveltech.com/llms.txt --- # Codex Locked Computer Use: AI Agents on a Locked Mac ## TL;DR On May 21, 2026, OpenAI shipped **Locked Computer Use** for the Codex Mac app — letting Codex keep clicking, typing, and navigating macOS apps after your screen turns off and locks[^1][^2]. The feature works through an Apple authorization plug-in that temporarily unlocks the Mac only during active, trusted Computer Use turns, with safeguards including short-lived authorization, covered displays, and an instant relock the moment local keyboard or pointer input is detected[^2][^3]. It's unavailable in the European Economic Area, the United Kingdom, and Switzerland at launch, and it cannot automate Terminal apps, Codex itself, or system-level admin prompts[^1][^4]. The release lands alongside Goal Mode going generally available and the new Appshots capture feature, and it pairs naturally with Codex Mobile — launched May 14, 2026 — so you can fire off a long-running agent task from your phone and walk away from your laptop[^5][^6]. Anthropic brought Computer Use to the Claude Cowork and Claude Code Mac desktop apps on March 23, 2026 — but as of this post Claude still does not survive the lock screen, making OpenAI the first major coding agent to clear that barrier on macOS[^7]. --- ## What You'll Learn - What Codex Locked Use actually does — and the exact macOS lock-screen problem it solves - How the Apple authorization plug-in mechanism works, and what permissions Codex needs - The four safeguards OpenAI built in (and one big admin override for the enterprise) - Why Locked Use is unavailable in the EEA, UK, and Switzerland at launch - How it compares to Claude Computer Use on Mac — and which agent still loses to the lock screen - How Locked Use stacks with Codex Mobile, Goal Mode GA, and Appshots in the same release - Practical pitfalls: the three things Locked Use refuses to automate, and why --- ## The Lock Screen Problem Ever since Anthropic's Computer Use API entered public beta on October 22, 2024[^14], every AI coding agent that "controlled your Mac" had the same dirty secret: the moment your screen locked, the agent died. macOS turns off display output and pauses graphical access on lock, and accessibility-API-driven agents — which is most of them — could no longer see windows to click. If you left an agent running while you stepped away for an hour, you came back to a half-finished migration or a stalled UI test. Common workarounds included `caffeinate` to prevent idle sleep, third-party utilities that disabled lock-screen triggers, and even hardware display dongles that fooled the Mac into thinking an external monitor was attached. OpenAI shipped Computer Use for the Codex Mac app on April 16, 2026 as part of the broader "Codex for almost everything" update[^8]. That first version used the macOS accessibility hierarchy to read window state, then sent clicks, keystrokes, and clipboard operations to apps you'd explicitly approved. It worked well — but it only worked while you were logged in with the screen awake. The May 21, 2026 update closes that gap. Codex can now keep operating GUI apps after lock, with the screen blacked out, so a long-running agent task can finish overnight or while the laptop sits in a drawer at a coffee shop[^1][^2]. --- ## How Locked Use Actually Works Locked Use is built on a piece of macOS infrastructure most users never see: **authorization plug-ins**. macOS exposes an extension point in the Security framework — the `AuthorizationPluginInterface` C API, surfaced through the system's `SecurityAgent` process — that lets developers participate in the authentication dialogs the system shows during unlock, install, and admin elevation flows[^9]. When Codex installs the Computer Use plug-in, it registers a handler that can produce an unlock decision under tightly scoped conditions. In practice, the flow looks like this: 1. You start a Computer Use turn — locally on your Mac, or remotely from Codex Mobile on iOS or Android[^5][^6]. 2. The Computer Use plugin must already be installed in Codex, with **Screen Recording** and **Accessibility** permissions granted in System Settings → Privacy & Security[^3]. 3. While the turn is active, Codex requests permission to operate each app it touches. You can mark trusted apps as **Always allow**, and remove them later from the Computer Use section of Codex settings[^3]. 4. If the screen locks during the turn, Codex's authorization plug-in steps in and silently unlocks the session for the duration of the active Computer Use action. The display stays covered (turned off), so anyone walking past doesn't see your screen. 5. The moment macOS detects local keyboard or pointer input, the system relocks immediately and Codex pauses automatic unlock until you manually log back in[^2]. Crucially, Locked Use is **not** a general-purpose remote-unlock backdoor. OpenAI's documentation is explicit that the unlock is scoped to active, trusted Computer Use turns — not to give you a way to log in to your Mac from anywhere, and not to bypass the lock screen for non-Codex purposes[^2]. --- ## The Four Safeguards OpenAI lists four named safeguards in the Codex changelog[^2]: | Safeguard | What it does | Why it matters | |---|---|---| | **Short-lived authorization** | The unlock window is bounded to the active Computer Use turn, not a persistent session | Prevents a long-lived "unlock token" from leaking or being abused | | **Covered displays** | The Mac's display stays off while Codex operates | Bystanders don't see what the agent is doing on screen | | **Relock on local input** | Any keyboard or pointer activity instantly relocks the Mac | If someone physically picks up your laptop, the agent can't keep going | | **Manual-unlock fallback** | After a relock-on-input, automatic unlock is disabled until you log in by hand | Stops an attacker from triggering the agent again right after kicking you off | A fifth control sits at the org level: enterprise admins and owners can disable the feature entirely by setting `remote_computer_use = false` in **Policies & Configurations** inside Codex cloud[^4]. That's the right primitive for regulated industries — you don't have to choose between letting employees use Codex or letting them leave laptops unattended in unlocked states. --- ## Three Things Locked Use Refuses to Do Even with the plug-in installed and all permissions granted, Locked Use has hard limits. Codex cannot automate[^1][^3]: 1. **Terminal apps.** Automating Terminal, iTerm, or any shell session through Computer Use is blocked — that path could bypass Codex's own sandbox and approval rules for shell commands. 2. **Codex itself.** Codex won't drive its own UI through Computer Use, for the same security-self-reference reason. 3. **System-level admin prompts.** The plug-in can unlock the screen for a Computer Use turn, but it can't authenticate as an administrator or click through privacy/security permission dialogs. Anything that requires `sudo`-style elevation still needs you. These aren't bugs — they're deliberate scope cuts to keep the lock-screen unlock from becoming a generic privilege-escalation primitive. --- ## Why It's Off in the EEA, UK, and Switzerland The Codex documentation states plainly that Computer Use, including Locked Use, is "currently available on macOS, except in the European Economic Area, the United Kingdom, and Switzerland at launch"[^3]. OpenAI hasn't published a detailed legal rationale, but the pattern matches how the company has rolled out other agentic features: launch in the U.S. and other markets first, then expand to GDPR-and-DSA-adjacent jurisdictions after the regional compliance review is done. Expect the regional exclusion to be temporary, not permanent. If you're a developer in those regions, the rest of Codex still works — you just won't see the **Computer Use** install option in settings yet. --- ## Codex Locked Use vs. Claude Computer Use on Mac Anthropic brought Computer Use to the Claude Mac desktop apps (Claude Cowork and Claude Code) on March 23, 2026 — about two months before OpenAI's Locked Use update[^7]. (Claude's underlying Computer Use capability has existed as a public-beta API since October 22, 2024[^14], but March 2026 was the first time it shipped as a built-in Mac-app feature.) Claude's version uses a similar permission-first model — per-app approval, requires Accessibility. But Claude's Computer Use does not survive the lock screen: the agent halts when the display turns off, and there is no published Anthropic-side mechanism to unlock the Mac mid-task[^7][^10]. | Capability | Codex (May 21, 2026) | Claude (March 23, 2026) | |---|---|---| | GUI control on macOS | Yes[^3] | Yes[^7] | | Operates while Mac is locked | **Yes** — via Apple authorization plug-in[^2] | **No** as of May 2026 | | Per-app approval flow | Yes, with "Always allow"[^3] | Yes, permission-first[^7] | | Remote control from phone | Yes — via Codex Mobile in the ChatGPT app[^5][^6] | Yes — Claude Code Remote Control on iOS/Android[^11] | | Available regions at launch | U.S. + most markets; not EEA, UK, Switzerland[^3] | Available where Claude Pro / Max are sold[^7] | | Windows / Linux Computer Use | Codex desktop on Windows since March 4, 2026, but Computer Use is macOS-only[^12] | Not yet shipped at the OS-control level[^7] | The headline difference is the lock screen. For multi-hour or overnight workflows — refactoring a large codebase, running a UI test suite, scraping a desktop app for a one-time data migration — Locked Use is the only option that lets the agent keep going without someone physically guarding an unlocked laptop. --- ## How It Stacks With the Rest of the May 21 Release Locked Use didn't ship alone. The same May 21, 2026 release rolled out three other developer-facing features[^1][^13]: - **Goal Mode → GA.** Goal Mode — Codex's mode for "give me a milestone, keep working until you reach it, across hours or days" — moved from beta to general availability in the Codex app, IDE extension, and CLI[^13]. - **Appshots.** A new `Command-Command` shortcut on Mac that captures the frontmost window — screenshot plus any exposed text, including content outside the visible scroll region — and injects it as an attachment into the current Codex thread. Appshots is macOS-only for now[^13]. - **Remote / locked Computer Use from Codex Mobile.** The mobile counterpart to Locked Use: fire off a Computer Use task from the ChatGPT app on your phone, walk away, and the Mac executes it under lock[^1]. The combination is what makes the release meaningful as a product move, not just a feature drop. Goal Mode lets you scope a multi-hour milestone. Appshots is how you hand off rich GUI context to the agent without describing every window in prose. Locked Use is how the agent keeps working after you've closed the laptop and gone home. Codex Mobile is the trigger from anywhere. --- ## Frequently Asked Questions ### Is Codex Locked Use a remote-unlock for my Mac? No. The Apple authorization plug-in only unlocks the Mac during an active, trusted Computer Use turn that you (or your phone) explicitly started. It does not let you log into your Mac remotely for other purposes, and any local input — touching the keyboard or trackpad — instantly relocks the system[^2]. ### What permissions does Codex need on macOS? Two system permissions, both granted in System Settings → Privacy & Security: **Screen Recording** so Codex can see the target app, and **Accessibility** so Codex can click, type, and navigate. App-level approvals are separate, and you grant them on first use per app[^3]. ### Can I use Locked Use in Europe? Not at launch. OpenAI's documentation explicitly excludes the European Economic Area, the United Kingdom, and Switzerland from initial availability[^3]. Other Codex features still work in those regions. ### Does it work on Windows? No. The Codex desktop app has run on Windows since March 4, 2026, but Computer Use — locked or unlocked — is currently macOS-only[^12]. ### How is this different from Codex Mobile? Codex Mobile, launched May 14, 2026, is the iPhone and Android remote-control surface for a Codex session running on your Mac[^5][^6]. Locked Use is the macOS-side capability that keeps the session alive when the screen locks. You typically use them together: send the task from your phone, let Locked Use carry it out on a locked Mac. ### Can my company turn this off? Yes. Enterprise admins and owners can disable remote/locked Computer Use organization-wide by setting `remote_computer_use = false` in Policies & Configurations inside Codex cloud[^4]. ### Does Anthropic have an equivalent? Not yet. Claude shipped Computer Use on Mac in March 2026, but as of late May 2026, Claude does not operate on a locked Mac. If your workflow requires the agent to run with the screen off, Codex is the only first-party option among major coding agents[^7][^10]. --- ## Bottom Line The lock screen has been the last visible failure mode for Mac coding agents since computer-use shipped industry-wide. With Locked Use, OpenAI moved Codex past that barrier by leaning on a part of macOS — authorization plug-ins — that Apple built for legitimate enterprise identity tools and exposed safely behind explicit user permission. The result is the first major coding agent that can credibly run a multi-hour task while the laptop is closed. The interesting question now is how the rest of the field responds. Claude's Computer Use is already feature-comparable when the screen is awake, and Anthropic ships fast — a lock-screen equivalent before the end of Q3 2026 would not be surprising. Cursor's cloud agents already sidestep the problem by running in remote VMs. The local-Mac-with-lock-screen path is just one architecture, but it's the one most developers run today, and OpenAI shipped first. If you're already running Codex on a Mac in the U.S. or a non-restricted market, installing the Computer Use plug-in and enabling Locked Use is a five-minute setup. The bigger decision is whether your team is comfortable letting an autonomous agent operate a logged-in macOS session unattended — and that's a policy question, not a technical one. For high-trust use cases (a single-developer Mac, scoped to a specific app), the safeguards are genuinely thoughtful. For multi-user or regulated environments, the `remote_computer_use = false` policy override is the right starting point until you've reviewed how Codex handles your data. Locked Use is small in code and large in implications. It says: agents are not just "computer use" demos anymore. They're shift-workers. --- ## Sources [^1]: MacRumors, "OpenAI's Codex Can Now Use Your Mac Even When It's Locked," May 22, 2026. [https://www.macrumors.com/2026/05/22/codex-use-mac-apps-when-locked/](https://www.macrumors.com/2026/05/22/codex-use-mac-apps-when-locked/) [^2]: OpenAI, "Changelog – Codex," May 21, 2026 entry on remote computer use. [https://developers.openai.com/codex/changelog](https://developers.openai.com/codex/changelog) [^3]: OpenAI, "Computer Use – Codex app." [https://developers.openai.com/codex/app/computer-use](https://developers.openai.com/codex/app/computer-use) [^4]: OpenAI Codex enterprise configuration reference (Policies & Configurations). [https://developers.openai.com/codex/enterprise/managed-configuration](https://developers.openai.com/codex/enterprise/managed-configuration) [^5]: 9to5Mac, "OpenAI brings Codex to ChatGPT for iPhone, iPad, and Android with these features," May 14, 2026. [https://9to5mac.com/2026/05/14/openai-brings-codex-control-to-chatgpt-for-iphone-and-android/](https://9to5mac.com/2026/05/14/openai-brings-codex-control-to-chatgpt-for-iphone-and-android/) [^6]: TechCrunch, "OpenAI says Codex is coming to your phone," May 14, 2026. [https://techcrunch.com/2026/05/14/openai-says-codex-is-coming-to-your-phone/](https://techcrunch.com/2026/05/14/openai-says-codex-is-coming-to-your-phone/) [^7]: 9to5Mac, "Anthropic is giving Claude the ability to use your Mac for you," March 23, 2026. [https://9to5mac.com/2026/03/23/anthropic-is-giving-claude-the-ability-to-use-your-mac-for-you/](https://9to5mac.com/2026/03/23/anthropic-is-giving-claude-the-ability-to-use-your-mac-for-you/) [^8]: OpenAI, "Codex for (almost) everything," April 16, 2026. [https://openai.com/index/codex-for-almost-everything/](https://openai.com/index/codex-for-almost-everything/) [^9]: Apple Developer Documentation, "Extending authorization services with plug-ins." [https://developer.apple.com/documentation/security/authorization_plug-ins/using_authorization_plug-ins](https://developer.apple.com/documentation/security/authorization_plug-ins/using_authorization_plug-ins) [^10]: Anthropic, "Let Claude use your computer from the CLI." [https://code.claude.com/docs/en/computer-use](https://code.claude.com/docs/en/computer-use) [^11]: MacRumors, "Anthropic's Claude AI Can Now Use Your Mac While You're Away," March 24, 2026. [https://www.macrumors.com/2026/03/24/claude-use-mac-remotely-iphone/](https://www.macrumors.com/2026/03/24/claude-use-mac-remotely-iphone/) [^12]: SmartScope, "OpenAI Codex Desktop App Major Update (April 2026)." [https://smartscope.blog/en/generative-ai/chatgpt/codex-desktop-major-update-april-2026/](https://smartscope.blog/en/generative-ai/chatgpt/codex-desktop-major-update-april-2026/) [^13]: 9to5Mac, "Codex for Mac updated with new Appshots feature that instantly gives chat context," May 21, 2026. [https://9to5mac.com/2026/05/21/codex-for-mac-updated-with-new-appshots-feature-that-instantly-gives-chat-context/](https://9to5mac.com/2026/05/21/codex-for-mac-updated-with-new-appshots-feature-that-instantly-gives-chat-context/) [^14]: Anthropic, "Introducing computer use, a new Claude 3.5 Sonnet, and Claude 3.5 Haiku," October 22, 2024. [https://www.anthropic.com/news/3-5-models-and-computer-use](https://www.anthropic.com/news/3-5-models-and-computer-use)