Claude Cowork and OpenAI Codex are Becoming the Interfaces for Everyday Work

Claude Cowork and OpenAI Codex are Becoming the Interfaces for Everyday Work

What started with coding agents is quietly becoming the place where general business work happens. Claude Cowork and OpenAI's Codex on the desktop are agentic AI tools that run general work directly on an employee's machine, executing code, reading and writing files, browsing the web, and calling external systems through connectors.

Neither was built for engineers, but they were born out of tools that were: Claude Code and the Codex CLI. Those tools automated software work from the terminal, and the desktop apps that grew out of them are now becoming where everyday work gets done, from writing documents to triaging email to pulling reports.

It’s a two-horse race, and we watch the lead change hands as each side ships. That competition is worth paying attention to, because the tool that pulls ahead, if a clear winner emerges, gets to shape how the workforce operates day to day: the surface people work in, the habits they form, the systems their agents reach. The lineage also matters, because the terminal app built to automate software is turning into the interface for the computer itself, and that shift carries real consequences for how security teams think about coverage.

From pair programmer to autonomous coworker

The first act was automating engineering. Claude Code put an agent in the terminal with access to the file system, the shell, and the developer's own credentials. Instead of suggesting completions inside an editor, it could read a repository, plan a change, run the tests, and open a pull request. Codex followed the same arc: early versions were precise and literal, strong at well-specified tasks, and over successive releases they grew faster and better suited to open-ended work.

What made this paradigm stick was running the agent locally. An agent on your machine inherits everything you can reach, and there is a deep well of public material on how to drive a terminal, so the models were unusually good at it. That combination produced a step change in how much a single instruction could accomplish, and it pulled coding agents out of the IDE and into the operating system.

The desktop is the second act

Once an agent can build anything on your machine, it turns out to be useful for almost any work, not just code. People started using coding agents to sort files, draft and send email, assemble reports, and pull research, and the tools followed them there. Cowork is a friendlier surface on top of the same Claude Code foundation. Codex on the desktop took the lessons from the engineering era and wrapped them for general knowledge work, including an in-app browser so the agent can see and act on the same web pages you do.

The pattern we keep seeing is that the agent and the person work the same surface together. You watch what it does, it sees what you are doing, and the two of you trade off in a loop. The agent reads ten thousand pages in a second and handles the detail; you supply the judgment about what matters. For a growing number of teams, that surface is becoming the operating system for daily work, the place where documents get written, inboxes get cleared, and analysis gets done.

These desktop agents also increasingly talk to one or more central agents the organization runs, often reachable from a chat tool, that anyone can hand a task to. Whether that settles into a single company-wide agent or a set of them per team is still an open question. Either way, the desktop surface is where an individual does focused work and the central layer is where the company offloads recurring jobs. Both are becoming normal fixtures of how work gets done, and both expand the set of systems that AI can reach on an employee's behalf.

Cowork opened the door for knowledge work, but Codex has come on strong

Cowork reached non-technical work first, and that head start shaped where it landed. It took the coding-agent paradigm and presented it to people who would never open a terminal, which is a large part of why agentic desktop work reached marketing, operations, legal, and finance as fast as it did. For Anthropic, that early lead in general knowledge work is a credible opening into the enterprise, where the buyer cares less about raw coding benchmarks and more about whether the whole workforce can use the tool safely.

Codex has recently received high praise for our customers, especially for the ease with which it can be used to manage parallel tasks with minimal oversight. Whichever tool is ahead will change from quarter to quarter as each ships new iterations. Trying to crown a winner is the wrong exercise. Both are converging on the same shape, both will likely be present in your environment, and the useful question is how to govern the category rather than which brand to bet on.

How they run, and why the surface area is the real story

Under the hood these tools work alike. They execute code, read and write local files, reach the network, call external services through connectors and MCP servers, and run scheduled or dispatched tasks that can fire when no one is watching. The risk lies in the accumulation of surfaces across browsers, connectors, plugins, etc. Every background task is another path data can take out of the business, and another place a hidden instruction can enter.

Prompt injection ties all of it together. A web page, a document, an email, an MCP response, or a repository instruction file can carry instructions the agent treats as its own. Because of the access these agents have, a successful injection can easily lead to destructive actions or sensitive information going out the door. The defenses that matter are the unglamorous ones. Scope what folders the agent can touch, keep network egress restricted, allowlist connectors and MCP servers, prefer read-only access, and route what telemetry you can to your SIEM.

On the question of which is better secured today, our current read is that Codex gives administrators a somewhat more developed set of enforceable controls, particularly admin-enforced policy files that cap sandbox modes, approval policies, web search, and tooling in ways users cannot weaken. Cowork has a meaningful gap worth flagging: its own activity is currently excluded from Anthropic's audit logs, Compliance API, and data exports, which makes it unsuitable for workloads that require auditability unless you have a tool for analysing and logging OpenTelemetry data. Codex activity, by contrast, is covered by OpenAI's Compliance API for signed-in use. Both Anthropic and OpenAI are iterating rapidly, so treat this as a snapshot rather than a verdict.

What security teams should do now

The same surfaces show up in both tools, so a single posture covers most of the work: decide which capabilities are enabled, who can use them, what each agent can reach, and where the evidence lands. Start restrictive, prove the policy applies to real users, connect the audit trail, and widen access by group and use case.

Harmonic Security has written detailed, configuration-level guides for both Cowork and Codex, so security teams do not have to reverse-engineer the settings themselves. Each walks through the surfaces, the controls available today, and a risk-based rollout. 

For broader audibility and real-time guardrails on employee and agent actions, Harmonic is here to help, and we’d be happy to walk you through how to secure your specific setup.

‍

FAQ

What is the difference between Claude Cowork and Codex?

Both are AI tools that grew out of coding assistants and now run general work on the desktop. Cowork is built on Claude Code and reached non-technical knowledge work early; Codex on the desktop adapted the same engineering-era paradigm for broader use, including an in-app browser. In practice they are converging on the same shape, and most organizations will see both in their environment.

What is the biggest security risk with desktop AI agents?

Prompt injection is the primary risk. Because these agents can write files, browse, call connectors, and run code, hidden instructions in a web page, document, email, or MCP response can hijack their behavior with real consequences. The risk compounds across every surface the agent can touch, so scoping access and restricting egress matter more than any single setting.

Is Codex or Cowork more secure for enterprise use?

Our current read is that Codex offers administrators a somewhat more developed set of enforceable controls, while Cowork activity is currently excluded from audit logs and the Compliance API, which rules it out for workloads that require an audit trail unless you’re able to process OpenTelemetry data. Both are moving quickly, so this is a snapshot rather than a permanent ranking, and the more durable approach is to govern the category with a consistent posture across both tools.

‍