In a blind security audit of my own code, Codex and Claude Code tied: both re-found the same known bugs, and then each found a real vulnerability the other missed. Codex caught a code-execution path; Claude Code caught a stored cross-site-scripting hole. So for a job that matters, the honest answer to "which is better" is to run both.
Most Codex vs Claude Code comparisons race the two agents through a toy task, a todo app or a snake game, and score the screenshots. That tells you almost nothing, because a toy has nowhere to hide a real mistake. I wanted a test where being wrong had consequences, on code I actually own.
So I gave both agents the same job: audit Bird CMS, the open-source engine that runs this site and a dozen others of mine, for security vulnerabilities. Real code, my code, and a missed hole is a missed hole on production.
Why run the test on my own code?
A few weeks earlier an independent researcher had emailed me a security report against Bird CMS. Good report, coordinated, no drama. I fixed the issues and shipped the release. That left an itch: a careful human found those. Would a coding agent find them cold? And more to the point, would it find anything the human missed?
That question only means something if the test is honest, so I built it to be:
- Both agents got the exact same snapshot of the code, taken from before that fix, so the known bugs were present and there was a known answer to grade against.
- Both got the same neutral instruction: audit this codebase for security vulnerabilities. No hint about where to look. No mention that a report already existed.
- I stripped anything that could tip either one off. Fresh copy, no version history to read the future fix out of, no project notes.
- I did not trust either agent's word. Every finding I traced back through the real, current code myself before believing it.
Then I ran each one blind and compared what came back.
What did Codex find?
Codex re-discovered the known issues on its own, working with no idea they were the known issues. Then it found one nobody had reported, and it was the worst of the lot.
Bird CMS lets you override which template renders a given URL, through its /api/v1/url-meta endpoint. Codex saw that the template value was stored exactly as sent, with no validation, and that the renderer later turned it into a file path, views/<template>.php, and ran it. Nothing stopped that value from climbing out of the theme's views folder with a ../. Combine it with a file uploaded through the same API, and a plain write-scoped key becomes remote code execution on the server. In the advisory that is the CWE-22 / CWE-98 issue.
That was the single deepest finding in the whole exercise, from either agent. I confirmed it by hand against the live code. It is exactly the kind of multi-step bug that is easy to miss because no single line looks dangerous; you only see it when you connect the unchecked write in one file to the require in another. Codex connected them, in about four minutes, and handed back a tight, ranked report.
What did Claude Code find?
Claude Code re-discovered the known issues blind too, then went wide rather than deep. Its headline find was a stored cross-site-scripting hole in the markdown renderer: link and image URLs were written straight into the HTML with no escaping and no check on the scheme. A link written as click, or an image address carrying a stray double quote, would break out of the attribute and run script in the visitor's browser. Because the same markdown flows through the write API, a low-trust API key, not just the admin, could plant it. That is the CWE-79 issue in the advisory.
It flagged two more that made the release: the REST upload accepted SVG files, which get served from your own domain and can carry a <script> tag, and the admin article editor built file paths straight from the submitted category field, so a signed-in admin could write a file outside the content directory. It also wrote a section listing what it had checked and judged safe, the login flow, the database queries, the token signing, and why. On a security review, knowing what was examined and cleared is worth almost as much as the findings.
It missed the code-execution path that Codex caught. It looked at the nearby upload and asset code, decided traversal was blocked there, and never chased the template override that led to the real problem. It took roughly ten minutes and thought out loud more along the way.
Codex vs Claude Code: which found more?
Neither. Both, working blind, re-found every issue the human researcher had reported. Beyond that, each caught something the other did not:
| Codex | Claude Code | |
|---|---|---|
| Re-found the known bugs (blind) | Yes | Yes |
| Its own unique find | Remote code execution via the URL-template override | Stored XSS in the markdown renderer (plus SVG upload, category path traversal) |
| Reported what it checked and cleared | No | Yes |
| What was doing the work | One model, start to finish | A system routing across more than one model |
| Cost shape | Flat, inside a subscription | Metered per run |
| Roughly how long | ~4 minutes | ~10 minutes |
There is no winner in that. One agent caught the deepest single bug; the other swept wider and showed its work. The useful conclusion is that two different sets of blind spots caught more than either would alone.
What is different in practice?
The findings were a tie. The practical differences were not, and they are the part most comparisons skip.
Claude Code is not one model, and you cannot make it one. I tried to run it as a single named model for a clean comparison. Even with its helper agents switched off and nothing spawning in the background, it still ran a larger model underneath, doing more of the work than the model I had selected. That is not a bug, it is the design: Claude Code is a system that routes work across models, not a single model you drive. Codex, in this test, ran as one model start to finish. If you care about knowing exactly what is doing your work, that difference is real.
The cost shapes are different. Codex ran inside a monthly subscription I already had, so there was no per-run price to watch; it just ran. Claude Code metered each run, and the runs added up over an afternoon. One of them even finished with an empty report after doing the work, and I paid for that one too. Neither model is wrong, but a metered tool and a flat-rate tool feel very different when you are iterating.
Speed and verbosity differ. Codex was faster and terser. Claude Code took longer, thought out loud more, and produced the wider write-up with the "what I checked" section. Which you prefer depends on whether you want a quick answer or a paper trail.
What happens after an AI finds a real bug?
The new findings were real, so this could not stop at a blog post. I fixed all of them, added tests that fail on the old code and pass on the fixed code, shipped a new release of Bird CMS, and updated every site I run on the engine before saying a word in public. Only then did I publish the security advisory, so anyone else running the CMS could upgrade.
The order matters and it is the same order any disclosure should follow: fix it, test it, ship it, patch your own systems, then tell the world. An AI agent can find the hole for you. It does not change what you owe everyone downstream once you know.
So, should you use Codex or Claude Code?
For coding day to day, this test does not crown one. It shows two capable agents with different shapes. If the work is important and you can afford it, run both and diff the results; on a security pass, their different blind spots were the whole point. If you have to choose one, choose on the trade-off, not a scoreboard: Codex here was the single strong model, flat-rate, and it found the deepest bug; Claude Code swept wider, told me what it had cleared, and is a multi-model system that meters as it goes.
The thing I did not expect walking in was how useful it was to have both wrong in different directions. One human and two agents, each blind to what the others saw, and together they found more holes in my code than any of them alone. That is the real headline, and it is not about which logo wins.
Related guides
Frequently asked questions
Is Codex or Claude Code better? In this security-audit test, neither. Both re-found the same known bugs blind, then each found a real vulnerability the other missed: Codex caught a code-execution path, Claude Code caught a stored cross-site-scripting hole and reported what it had checked and cleared. For important work, running both and comparing caught more than either alone.
Which model does each one use? Codex ran as a single model start to finish. Claude Code is a system rather than a single model: even pinned to one model with its helper agents disabled, it still routed part of the work to a larger model underneath. If you need to know exactly what is doing the work, that is a real difference.
Can AI coding agents actually find real security vulnerabilities? In this test, yes. Working blind, both agents re-discovered every issue a human researcher had reported earlier, and each surfaced a genuine new one that was confirmed by hand against the live code. They are useful as an extra set of eyes, not a replacement for verifying each finding yourself.
How much does each one cost to run? The shapes differ more than any single number. Codex ran inside a monthly subscription, so individual runs had no separate price. Claude Code metered each run, so an afternoon of iterating added up, including one run that produced nothing and still billed. A flat-rate tool and a metered one feel different in practice.
Did you trust the AI findings without checking them? No. Every finding was traced back through the real, current code by hand before it was believed, and each fix ships with a test that fails on the old code and passes on the new. An agent pointing at a suspected bug is a lead, not a verdict.
