Release notes

FEATURE

Logging in still works even behind a corporate proxy — Windows finally caught up

If your company network routes everything through a proxy (proxy, a middleman server your network requests get handed off through, common on corporate firewalls) before it can reach the internet, Codex's Windows login flow used to not understand that setup. Now you can opt in to support for PAC (auto-config scripts), WPAD (auto-discovering the proxy), static proxy addresses, and bypass rules for which destinations skip the proxy. It's like a mailbox rule that always required mail to go through the building's security desk first — the system finally understands that rule, so your mail doesn't get stuck halfway.

FEATURE

When the AI needs a plugin tool, it now searches for it first — faster and more accurate

When you've hooked up a lot of MCP servers (Model Context Protocol, the standard that lets the AI talk to external tools), the AI used to have to memorize every tool's full instruction manual just to know what was available. Now, where supported, the AI uses tool search instead (tool search, looking up the specific tool it needs on demand rather than memorizing the whole catalog), finding tools more accurately, while older models and plugins keep working fine. It's like having to memorize every book title on a whole library floor just to find one useful book — now you just search for what you want and get pointed straight to the shelf.

FEATURE

Plugin icons no longer clash in dark mode — developers can ship a dedicated dark version

Plugin (plugin, an add-on package that extends Codex with extra features) developers can now ship a dedicated dark-mode (dark mode, the dark-background display mode meant for low-light use) icon, supplied through the plugin's own manifest or a remote plugin store, which swaps in automatically when you switch to a dark interface — no more glaring light-colored icons sitting on a dark background.

BUGFIX

Expired Amazon Bedrock credentials now tell you exactly how to fix it, not just "unauthorized"

If you connect to a model through Amazon Bedrock (Amazon's cloud AI platform), expired credentials (credentials, the keys that prove you're allowed to use the service) used to just throw a vague 'unauthorized' error, leaving you to guess what actually went wrong. Now it tells you exactly what to do and how to get a valid credential again. It's like an ATM that used to just say 'card problem' now spelling out 'card expired, please get a new one at the counter.'

FEATURE

When a remote image link fails, the AI now understands why instead of failing silently

If you point the AI at a remote image link (HTTP/HTTPS image, a picture that lives on a server elsewhere and only loads via its URL), problems with the format or source used to silently stall or fail the whole flow with no clear reason. Now the system produces a clear validation error the AI itself can read and understand — 'here's why this image didn't work' — while inline pasted image data (data URLs) and local files are unaffected and keep working.

FEATURE

PowerShell commands with unreadable executable code now get held for your approval, not waved through

The safety classifier (safety classifier, the system that automatically judges whether a command is safe and decides whether to ask your permission first) used to sometimes wave through PowerShell (Windows's scripting language) commands containing executable code regions (AST, abstract syntax tree, a structured breakdown of code that computers can parse) it couldn't actually parse — treating 'can't read it' as 'must be safe.' Now anything the classifier can't read gets stopped for your manual approval instead, closing that 'unreadable so let it through' loophole. It's like customs that used to sometimes wave through suspicious items it couldn't identify; now anything it can't identify gets pulled aside and opened up first.

FEATURE

Picking an incompatible model in Code Mode now gets you a warning up front

Code Mode (a mode where the AI calls tools by writing code directly instead of issuing commands one at a time) needs the model to supply specific metadata (metadata, extra information describing which features a model supports) to work properly. Picking an unsupported model used to just fail silently and leave you confused. Now the system proactively warns you up front: 'this model might not work well this way.'

Original changelog

Original changelogLogging in still works even behind a corporate proxy — Windows finally caught up
Added opt-in Windows system proxy support for authentication, including PAC, WPAD, static proxies, and bypass rules.
Original changelogWhen the AI needs a plugin tool, it now searches for it first — faster and more accurate
MCP tools now use tool search by default when supported, improving tool discovery while preserving compatibility with older models and providers.
Original changelogPlugin icons no longer clash in dark mode — developers can ship a dedicated dark version
Plugins can provide dedicated dark-mode logos through local manifests and remote catalogs.
Original changelogExpired Amazon Bedrock credentials now tell you exactly how to fix it, not just "unauthorized"
Expired Amazon Bedrock credentials now produce actionable recovery guidance instead of a generic authorization error.
Original changelogWhen a remote image link fails, the AI now understands why instead of failing silently
Remote HTTP(S) image inputs now return clear model-visible validation errors; inline data URLs and local images remain supported.
Original changelogPowerShell commands with unreadable executable code now get held for your approval, not waved through
PowerShell commands containing executable AST regions the safety classifier cannot inspect now require approval.
Original changelogPicking an incompatible model in Code Mode now gets you a warning up front
Code Mode now warns when the selected model lacks the required metadata.