Three Products, One Word
The question used to come from engineers. This summer it started coming from operations leads, finance managers, and founders who do not write code: "Should we run OpenClaw, Claude Code, or Codex?" They ask because all three get called "AI agents," and because someone on their team has already installed one of them without telling anyone.
We run all three. Claude Code is the tool we build with every day, using skills, subagents, MCP servers, and hooks. OpenClaw runs on a Mac Mini in our office and on a VPS for client automation. Codex handles parallel, sandboxed work out of GitHub. That first-hand experience is what this comparison is built on, and it is why we will tell you up front that these are not three answers to the same question.
OpenClaw is a runtime you host. Claude Code is an agent you direct. Codex is an agent you delegate to. The right choice depends on which of those three verbs your team actually needs.
What Each One Is
OpenClaw: a self-hosted personal agent runtime
OpenClaw is an MIT-licensed, open-source agent that runs on hardware you control and talks to you through messaging apps. The project docs describe it as a multi-channel gateway for AI agents: Slack, WhatsApp, Telegram, Discord, Signal, iMessage, Microsoft Teams, and Google Chat all connect to one always-on assistant. You bring your own model key. It works with Claude, OpenAI, and DeepSeek models, and it will also run fully local models through Ollama, LM Studio, vLLM, or any OpenAI-compatible server, which is the feature that makes it interesting to regulated buyers.
Since February 2026 the project has been stewarded by the OpenClaw Foundation after its creator joined OpenAI. We covered the origin story in our first OpenClaw assessment and the production side in how we use OpenClaw with clients.
Claude Code: Anthropic's agentic coding tool
Anthropic's documentation defines Claude Code as an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools, available in the terminal, IDE, desktop app, and browser. The extension layer is what separates it from a chat window: skills package repeatable workflows as folders of instructions, subagents run in isolated context windows and work in parallel, MCP connects it to Slack, Jira, databases, and your own tooling, and hooks run shell commands or HTTP calls before and after actions.
The piece business buyers miss is headless mode. Pass the print flag and Claude Code runs non-interactively, returns JSON, and drops into CI pipelines or scheduled jobs. That is how we run our nightly lead-attribution check. As a Claude Partner Network member, we have published 204 open-source Claude skills built on exactly this surface.
Codex: OpenAI's coding agent
Codex is OpenAI's coding agent, delivered as an open-source Rust CLI under Apache-2.0, IDE extensions, a desktop app, and a cloud runner you can trigger by tagging it on a GitHub issue. Its distinguishing design is the approval and sandbox model: read-only, workspace-write, or full-access modes, enforced by the operating system itself through Seatbelt on macOS and bwrap plus seccomp on Linux. We compared it surface by surface against Claude Code in Claude Code vs Codex, and that analysis still holds.
Control vs Convenience
This is the real axis. OpenClaw gives you maximum control and asks the most of you in return. You pick the machine, the model, the channels, and the permissions. Nothing leaves your infrastructure unless you route it there. The price is that you also own patching, uptime, and hardening. In our experience a new OpenClaw agent takes two to three days of tuning before it is reliable enough to face a client.
Claude Code and Codex sit at the other end. Both vendors run the model, manage the sandbox for cloud tasks, and ship security fixes without you noticing. You give up model choice: Claude Code runs Claude models, Codex runs OpenAI models. For most businesses that trade is correct. For a firm with a data-residency requirement, or one that wants an agent answering WhatsApp at 2 a.m., it is not.
- OpenClaw: you own the runtime, the keys, and the risk. Always-on by design.
- Claude Code: vendor-managed, deepest extension ecosystem, session-based unless scripted.
- Codex: vendor-managed, strictest default sandbox, built for delegating parallel jobs.
Security: The Incident That Defined OpenClaw's Year
In February 2026, SecurityScorecard found 40,214 OpenClaw control panels reachable from the public internet across 28,663 IP addresses, with roughly 63 percent vulnerable to remote code execution. The root cause was mundane: the gateway bound to every network interface by default, and users installed it on cloud servers without reading the security page. A one-click remote code execution flaw, CVE-2026-25253, was disclosed the same month and patched within a day.
The project responded. The current security docs bind the gateway to loopback by default, require authentication for every connection, default unknown senders to a pairing code, and tell you plainly never to expose the gateway unauthenticated. That is a better posture than most self-hosted software ships with. It does not change the underlying fact: with OpenClaw, you are the security team. We run it with dedicated non-privileged credentials, access to only the tables and endpoints it needs, and confirmation gates on any action that sends a message or changes data.
Claude Code and Codex push the same problem to the vendor and give you controls at the edges. Claude Code's hooks can block a dangerous command before it runs, its permission modes set the baseline for unattended jobs, and bare mode keeps a CI run from loading anyone's local configuration. Codex's OS-enforced sandbox is the most auditable default of the three. Neither has had an exposed-instance problem, because neither exposes an instance.
What Each One Costs
OpenClaw is free software with three real costs: a machine that stays on, model usage, and engineering time. A single agent running around the clock on a frontier model costs us roughly $80 to $150 a month in API calls. Local models remove the API bill but the local-models guidance is candid that comfortable performance means serious GPU hardware, and that small quantized models weaken prompt-injection defenses.
Claude Code is included in every paid Claude plan. Per Anthropic's pricing page, that starts at $20 a month for Pro, with Max tiers from $100 for heavier use and Team seats at $25. Usage beyond plan limits can fall through to API rates.
Codex is bundled into ChatGPT plans from Free through Enterprise. OpenAI's pricing docs list Plus at $20 and Pro from $100, with credits metered by token once included limits run out, and API-key billing for CI.
The Decision Table
| If your team needs | OpenClaw | Claude Code | Codex |
|---|---|---|---|
| An agent that answers Slack or WhatsApp around the clock | Best fit | Possible via scheduled jobs | Not designed for it |
| To build and ship software | Not its job | Best fit | Strong |
| Data that never leaves your hardware | Yes, with local models | No | No |
| Choice of model vendor | Any, including local | Claude only | OpenAI only |
| Auditable source code | Fully open, MIT | SDK open, runtime closed | CLI open, Apache-2.0 |
| Strictest default sandbox | You configure it | Hooks and permission modes | OS-enforced by default |
| Repeatable team workflows | ClawHub skills, vet each one | Skills, subagents, plugins | Cloud tasks from GitHub |
| Who owns security patches | You | Anthropic | OpenAI |
| Entry cost | Free plus model and hardware | From $20 per month | Free tier, $20 for Plus |
Who Should Pick Which
Pick Claude Code if the job is building anything: internal tools, client products, data pipelines, or the automation that runs the business. It is the default we recommend to nearly every company we train, because the skills and hooks layer turns one person's process into something the whole team runs the same way. When the work is large enough, we fan it out across subagents using the approach in our agent orchestration write-up.
Pick Codex if your engineers live in GitHub, want the tightest sandbox with the least configuration, and prefer to delegate scoped tickets rather than steer long sessions, or if the company is already standardized on ChatGPT Enterprise.
Pick OpenClaw if you need always-on agents on messaging channels, model independence, or on-premise data handling, and you have someone who can own a server. Do not pick it because it is free. The model bill and the engineering hours are the real cost.
Most teams should run two. Our own stack is Claude Code to build and OpenClaw to operate, with Codex for parallel sandboxed work when it fits. If you want help deciding where each one belongs in your company, that is the conversation behind our Claude Code consulting engagements.
Update, September 2026: OpenClaw shipped version 2026.8.1, which the project calls OpenClaw 2.0, at the end of August. Per the release notes, it adds guided onboarding that detects existing subscriptions, API keys, and local models, private credential requests that keep secrets out of chat, plugin trust reviews before install, and one-time approval for recurring automations. It narrows the convenience gap described above. It does not change who owns the server.
Sources
- OpenClaw documentation - OpenClaw
- Gateway security - OpenClaw Docs
- Local models - OpenClaw Docs
- How Exposed OpenClaw Deployments Turn Agentic AI Into an Attack Surface - SecurityScorecard
- Researchers Find 40,000+ Exposed OpenClaw Instances - Infosecurity Magazine
- OpenClaw 2026.8.1 release notes - GitHub
- Claude Code overview - Claude Docs
- Run Claude Code programmatically - Claude Docs
- Hooks - Claude Docs
- Pricing - Claude
- Codex CLI - GitHub (OpenAI, Apache-2.0)
- Agent approvals and security - ChatGPT Learn
- Codex pricing - ChatGPT Learn