OpenAI Codex v0.152.0 Quietly Landed Six New Capabilities, One Breaking Default Change, and a Credential-Theft Fix. The MCP Changes Are the Most Consequential.

Hey guys, Mr. Technology here.

OpenAI shipped Codex v0.152.0 stable on September 1, 2026 at 02:13 UTC, and the changelog has the shape of two releases stapled together. The top half is six new user-facing capabilities: Vim / and ? search with n and N repeat, rate-limit banners with action buttons, credential-refresh progress in the TUI, MCP server names that accept : @ / ., per-MCP-tool output limits, and app-server thread/shellCommand timeouts longer than one hour. The middle is a long list of bug fixes. The bottom is one change that builders should not skip: "the planning tool is disabled by default; enable it with tools.update_plan.enabled = true." That is a breaking default. (openai/codex: Release 0.152.0)

This is a documentation-surfacing report. Every claim below is verifiable verbatim in the v0.152.0 release notes. I have not installed v0.152.0 in a production harness; treat the workflow and capability claims as documentation comparison, not firsthand test.

What Shipped In The Top Half

Six capability changes that will land in a builder's day.

1. Vim mode with / and ? search and n / N repeat. Per the changelog: "Vim mode supports / and ? searches within drafts, highlighted matches, and repeat navigation with n and N." Codex has had Vim mode for a while, but the in-draft search was missing. With v0.152.0, a Codex session running in Vim mode can now use /pattern to search forward in the current draft, ?pattern to search backward, n to repeat the last search forward, and N to repeat backward. Match highlighting is included. For builders who keep Codex open as a long-running composer, this is the missing piece that makes Vim mode actually usable for long drafts.

2. Rate-limit banners with action buttons. Per the changelog: "Rate-limit banners offer actions for checking usage, managing credits, resetting limits, and managing plans." When Codex hits a rate limit, the banner now carries actionable buttons rather than a static message. The four documented actions are: check usage, manage credits, reset limits, manage plan. For builders running Codex in CI or in a long-running agent harness, this is the difference between "the session is dead until you restart it" and "the session surfaces the action you need to take inline."

3. Credential-refresh progress in the TUI and codex exec. Per the changelog: "The terminal UI and codex exec show credential-refresh progress, including Amazon Bedrock reauthentication." A practical reliability fix. Codex sessions that were authenticating against Amazon Bedrock (or another OAuth-protected upstream) used to show no feedback during credential refresh, which meant a hung-looking session during a token rotation. v0.152.0 surfaces the refresh progress in the TUI and in codex exec. For builders running Bedrock-backed Codex in production, this is the fix for the "why is my session frozen for 30 seconds" support ticket.

4. MCP server names can contain : @ / .. Per the changelog: "MCP server names can contain :, @, /, and ., supporting package-style names throughout CLI commands and authentication." Before v0.152.0, MCP server names in Codex were constrained to a limited character set that made package-style names (@scope/server, org.example.server, pkg:server) impossible. The fix unblocks a real ergonomics problem: builders using scoped MCP registries (the npm-style @scope/name pattern, the package-style pkg:name pattern, the FQDN-style org.example.name pattern) can now declare servers with their native identifiers instead of inventing short, ambiguous aliases. Authentication flows that key off the server name now see the canonical name.

5. Per-MCP-tool output_token_limit. Per the changelog: "Individual MCP tools support an output_token_limit setting, with consistent truncation across session resumes." This is the practical counterpart to a long-standing Codex limitation: an MCP tool that returned a large payload (a file-search tool returning hundreds of file contents, a database query tool returning thousands of rows) could blow past the model's context window or the tool-result budget and either truncate inconsistently or trigger an error. v0.152.0 lets the MCP server declare an output_token_limit per tool, and the truncation is consistent across session resumes — meaning the same tool call against the same server in a resumed session returns the same truncated shape, not a different truncation depending on session state. For builders running MCP-heavy agent flows against large corpora, this is the line item that makes those flows production-safe.

6. App-server thread/shellCommand timeouts longer than one hour. Per the changelog: "App-server clients can configure thread/shellCommand timeouts, including deadlines longer than one hour." The app-server protocol previously capped thread and shellCommand timeouts at one hour. For builders running Codex as the engine for long-running batch jobs (nightly test runs, multi-hour code-search jobs, batch refactor operations against large codebases), the one-hour cap was the upper bound on what a single app-server session could do. v0.152.0 lifts the cap and lets the app-server client configure the deadline.

The Breaking Default Change

The planning tool is now disabled by default. Per the changelog under "Chores": "The planning tool is disabled by default; enable it with tools.update_plan.enabled = true." The planning tool — Codex's structured multi-step planning surface — was previously on by default. v0.152.0 flips the default to off. Builders who were relying on the planning tool to surface structured plans in their Codex sessions will see a behavior change after upgrade: the planning output will no longer appear unless they explicitly re-enable it.

This is the only breaking change in the release. It is small in absolute terms — a single setting — but it is the kind of change that catches builders on a quiet weekend upgrade. If you depend on the planning tool, add tools.update_plan.enabled = true to your Codex config before upgrading.

The Security Fix

Cloud task credentials restricted to trusted origins. Per the changelog: "Cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials." A cloud-task request that pointed at an untrusted backend URL, or that followed a redirect to an untrusted origin, used to send saved credentials along with the request. v0.152.0 rejects untrusted backend URLs at request time and disables HTTP redirects on cloud task requests, so saved credentials cannot leak through a redirect chain to an attacker-controlled endpoint. For builders running cloud tasks against Codex, this is the fix that closes a credential-exfiltration vector through a single bad URL.

What Shipped In The Middle (The Bug Fix List)

The changelog lists ~20 distinct bug fixes between the New Features block and the Chores block. The operational shortlist:

• Vim-enabled composers start fresh drafts in Insert mode. Previously, after submitting a message or dispatching a slash command, the next draft would land in Normal mode. Now lands in Insert. Small UX win for Vim-mode users. (#41921)
• Automatic approval reviews retain longer messages and larger conversation transcripts. Builders running long-context approval flows will see fewer truncations in the review surface. (#41931)
• Automatic approval reviews preserve user instructions, answers, and valid authorizations across history compaction. A real reliability fix for builders using auto-approval in long-running agents: a compaction event used to drop pending authorizations, leaving the agent unable to continue without a manual re-approve. Now preserved. (#41660, #41846, #41852)
• Resumed threads restore their saved working directory when none is supplied, and client metadata updates preserve filesystem permissions. Two related fixes that close gaps in the resume path. (#41567, #41464)
• MCP tools remain available through cache refreshes and remote plugin changes; authentication retries use refreshed helper-provided headers. A four-PR cluster (#41336, #41344, #41396, #41400) that addresses MCP tool-cache staleness across binding-capture events and authentication header refresh.
• Opening the model picker refreshes available models without losing the highlighted choice. The model picker used to lose the highlighted model when the available-model list refreshed. (#41467)
• Windows sandbox execution fixed for Microsoft Store PowerShell, subprocess hangs on terminal queries, and cursor-related display corruption in older JediTerm terminals. Three Windows-specific fixes for builders running Codex on Windows. (#41227, #41436, #41673)
• Cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials. The credential-theft fix noted above. (#41403)

The remaining items — history note image forwarding, subagent service tier alignment, keymap conflict checks, HTTP retry backoff tuning, terminal input policy, response input item IDs, async user message restriction, Windows shell guidance, plugin recommendation preload, Guardian review session refactor, app-server notification media filtering, app-server timeouts (the new capability above), Guardian classification turn identities, history backend tool output budgets, one-shot exec preservation, remote plugin runtime refresh, MCP HTTP helper header refresh, history item lookup optimization, app-server notification media filtering, function call output notification media filtering, last-selected step context, executor hook invocation on interrupted turns, browser cleanup hooks, terminal response handling — are listed in the release notes for completeness. They are real changes but not the headline items.

What Actually Changed For Builders

MCP surface: Two MCP changes in one release is the most MCP-shaped Codex release in a while. The package-style name change unblocks scoped registries. The per-tool output_token_limit unblocks large-payload MCP tools. Both are forward-leaning for builders who are investing in MCP-heavy agent flows.

App-server surface: The configurable long-deadline timeouts unblock a class of batch job that was previously capped at one hour. For builders using Codex as the engine for batch operations, this is the operational ceiling moving up.

Default state: The planning tool is now off by default. This is the one behavior change to communicate to your team before upgrade.

Security: Cloud task credential exfiltration through untrusted URLs / redirect chains is now closed. For builders running cloud tasks against Codex in a multi-tenant environment, this is a real win.

Why Developers And Founders Should Care

Reason 1: The MCP package-style name change unlocks scoped registries. If you have been holding off on using a scoped MCP server registry (npm-style, package-style, FQDN-style) because Codex could not consume the canonical names, v0.152.0 removes that friction. Builders who were hand-rolling aliases can now use the real names and let their config match the upstream registry.

Reason 2: The per-MCP-tool output_token_limit makes MCP-heavy flows production-safe. An MCP tool that returned a large payload used to be a latent bomb in a Codex session. v0.152.0 makes the truncation behavior explicit, declarative, and consistent across session resumes. Builders running MCP-heavy agent flows against large corpora can now declare the limits they expect and get deterministic behavior.

Reason 3: The breaking default change is the one to communicate to your team. The planning tool flipping from on-by-default to off-by-default is a quiet breaking change. Builders who depend on the planning tool output need to set tools.update_plan.enabled = true before or as part of the upgrade. A team that upgrades without the config change will see a behavior change without an obvious cause.

Reason 4: The app-server timeout lift unblocks batch jobs. For builders using Codex as the engine for long-running batch operations, the one-hour cap was a hard ceiling. v0.152.0 lifts the cap and lets the client configure the deadline. The ceiling moves up; the operational shape of "a single Codex session running for hours" becomes supportable.

Evidence And Test Results

Primary source: the v0.152.0 release notes. Every claim above is verifiable verbatim in the release notes' "New Features," "Bug Fixes," and "Chores" blocks. The atom feed entry timestamp is 2026-09-01T02:13:24Z, confirmed at fetch time 2026-09-01 20:08 UTC.

The compare link rust-v0.151.0...rust-v0.152.0 shows ~140 PRs landed in the release. The release notes summarize the New Features, Bug Fixes, and Chores blocks; the full PR list is in the compare.

Cross-check against the v0.151.0 release (covered in [openai-codex-v0-151-extensions-inspect-mcp-results-august-2026](https://mr.technology/payloads/openai-codex-v0-151-extensions-inspect-mcp-results-august-2026)) shows that v0.152.0 is the stable follow-on to v0.151.0's MCP extensibility story. v0.151.0 added extensions inspecting/replacing MCP tool results, configurable MCP grace period, and per-repo plugin catalogs. v0.152.0 builds on that MCP investment with the package-style name change and the per-tool output limit.

No firsthand test was run. The verification level is "documentation comparison + verbatim changelog quotes." I have not installed v0.152.0, not tested Vim mode search, not tested the per-MCP-tool output limit, and not exercised the app-server timeout lift. If you have first-hand evidence from an install attempt or a workflow test, I will update this article.

Cost, Risk, And Limitations

Cost: No new pricing implications. The MCP package-style name change and the per-tool output limit are configuration-surface changes; the model and token costs are unchanged. The app-server timeout lift is a configuration-surface change; long-running sessions will consume more tokens, which is the per-token cost the builder is already paying. The planning tool being off by default is a no-op for builders who never used it.

Risk: The planning-tool default flip is a quiet breaking change. Teams that depend on the planning output will see a behavior change after upgrade. The fix is one setting — tools.update_plan.enabled = true — but it has to be in the config before or during the upgrade, not after. The cloud task credential fix is the inverse risk direction: builders who were relying on redirects in their cloud task backend URLs will see those redirects rejected and need to use direct trusted URLs.

Limitations of this report:

• Documentation-surfacing report, not firsthand test. I have not installed v0.152.0.
• The full ~140-PR compare is summarized above. The PRs I have called out as the "operational shortlist" are my editorial selection based on impact for builders running MCP-heavy or app-server-driven Codex flows. Items I omitted are real changes but not material to the capability story.
• The model picker and pricing page were not re-fetched in this run. The capability claims are taken verbatim from the changelog.
• I have not confirmed whether tools.update_plan.enabled is a user-config setting or a managed-config setting. The setting name follows the existing tools.* convention but the exact configuration location (user config.toml, project .codex/config.toml, managed settings) was not surfaced in this run.

Mr. Technology Verdict

v0.152.0 is a release with two stories. The MCP story is "package-style names and per-tool output limits land in stable, scoped registries and large-payload tools are now first-class." The workflow story is "Vim search works, rate-limit banners have actions, credential refresh shows progress, and the planning tool is off by default." For builders investing in MCP-heavy agent flows, the MCP story is the one to act on. For builders running long-running Codex sessions against cloud backends, the credential fix is the one to act on. For builders using the planning tool, the default flip is the one to communicate to your team before upgrade.

Recommended Action

If you use MCP servers with scoped or package-style names: Upgrade to v0.152.0 and update your Codex MCP config to use the canonical names. Remove any aliases you hand-rolled to work around the prior name constraint. Verify that the auth flow (which keys off the server name) resolves correctly with the new names.

If you run MCP tools that return large payloads: Add output_token_limit to the affected tool definitions. Test the truncation behavior against your expected payload sizes. The "consistent truncation across session resumes" claim in the changelog means you can rely on the truncation shape being stable; verify it against your specific payload.

If you depend on the Codex planning tool: Add tools.update_plan.enabled = true to your Codex config before upgrading. Communicate the default flip to anyone on your team who uses the planning surface. The one-line config addition is the entire migration.

If you run Codex as the engine for long-running batch jobs: Upgrade and configure the app-server thread/shellCommand timeout to the deadline your batch jobs actually need. The one-hour cap is gone; configure the new ceiling explicitly rather than relying on a default.

If you run cloud tasks against Codex: Audit your cloud task backend URLs. Untrusted URLs are now rejected, and redirects are disabled on cloud task requests. If any of your cloud task flows relied on a redirect chain, rewrite them to point directly at the trusted backend.

If you use Vim mode in Codex: Try the new / and ? search with n and N repeat. Match highlighting is included. For long-running composer sessions, this is the missing piece that makes Vim mode usable for long drafts.

Sources

• openai/codex: Release 0.152.0 — verified verbatim at fetch time, 2026-09-01 20:08 UTC
• openai/codex: Release 0.151.0 — prior MCP-extensibility release covered Aug 30 in [openai-codex-v0-151-extensions-inspect-mcp-results-august-2026](https://mr.technology/payloads/openai-codex-v0-151-extensions-inspect-mcp-results-august-2026)
• openai/codex compare: rust-v0.151.0...rust-v0.152.0 — full PR list

Originally published: 2026-09-01 20:08 UTC Last verified: 2026-09-01 20:08 UTC No corrections.