Codex vs Claude Code: pricing, limits and guardrails

What this comparison is, and what it is not

Let us start with the conflict of interest, because it is real. This site already publishes a practice guide and a pricing page on Claude Code, and the agency uses it daily. You are entitled to distrust a comparison written here.

The safeguard is one rule: everything below comes from both vendors' public documentation, checked on 3 August 2026, with the links at the bottom of the page. No benchmark, no productivity percentage, no in-house measurement presented as fact. Where a figure is missing, the article says so instead of estimating it.

What remains checkable is already a lot: both price ladders, how each vendor communicates about quotas, and above all the guardrails applied by default. That last point is what decides the matter in a company, and it is the one no comparison treats seriously.

Two almost identical price ladders

The first surprise, putting both ladders side by side, is how closely they match on the tiers that matter.

Price is therefore not a deciding factor. At $20, $100 and $200 you pay the same on both sides, and the team seat matches too. The only structural difference is OpenAI's $8 Go tier, which has no Anthropic equivalent and targets light use.

One detail not to miss on the Sonnet 5 API rate: the $2 and $10 are introductory, valid through 31 August 2026. After that the rate moves to $3 and $15, fifty per cent more. If you are building a twelve-month budget on that model, use the later rate.

Quotas: one vendor publishes a number, the other does not

This is the first real difference, and it is about transparency rather than technology.

OpenAI documents a consumption unit. Its pricing page states that GPT-5.6 usage averages between 5 and 40 credits per message, and lets you buy extra credits when you hit your limit. It is imprecise, the range spans a factor of eight, but it is an order of magnitude you can build an estimate on.

Anthropic publishes no number. Quotas are relative: Pro gives at least five times Free usage per session, Max gives five or twenty times Pro. The mechanics are documented, a rolling five-hour window with weekly limits on top for paid plans, but the absolute value stays invisible until you open your own account's usage panel.

Both share one identical and rarely flagged trap: the quota is common to chat and to the coding agent. A long conversation eats into the coding budget, and the reverse holds. In a team this is hard to diagnose, because the symptom is a limit reached with no matching coding work.

One last calendar point, useful if you are reading older comparisons: Anthropic doubled Claude Code's five-hour limits on 6 May 2026 and removed the peak-hours reduction for Pro and Max. Every consumption benchmark published before that date is stale.

Default guardrails, the real point of divergence

Both tools build on the same system primitives, Seatbelt on macOS and bubblewrap on Linux, and both cleanly separate two layers: a technical boundary saying what a command can reach, and an approval layer saying when to ask you. Same architecture in principle.

The difference that matters is in reads, not writes. Anthropic's documentation is explicit on a point nobody relays: by default the sandbox allows reading the entire computer, including ~/.aws/credentials and ~/.ssh. You have to declare a sandbox.credentials block to block those reads and unset sensitive environment variables. Until you do, a compromised command can read your keys.

Anthropic also documents the limit of its network filtering, which is rare and honest: the proxy decides from the client-supplied hostname without terminating TLS by default, so a domain-fronting style technique can leave the allowlist. If your threat model needs better, you have to wire in your own proxy that inspects traffic.

On the Codex side, the agent phase of cloud runs is offline by default, and secrets are only available during the setup phase before being removed. That is a stricter design for unattended work, and it is a real argument if you run agents with nobody watching the screen.

How to decide without spending a quarter on it

Since prices are identical and the architectures close, the choice comes down to concrete constraints rather than preference.

One methodological note that applies to both. The project instruction file, CLAUDE.md on one side and AGENTS.md on the other, does more for output quality than the choice of tool. A repository that spells out its conventions, its test commands and its prohibitions gets far better results from either agent than a silent one.

And if you are still hesitating: both have a free tier. Two half-days on a real task in your own repository will teach you more than any comparison, this one included.