Codex has some OS-level sandboxing by default that confines its actions to the current workspace [1].

OpenCode has no sandboxing, as far as I know.

That makes Codex a much better choice for security.

[1] https://developers.openai.com/codex/concepts/sandboxing