TLDR: Without being told how, Codex found my existing Claude login, installed Claude Code, and recruited it as a sandboxed independent QA agent. It worked, and… what the FUCK. I was having Codex work through a defect review in my AI system, and I wanted an independent QA pass. Apparently Codex decided “independent” meant it shouldn’t just critique its own work from a fresh prompt. So it searched my computer for an existing Claude Desktop or Claude Code installation. It didn’t find a runnable Claude program, but it did find an existing Claude configuration and credentials from a previous login. Then it downloaded Claude Code into a temporary folder. The first installation failed because the setup process couldn’t see the bundled Node runtime. Codex diagnosed the problem, exposed the correct runtime for that one process, and completed the temporary installation without modifying my existing Claude credentials. It confirmed that Claude Code could reuse my OAuth login, launched Claude non-interactively, withheld its own findings so Claude wouldn’t be biased by them, disabled Claude’s editing capabilities, turned off session persistence, and instructed it to perform an independent audit. Claude sat there silently for several minutes. Codex monitored the process, checked whether it had crashed, noticed the low CPU usage, suspected it was waiting on authentication or a model response, and separately verified that Claude Code was logged into my company’s Anthropic account. The first Claude review came back with basically the same defects Codex had found, which was already wild. But Claude couldn’t execute the test suite because Codex had accidentally locked it into plan mode. So Codex copied only the audit inputs into an isolated temporary workspace, kept my live Nexus library completely outside Claude’s working area, gave Claude read and command-execution access inside the sandbox, and launched a second execution-enabled audit. Claude could run the Python tests and adversarial probes without being able to edit or damage the actual system. I did not build an Anthropic API integration. I did not configure MCP between the models. I did not create a multi-agent framework or a Claude connector. Codex looked around, realized Claude Code could be installed and was already authenticated on the machine, and temporarily recruited it as an independent QA agent. To be technically precise, Codex didn’t hack into Claude or bypass authentication. It reused an already-authenticated OAuth session available to my Windows user. Still, what the actual fuck. This wasn’t merely one AI sending a prompt to another AI. Codex acted as the orchestrator. Claude Code acted as the independent auditor. The isolated workspace became the safety boundary. The test suite supplied deterministic evidence. When the first delegation failed, Codex diagnosed the capability mismatch, rebuilt the environment, and relaunched Claude with corrected permissions. I’ve been spending weeks trying to understand how to design agent hierarchies, orchestrators, QA agents, capability boundaries, and cross-model review loops. Then Codex casually assembled the entire architecture at runtime because the necessary components happened to exist on my computer. The security lesson might be the craziest part. An agent’s actual capability is not limited to the tools shown in its interface. Its real capability includes everything it can construct from shell access, local credentials, package installation, network access, and software it discovers in the environment. Apparently a shell-enabled coding agent isn’t merely an agent with tools. Under the right conditions, it’s a tool builder that can recruit other agents. submitted by /u/Bulldagshunter
Originally posted by u/Bulldagshunter on r/ClaudeCode