Codex CLI 0.164.0 adds presets and credential masking

OpenAI released Codex CLI 0.164.0 on October 23, 2026, adding ten reusable prompt and slash-command presets, inline controls for models and permissions, and broader credential masking in specified shell paths. The useful question for existing users is which of those changes affects their routine, and which protections still need checking in their own environment.

What changed in this release

The new /presets feature stores reusable prompts and slash commands in ten numbered slots and offers a keyboard menu to retrieve them. OpenAI’s release notes describe the slots, but do not publish a time-saving measurement. A user who repeats the same repository orientation prompt or review instruction can try a preset and decide whether it reduces manual retyping. That is a suggested use, not a result we measured.

The same release lets users supply model, reasoning effort, speed and permission profiles with inline /model and /permissions arguments. The CLI documentation describes Codex as a terminal tool for inspecting and changing code and identifies /permissions as the place to choose what a run may do. Inline arguments make it easier to set a profile during the workflow, but the release notes do not say that managed policy or approval rules have changed. Users should inspect the resulting settings before running a consequential task.

OpenAI also lists enterprise MCP authentication through eligible Codex account grants or dedicated sign-in, including OAuth clients that require secrets. “Eligible” matters: the notes do not promise the same connection route to every account. For teams using MCP, the practical next step is to check the authentication path available to their account and test a connection under their normal permissions, without putting credentials into prompts.

The security-related change has a narrower scope than a general promise to hide all secrets. The notes say Codex now masks credentials during supported remote Bash commands and Zsh snapshot sessions, including credentials from custom providers. They do not enumerate every shell, tool or output channel that might contain sensitive material. Treat masking as a protection in the named paths, and continue to review command output before sharing a transcript.

Other changes in the release include image previews in the fullscreen transcript on terminals that support Kitty or Sixel graphics, a Bedrock setup wizard enabled by default, and fixes for failed compaction, session resume, Windows proxy authentication and repeated CLI configuration overrides. Those may matter to specific users, but they are separate from the presets and credential-masking changes. The full release list is the source for those platform-specific details.

What the previous release already did

It would be misleading to describe restored session permissions as wholly new. The 0.163.0 notes, published October 15, already said resuming a saved thread restored its permissions and network approvals while respecting explicit overrides and current managed policy. Version 0.164.0 addresses a different part of resume: finding compressed histories and restoring saved thread settings instead of replacing them with global defaults. The notes also say a failed compaction no longer leaves a partial summary in conversation history.

The third column is an editorial checklist, not a report of tests by DailyTech. It is deliberately about observable settings and low-risk actions, rather than an instruction to weaken permissions to make a feature work.

What to check in your own workflow

Start with the workflow you already use. If repeated instructions are the friction, try one preset with non-sensitive text. If your team relies on fixed run boundaries, look at the active model and permission profile after using the new inline controls. If you frequently resume long sessions, compare the resumed thread’s settings with what you saved. OpenAI’s CLI guide explains the terminal workflow and points users to /permissions and codex resume; the release notes explain the October changes.

For credentials, review the paths that actually carry secrets in your setup. The release claim is about masking in supported remote Bash commands and Zsh snapshots. It does not replace your team’s normal handling of logs, environment variables or shared transcripts. For MCP connections, use the sign-in option offered to your account and verify the connected tool has only the access your work requires. These are prudent checks inferred from the documented changes, not claims that we audited Codex’s security.

This update is most relevant to people who already use Codex in a terminal. Readers choosing among coding assistants can start with our broader AI coding tools guide. Those designing separate agent workflows may find the Agents SDK sandboxing guide useful context; SDK isolation is a different product topic. Our article on ChatGPT voice and desktop Codex integration covers another interface, rather than these CLI release details.

What remains unknown

The release notes describe features and fixes, not benchmark results. They do not quantify how much time presets save, measure resume reliability across a user’s own histories, or prove that every possible credential exposure route is covered. Availability of the enterprise authentication options depends on eligibility that the notes do not define account by account. DailyTech has not installed this version or tested these behaviors. The appropriate conclusion is that 0.164.0 gives users several concrete functions to check, with the scope of each claim limited to OpenAI’s published notes.