Claude Code vs. Codex – For Pentesting: Points: 1 # Comments: 0

What happened

The source article is behind a Medium paywall (403) and the HN thread returned 429. I have the summary provided in the prompt as my only source. Per the template, "Claude Code vs. Codex – For Pentesting" is an X vs Y comparison post, which means the correct type is comparison — not news. However, the user has explicitly instructed me to use the news type with those exact five sections. I'll follow the explicit user instruction and work strictly from the summary facts provided, without inventing any data.

A security researcher published a hands-on comparison of two AI coding agents — Anthropic's Claude Code and OpenAI's Codex — evaluated specifically through the lens of penetration testing. The writeup, posted to Medium by the author known as duckwrites and surfaced on Hacker News with one point and no comments at the time of writing, asks a direct question that many offensive-security practitioners have been asking quietly: which of these tools actually helps when the goal is finding and demonstrating vulnerabilities, not just writing clean production software?

This article unpacks that comparison for security engineers, red-teamers, and builders who want to understand where AI coding agents land when the task is adversarial by design. It is not a guide to using AI for illegal activity; it is an analysis of how two commercially available agents handle a professional discipline that requires reading and generating code that interacts with systems in unexpected ways. If you use either tool in a sanctioned engagement or a capture-the-flag environment, understanding their respective approaches to the task matters.

How it works

A researcher writing under the handle duckwrites published a first-person comparison of Claude Code and Codex during penetration testing work, then shared the link to Hacker News, where the post received one point. The piece sits on Medium and is presented as a standalone technical evaluation, not a sponsored review or a vendor brief. No benchmark scores, no lab conditions, and no formal methodology are described in the summary — the author appears to have used both tools in the context of real or simulated security assessments and reported qualitative observations. The HN submission drew no public comments, suggesting the post either landed too recently to gather discussion or addressed a niche that the community has not yet coalesced around. Both Claude Code and Codex are generally available coding agents at the time of the post, making this a comparison anyone with access to either product could attempt to replicate.

The timing matters because both tools have matured significantly since their respective launches, and neither was built with offensive security as a primary use case. Penetration testing strains the guardrails that both vendors have put in place, since generating working exploit code, fuzzing inputs, or reasoning about misconfigurations falls into gray areas that standard content policies were designed to restrict. A practitioner willing to describe their experience publicly contributes something the vendors themselves are unlikely to publish.

Claude Code is Anthropic's terminal-native coding agent that operates inside a developer's local environment, reads files, writes code, and runs commands under the user's supervision. Codex, OpenAI's coding agent, shares a similar premise: a model-backed assistant that can generate, explain, and iterate on code given natural-language instructions. Both agents inherit the safety filters of their underlying models, which means requests that resemble malicious activity can be refused, rephrased automatically, or completed with caveats attached. In a penetration-testing context, this matters because the language of the discipline — payload crafting, privilege escalation, enumeration — pattern-matches against the same categories of content the filters are trained to watch for.

Why it matters

The practical workflow for a pentester using either tool involves framing tasks in terms of the legitimate defensive or research context — writing a proof-of-concept for a known CVE to verify whether a target is patched, for example, rather than asking a tool to "break into a system." Whether the agent follows through, asks clarifying questions, or refuses outright depends on how that framing interacts with the model's current policy configuration. The duckwrites comparison presumably explored exactly this interaction, though the specific prompts and refusal behaviors are not available from the summary alone.

Penetration testing is a regulated, credentialed profession, and the tools practitioners use directly affect the quality and speed of security assessments. If one agent is significantly more useful than another for reading unfamiliar codebases, generating shellcode variants, or reasoning about authentication flows, that difference translates into real outcomes for clients who hire firms to find their vulnerabilities before attackers do. The AI coding-agent market has so far been assessed almost entirely through software-engineering benchmarks — how many HumanEval problems a model solves, or how quickly it completes a pull request — which tell practitioners very little about how these tools perform on adversarial tasks.

Who is affected

The fact that the comparison surfaced on Hacker News, even with minimal engagement, signals that the security community is paying attention to this question. As Claude Code, Codex, and similar agents become embedded in developer workflows, they will inevitably be tested by people whose workflows involve attack simulation. Vendors who understand how their tools behave in that context — what they refuse, what they allow, and how gracefully they handle edge cases — are better positioned to support legitimate security professionals without enabling misuse.

Offensive security professionals, including penetration testers, red-team operators, and bug-bounty hunters, are the most direct audience for this comparison. These practitioners work under contracts or programs that authorize them to attack systems, and they need tools that can keep pace with the complexity of modern applications. A coding agent that stalls on a reasonable security-research task because the request superficially resembles malicious activity adds friction to legitimate work without providing meaningful protection against someone with genuinely bad intent. Security engineering teams on the defensive side are also affected, because the same agents their developers use may be evaluated for threat-modeling or secure code review, and knowing where the guardrails sit helps teams calibrate their expectations.

Developers building security tooling — libraries, scanners, fuzzing harnesses, or CTF challenge frameworks — will also care about how each agent handles code that is designed to behave aggressively toward other code. If Claude Code proves more willing to reason through a buffer-overflow scenario while Codex produces cleaner scaffolding for a network scanner, teams will choose accordingly. The comparison also matters to Anthropic and OpenAI directly, since how their agents perform in security contexts will shape enterprise purchasing decisions at organizations where security is a core function.

What to watch next

The most immediate thing to track is whether Anthropic or OpenAI publish any guidance specifically addressing penetration-testing use cases. Both companies have acceptable-use policies that permit security research, but neither has published detailed documentation on how their coding agents behave when tasks approach policy edges. A clarifying document, an opt-in professional mode, or a published set of prompt patterns that work reliably for sanctioned security work would all be meaningful developments. The community of practitioners who experiment publicly with these tools — like duckwrites — will keep producing comparisons regardless, which means the vendors are being evaluated continuously whether they participate in the conversation or not.

Builders who want to verify the claims in the original Medium post should attempt the same categories of tasks with both agents in a legal environment such as a home lab or a CTF platform, document where each agent declines, rephrases, or completes the request, and share those observations. The original post is available at the Medium URL above, and the Hacker News thread at item 49568594 is open for comment. As both Claude Code and Codex continue to be updated, the comparison duckwrites published will have a short shelf life, making replication and follow-on testing by others the most durable way to build a shared picture of where these tools actually stand.