Codex Record & Replay — OpenAI's RPA Play Has a Trust Problem

OpenAI shipped Record & Replay in Codex app v26.616 on June 18, 2026 — alongside CLI 0.141.0 — available to ChatGPT Plus, Pro, Business, Enterprise, and Edu subscribers. The pitch: perform a workflow on macOS once, Codex watches, and the demonstration becomes a reusable SKILL.md file that the agent can execute autonomously against any future screen state. This is OpenAI’s most direct incursion into RPA territory, and the architecture is genuinely different from what UiPath and Automation Anywhere have been selling for a decade.

TL;DR

• What: Codex Record & Replay converts a demonstrated macOS workflow into a natural-language SKILL.md — not a pixel-coordinate script — that the agent re-interprets on replay
• Portability: Output follows the Open Agent Skills Standard, portable to Claude Code, Gemini CLI, Cursor, and any compliant runtime
• Constraint: macOS only, unavailable in the EU/UK/Switzerland, requires Computer Use enabled
• Risk: No mechanism to audit what Codex observed during recording — OpenAI’s own docs warn against capturing secrets

Record & Replay — What Happened

The feature works in three steps. You start a recording session, perform a task on your Mac — clicking through forms, navigating apps, running terminal commands — and stop recording. Codex then generates a SKILL.md file with YAML frontmatter describing when to use the skill, what inputs it requires, the execution steps in natural language, and verification criteria for confirming success. On replay, Codex’s reasoning model reads that natural-language description and interprets it against the current screen state rather than blindly replaying mouse coordinates from the original session.

This is the architectural distinction that matters. Legacy RPA tools record literal interactions — click at pixel (423, 891), type “invoice_2026” into the third input field, wait 200ms. Move a button, change a font size, update a dialog, and the script breaks. Codex’s approach generates a semantic description of intent: “open the expense report, enter the amount from the receipt, submit for approval.” The model figures out where buttons and fields are on each replay, adapting to UI changes that would shatter a coordinate-literal recording.

The output format is not proprietary. SKILL.md files follow the Open Agent Skills Standard, which means a skill recorded in Codex can be dropped into .claude/skills/ for Claude Code, committed to a shared repo for Gemini CLI, or loaded by Cursor. In theory, you record once in Codex and replay anywhere. That cross-runtime portability is what elevates this from a convenience feature to an ecosystem play.

Record & Replay requires Computer Use to be enabled. Enterprise organizations that set computer_use = false in requirements.toml disable both Computer Use and Record & Replay entirely.

Why This Matters

The RPA industry just got its GPT moment. UiPath and Automation Anywhere have spent years building visual workflow designers that produce brittle, coordinate-dependent scripts requiring dedicated “RPA developer” roles to maintain. Codex flips the maintenance model: instead of debugging a broken script when a UI changes, you have a natural-language skill that the model re-interprets each time. The skill degrades gracefully when minor UI changes happen, and you edit it by changing English sentences rather than rewiring a visual flowchart.

But the comparison cuts both ways. Enterprise RPA platforms have spent those same years building governance layers — audit trails, credential vaults, role-based access control, compliance dashboards. Codex Record & Replay ships with none of that. OpenAI’s own documentation explicitly advises users to “use realistic inputs, but avoid secrets and sensitive data” during recording sessions. That warning tells you everything about the current trust surface: there is no mechanism to audit what window content Codex observed or ingested while recording. If a session token flashes in a terminal, if a password manager auto-fills a credential, if a customer record with PII is visible in a background window — Codex may have captured it, and you have no tooling to verify whether it did.

For enterprise teams subject to SOC 2, HIPAA, or GDPR, this is not a theoretical concern. A recorded skill that accidentally contains a credential or session token is a compliance event the moment it’s committed to a shared repository. And the sharing mechanism exists — OpenAI distinguishes Record & Replay (personal capture tool) from Plugins (the distribution primitive for packaging skills with MCP servers and install metadata) — but the boundary between “personal demo” and “team automation” is exactly one git push.

The geographic constraints reinforce the maturity picture. Record & Replay launched unavailable in the European Economic Area, the United Kingdom, and Switzerland, with no public timeline for expansion. Given that these are the jurisdictions with the strictest data protection enforcement, the exclusion reads less like a rollout plan and more like a regulatory acknowledgment.

There is currently no way to audit what Codex observed during a recording session. If your workflow touches credentials, tokens, or PII, treat the generated SKILL.md as potentially containing sensitive information — review it before committing or sharing.

The cross-runtime portability angle is more immediately interesting than the RPA disruption narrative. The Open Agent Skills Standard means recorded workflows are not locked to OpenAI’s ecosystem. A team could record a deployment checklist in Codex, hand the SKILL.md to a developer using Claude Code, and have it execute identically — assuming both runtimes interpret the natural-language steps the same way. “Assuming” is doing heavy lifting in that sentence. Semantic interpretation varies between models, and there’s no conformance test suite for the standard yet. But the direction is clear: skills as a portable, human-readable automation format that any agent can consume.

Compare this to the Devin approach, where automation is tightly coupled to Devin’s own environment and execution model. Codex is betting that open, text-based skill definitions will win the same way open config formats beat proprietary IDE project files. That bet has historical precedent.

The Take

I’d treat Record & Replay as a personal productivity feature today — not a team automation platform. The semantic architecture is genuinely better than coordinate-literal replay, and the portability story through the Open Agent Skills Standard is the most forward-looking part of the release. But the security story has a gap you could drive a compliance audit through: no recording audit trail, no content filtering, no credential detection. OpenAI telling users to “avoid secrets” during recording is the equivalent of a construction site sign that says “please don’t fall” — technically advice, practically insufficient.

For individual developers automating their own repetitive workflows — filling out forms, running multi-app deployment sequences, executing testing checklists — this is immediately useful. Record it, review the SKILL.md, edit anything that looks wrong, replay. The macOS-only constraint limits the audience, and the EU/UK/Switzerland exclusion limits it further, but within those boundaries, it works.

For teams considering this as an RPA replacement: wait. You need audit tooling, credential scanning for generated skills, and role-based access before this is safe to share across an organization. The feature that makes Record & Replay powerful — Codex observing everything on your screen — is the same feature that makes it a liability without governance controls.

The real story here is not “OpenAI kills UiPath.” It’s that natural-language skill definitions are becoming a cross-runtime standard, and recording is just the fastest way to author them. The format matters more than the feature.