Default-Deny Network or Gated Egress?

This comparison asks whether how outbound network access is granted, scoped, and audited. The useful answer is not a permanent winner but a boundary, cost, or workflow effect a team can reproduce.

The claim, stated precisely

The source list says Codex disables external network access by default while Claude Code allows networking behind classification or user permission. Defaults do differ across surfaces, but the meaningful unit is the task's effective egress after configuration. Local shells, managed workers, browser sessions, package managers, and connected tools can each create a different route to the network.

The comparison underneath “Default-Deny Network or Gated Egress?”

The environment questions are easy to flatten into a slogan: local is powerful, cloud is safe, hooks are flexible, sandboxes are rigid. Real engineering choices do not divide that cleanly. The important unit is the boundary around a task: what the agent can read, what it can change, which credentials it can inherit, where its commands execute, and how a reviewer reconstructs the result. A terminal process can be tightly constrained. A remote worker can be granted broad credentials. The surface does not determine the risk by itself.

For this group, compare the default path and the escape hatch separately. Defaults shape ordinary behaviour; escape hatches determine the worst case. Record whether the user has to make a deliberate choice to broaden access, whether that choice is visible later, and whether the permission applies to one command, one task, one repository, or the whole machine. Those details matter more than the marketing label attached to the environment.

The useful axis here is how outbound network access is granted, scoped, and audited. That wording is deliberate. It turns a product label into something a team can observe. Instead of asking which agent is generally better, ask what changes in the repository, the operator's workload, and the evidence available for review when this one design choice is different.

Keep model quality separate from product behaviour. The model can change while the harness remains familiar, and the harness can gain a new surface without the model changing. A comparison that attributes every outcome to “Codex” or “Claude” usually bundles model, prompt, repository state, permissions, tools, and operator skill into one word. That is convenient for a headline and useless for a policy.

How the Codex side behaves

Managed Codex workflows can begin without general network access and request a narrower permission when a task needs it. That makes exfiltration harder by default and forces setup to distinguish source retrieval from arbitrary browsing. Local Codex execution still sits inside the host's network reality, so teams must not project cloud defaults onto every surface.

The practical question is what the Codex route makes easy by default and what it makes explicit. Defaults determine the common case. Explicit boundaries determine whether an unusual task stops for review or quietly inherits more authority than the brief required. Inspect the surface you actually use: app, editor, CLI, cloud task, or API. They belong to one product family, but they are not interchangeable execution environments.

Also separate capability from availability. Account tier, workspace policy, platform, and release channel can change what a user sees. If a feature is decisive, verify it on the account that will do the work and record the date. A screenshot from another tier is not a procurement specification.

How the Claude Code side behaves

Claude Code commonly operates in a terminal where network-capable commands already exist. Permissions and hooks can require approval or classify risky requests, and an organisation can place the shell inside a network-restricted environment. The advantage is compatibility with existing developer workflows; the risk is that the agent's effective egress can be broader than the interface suggests.

Claude Code's terminal-centred design makes the surrounding machine unusually important. Shell configuration, installed commands, repository hooks, credentials, and local policy all become part of the agent system. That can be a strength because the tool fits an existing engineering environment. It can also make two developers' nominally identical installations behave differently.

Judge integrations by their failure mode. Ask what happens when a hook exits non-zero, a tool is missing, a permission prompt is ignored, or a plugin returns untrusted text. A feature list describes the successful path. Production use is defined by the path that fails at 4:45 on a Friday.

A repository where the difference becomes visible

A dependency-upgrade task needs the package registry and vulnerability advisories but not arbitrary hosts. The strongest implementation allows those destinations, denies everything else, and logs what was contacted. A blanket network toggle solves the immediate install and weakens the response to a poisoned README that asks a tool to post environment data to an unrelated endpoint.

This example matters because it creates an observable consequence rather than a preference. The operator either has to intervene, the agent either leaves a trace, and the repository either reaches the acceptance test. Those events can be counted. If the comparison cannot be expressed in an event a reviewer can see, it is probably still marketing language.

The failure mode on both sides

Default deny fails operationally when every task begins by requesting broad access because allowlists are hard to maintain. Gated egress fails when the classifier sees an ordinary curl command rather than the sensitive data inside it. Tool protocols can also move network access behind a connector, where reviewers may forget that a semantic search or issue lookup is still an outbound request.

Every advantage has a shadow. Automation reduces attention until it automates the wrong assumption. Safety prompts preserve control until repetition trains the user to approve without reading. Parallelism cuts elapsed time until reconciliation becomes the work. Local access removes setup until ambient credentials become invisible inputs. The correct comparison names the shadow before recommending the feature.

That is why the winner can reverse by team. A solo developer who knows every shell alias has a different risk profile from a regulated team running unattended tasks. A mature monorepo with deterministic checks rewards autonomy. A fragile legacy tree with undocumented release steps rewards frequent, cheap interruption. Neither result generalises beyond the conditions that produced it.

How to test this difference in your own repository

Run a task that installs one package, reads one official documentation page, calls one internal service, and attempts one unrelated destination. Inspect DNS, HTTP, connector, and subprocess routes separately. Repeat after granting the permissions developers normally choose. The result should show both what is blocked and how easily a task can widen access.

1. Start both runs from the same commit and remove generated files from the first attempt.
2. Use the same acceptance criteria, not merely the same conversational prompt.
3. Choose the model and account tier you would actually deploy, then write them beside the result.
4. Record elapsed time, active human time, tool calls, permission decisions, retries, changed lines, and tests executed.
5. Review blind where possible. A reviewer should judge the patch and evidence before learning which agent produced it.
6. Repeat at least three times. One lucky hypothesis is not a product property.
7. Keep the worst run. Tail behaviour is where agent policies are tested.

Do not force a single score. A run can be faster and harder to review, safer and more interruptive, cheaper and less complete. Preserve the vector of results until the team has stated which constraint matters. Weighted scores conceal disagreement by turning policy choices into arithmetic.

Reading the transcript without fooling yourself

A long transcript is not evidence of deep reasoning, and a short transcript is not evidence of efficiency. Look for decisions that changed the patch: files selected, assumptions tested, permissions broadened, tests added, failures diagnosed, and work discarded. Everything else may be useful communication, but it should not drive the technical comparison.

Tool-call counts need the same caution. One broad command can do the work of twenty narrow reads while exposing more data and making review harder. Twenty calls may show careful scoping or repeated confusion. Pair the count with intent and outcome. The question is whether each call reduced uncertainty that mattered to acceptance.

Likewise, count corrections initiated by the human. They are a form of active labour that product benchmarks often omit. A system that finishes in ten minutes after six interventions did not save the same kind of time as one that finishes in fifteen minutes unattended. Which is preferable depends on whether those interventions were valuable design collaboration or avoidable steering.

When this point should decide the purchase

Prefer default-deny for untrusted repositories, automated issue intake, or tasks with secrets in scope. Prefer a carefully gated local route when live external systems are central to the task and the organisation already controls egress at the workstation or container layer. The policy should name destinations and data classes, not merely say network on or off.

Make this point decisive only if it appears frequently in representative work and the cost of the worse behaviour is material. A dramatic feature used once a quarter should not outweigh the ordinary edit-review-test loop. Conversely, a boundary that prevents a rare but catastrophic credential or deployment error deserves more weight than its frequency suggests.

Write the decision as a conditional: “For repositories with these controls, this team prefers this surface because this measured outcome improved.” Conditional decisions age well. Universal rankings become stale the moment either vendor changes a default.

What could invalidate this article

A new release can move this capability between surfaces, change a default, add a permission scope, alter plan availability, or expose a first-party integration. The article would then describe history rather than the current product. A model update can also change observed speed or code quality without changing the surrounding workflow. Re-run the test after material releases and before renewing a large contract.

Documentation is necessary but insufficient. It establishes supported behaviour; it does not establish comparative speed, output concision, code quality, or cost to completion in your repository. Those claims require measurements. Where the original thirty-point list used a percentage, multiplier, or absolute count, this series treats it as a benchmark hypothesis unless a current primary source guarantees it.

Turn the comparison into a policy

A useful evaluation ends with a routing rule. Name the task conditions, the preferred surface, the evidence required before acceptance, and the condition that forces escalation. For this difference, the rule should mention how outbound network access is granted, scoped, and audited in plain language that a new team member can apply without knowing the history of the tool comparison. Put the rule beside the repository instructions or engineering handbook, not in a purchasing slide that disappears after rollout.

Give the policy an owner and an expiry date. Product defaults change, account tiers move, and the team's own repository matures. A decision that was correct when checks were weak may become unnecessary after CI improves; a permissive workflow that was safe for a prototype may become unacceptable after production credentials arrive. Re-test the representative task rather than debating release notes in the abstract.

Finally, preserve a second route. A team that standardises on one agent still needs an exception for tasks the chosen environment cannot reproduce, a model outage, a provider limit, or an investigation that benefits from an independent implementation. The goal of comparison is dependable delivery, not loyalty. “Default-Deny Network or Gated Egress?” should produce a default and an escape hatch, with both narrower than giving every tool every form of authority for every task.

Bottom line

Default-Deny Network or Gated Egress? is a useful difference only after it is reduced to how outbound network access is granted, scoped, and audited and tested on the surface your team will actually use. The product names tell you where to look today; they do not supply the complete durable answer for your repository. Preserve the context, measure accepted work, and expect the conclusion to change as the tools do.

That discipline is the comparison this publication is meant to support.