Grok Build

You will feel the difference on long sessions, because the deciding trait here is headroom: a five-hundred-thousand-token window on the current model means fewer of those moments where the agent forgets the file you discussed twenty minutes ago and starts rediscovering the codebase. Plan mode, worktrees and background tasks are all present, so the working shape is familiar rather than novel.

Pick it if your company already has a relationship with this vendor. Pick Codex CLI for the broader ecosystem, or Claude Code if you want the terminal agent most other tools are built to interoperate with.

The default is the failure. Isolation uses operating system primitives, Landlock on Linux and Seatbelt on macOS, and the row states it must be enabled rather than arriving switched on. It also states that network blocking works on Linux and not elsewhere, which means two engineers following the same instructions get two different threat models depending on their laptop. Nothing in the interface announces that difference.

What it does right: choosing kernel and system primitives over a container is honest, because it constrains the process where it actually runs instead of pretending a wrapper is a boundary.

Two points. 1. General-purpose, explore and plan subagents execute as separate child sessions, which bounds what a single task can accumulate and makes context growth a function of the subtask rather than the whole conversation. That is the correct containment for the failure mode where long sessions degrade. 2. Speaking a published agent protocol means the loop can be hosted by editors the vendor does not own, so interoperability does not depend on this vendor winning.

No evaluation is published. The design decisions are legible and should survive a model generation, which is more than the marketing needs them to.

The strategic read is simple. A frontier lab that sells inference needs a surface where developers consume it habitually, and a coding agent is the highest-volume surface available. Labelling it early access tells you the lab is willing to ship an unfinished funnel rather than cede the habit, and the earlier coding model name surviving only as an alias shows how fast the naming is being rearranged underneath.

Pricing power belongs to the parent's inference business, not to this client, and the parent is not going anywhere. There is no acquirer; there is a lab. Position: safe to use, and understand you are buying tokens, not software.

Usage billing sounds efficient until you run it across a department. Input at two dollars a million and output at six gives me a unit cost and no way to bound an individual, so my forecast depends on how verbose sixty people's tasks turn out to be. There is no published seat tier to negotiate against and the row records no SSO, no SCIM and no audit log tied to a person, so I cannot even attribute the spend.

A print flag with streaming output means pipelines work. Not yet. Revisit when there are organisation keys with per-user limits.

There is no source, so the config file is the whole of my ownership. It is a real one: model entries are declared in a TOML file under my home directory, hooks fire on lifecycle events, and MCP servers I run attach as a client. The key is mine, which at least means the billing relationship is direct rather than resold.

What I cannot do is run the model. Local models are not supported and no self-hosted endpoint is documented, so every session leaves the machine by design. Grudging respect for the configuration surface, none at all for the exit.