Cursor vs Codex vs Claude Code: Coding Agents for Small Teams

Every comparison of these three written before this year opens with the same tidy claim: Cursor is the editor, Claude Code is the terminal, Codex is the cloud. It was true once. Picking a coding agent on that basis today means picking on an expired fact.

The products converged. All three run in a terminal, inside your editor, in somebody else's cloud, and off a mention in chat or on a pull request. What still differs: what the agent may do without asking, and how the bill is shaped.

What each one actually is in mid 2026

Cursor is a fork of VS Code and the most visual of the three. Around that editor it runs a headless CLI sharing your rules, MCP servers and login with the desktop app; Cloud Agents that work in isolated VMs and can be started from the web dashboard, your phone, a Slack or Teams mention, a Linear or Jira issue, or a local session; and Bugbot, which reviews pull requests and can spin up an agent to test and propose a fix.

OpenAI Codex is an umbrella, not a single product. One ChatGPT account drives an open-source CLI that runs locally, an IDE extension for VS Code and its forks (Cursor and Windsurf included), separate integrations for JetBrains IDEs and Xcode, a cloud environment, a GitHub code review bot you summon by mention, the ChatGPT desktop and web apps, and Slack. OpenAI's docs describe keeping quick iterations local and pushing bigger tasks to Codex web. Cloud-only it is not.

Claude Code is one engine behind a lot of front doors: CLI, desktop app, VS Code extension, JetBrains plugin, web, the Claude mobile apps, and Slack. Anthropic's docs are explicit that configuration, project memory and MCP servers are shared across the local surfaces, so a CLAUDE.md written for the terminal governs the editor extension too. The CLI is still the most complete surface: scripting and the Agent SDK are CLI-only.

Difference 1: what it can do without asking

Claude Code treats permissions as a checked-in artifact. There are named modes: default (labeled Manual), plan, acceptEdits, auto, dontAsk and bypassPermissions. On top sit allow, ask and deny rules in settings files you can commit to the repo, hooks that veto a tool call before it runs, and an OS-level sandbox constraining shell commands and child processes. The load-bearing point: the rules are enforced by the harness, not the model, so nothing written in a prompt or a memory file can widen them. For an agency or a regulated shop, that is the entire pitch.

Codex splits the same problem into independent dials. sandbox_mode decides what it may touch: read-only, workspace-write, or danger-full-access. approval_policy decides when it stops to ask: on-request, never, or granular. Network access is gated separately again. Read-only plus on-request is a sensible first week; the fully unattended setting belongs in a container you'd be willing to lose.

Cursor's answer is review rather than restriction. You see the diff before you accept it, and Bugbot sits on the pull request as a second pass. Org-level controls (privacy mode, SSO, audit logs) live on the plan rather than in the repository. If your safety model is "a human reads every diff before merge," Cursor is built around that assumption. If it's "the agent must not be able to reach that directory at all," it isn't.

Difference 2: the shape of the bill

Cursor is a seat plus metered usage. Hobby is free, Pro is $20 a month, and the higher individual tiers buy multiples of the Pro agent limits (Pro+ at 3x, Ultra at 20x). Teams is $40 per user per month, with a premium seat at 5x the standard limits, and Enterprise pools usage across the org. Every plan includes a set amount of model usage and bills overages on demand. Budget for the overage, not the seat.

Codex rides on ChatGPT. Free, Go at $8 a month, Plus at $20, Pro from $100 with 5x or 20x rate limits, Business at $20 per user per month billed annually ($25 monthly), and custom Enterprise pricing. Usage is metered in credits that repackage token consumption against a per-model rate card; when the included amount runs out, you buy more.

Claude Code is bundled. No separate SKU: it comes with Claude Pro ($17 a month annual, $20 monthly), Max (from $100), Team (standard seats $20 per user annual or $25 monthly, premium seats $100 or $125) and Enterprise, which is a seat price plus usage at API rates. Teams that outgrow subscription limits move to Console billing. For the economics underneath all three, how AI pricing really works covers the moving parts.

Surface parity killed the easy answer. What's left is a question about governance and billing, which is less fun and far more useful.

So which one should a small team actually pick?

• Claude Code if the agent will run unattended, or if you ship client code under an NDA. Committed permission rules and an enforced sandbox are the difference between an agent you can audit and one you must trust.
• Cursor if your bottleneck is review, not generation. The product is organized around a human judging output fast: inline diffs, one window showing everything running, cloud agents that hand back screenshots and logs, a bot on the PR.
• Codex if you already pay for ChatGPT company-wide. Marginal cost is near zero, one account follows the developer across CLI, editor, cloud and GitHub, and the JetBrains and Xcode integrations cover editors the others serve less well.

Two is the honest answer for most small teams: one interactive, one unattended, ideally billed to different budgets. Three is one configuration too many. We take the longer view on where this convergence lands next in AI Coding Agents Heading Into 2027.

None of this answers "which one is best." It answers "which one fits this team." Our founder's guide to vibe coding is the longer version of that argument, and our honest comparison of the best AI models covers the model layer underneath all three.

Data privacy considerations

Each vendor offers a business or enterprise tier with stronger data-handling commitments — no training on your prompts, configurable retention, audit logs — but you have to opt in and pay, and defaults are what most teams use. For client work or anything under an NDA, that tier is the floor. Ask before the first sensitive prompt: is my code used to train models on this plan, can I disable retention, and is that in the contract?

Where people go wrong (and when to call a pro)

The expensive mistakes aren't about choosing the "wrong" tool. They're structural, and they show up months in.

The value of working with someone who has done this isn't the prompt library. It's knowing which permission model fits how your team ships. That's the bulk of our consulting work.

Frequently asked questions