Claude Opus vs GPT Codex: Who Drives and Who Gets Driven in Real Incident Response

The Incident: A Locked-Out User

A user couldn’t sign up on an Android phone. The entire brief: a first name and “a Google device.” SEV-3, an eight-minute session, 227 clicks, rageclicks included.

The trap: A failed signup is anonymous. The identify event only fires on success, so there’s no email, no username, no user ID in analytics. Nothing to grep for.

The Test: Same Incident, Two Engines

The same incident was given to two AI engines with the same repo, credentials, and skills:

Why This Matters

Opus ran the entire investigation on its own. It realized that an abandoned signup never fires identify, triangulated the anonymous session from time, platform, and registration events, decoded the PostHog replay blobs, confirmed the duplicate account in Supabase, proved the reset email never sent, and pulled the root cause out of an unmasked DOM field.

GPT needed a human to steer it three times-including being told which tool to use. It stopped at “request accepted (200), completion not observed.” True, and the wrong question.

A 200 from the reset endpoint is deliberate anti-enumeration and fires for any address. A 200 is a politeness, not a fact. Opus proved non-delivery across three layers (database trigger, audit log, mail provider) with a control user to validate the method.

The Real Culprit: The Gmail Dot

The root cause was a single misplaced dot:

• Gmail ignores dots in the local part, so both spellings reach the same inbox
• The auth database compares raw strings, so they are two different users
• Typed: .N*@gmail.com (dot BEFORE the number)
• Real: ..N*@gmail.com (dot AFTER the name)

One misplaced dot explains the ten failed logins, the dead password reset, and why “already exists” still fired (autofill supplied the correct spelling only on the register screen). From where the user sat, her email was simply her email. She was right, and locked out anyway.

The Broader Pattern

This split isn’t just about this single incident. Research comparing these models across penetration testing (PTES methodology) shows a consistent pattern:

• Claude Opus demonstrates superior adaptability, maintains long coherent conversations, and suggests alternative attack paths when initial attempts fail
• GPT-4 occasionally requires manual adjustments and more generic commands, though still valuable in exploitation and reporting phases
• Claude Opus is recommended for all phases of PTES as an auxiliary tool, providing more contextually specific suggestions

The Driver/Worker Pattern in Production

Many teams are now running these models hierarchically rather than choosing between them:

• Claude Code (Opus 4.7/4.8) acts as the driver-it plans, holds the architecture, and decides what to hand off
• Codex (GPT-5.5) acts as the worker-it executes long terminal runs the driver delegates

The pattern has held up across complex refactors, full WordPress migrations, and ground-up SaaS rebuilds.

Why it works:

• Opus’s self-verification sub-agents and long-context coherence make it ideal for planning and architecture
• Codex’s terminal autonomy, sustained 45+ minute runs, and ~72% fewer output tokens make it ideal for execution

The 2AM Lesson

In ops, the scarce resource at 2 AM is human attention, not tokens. The engine that drove itself was also the one that refused to stop at a 200. Half the fixes shipped only exist because of it: you can’t ship “fix the dot UX” if you never found the dot.

Key Takeaways

• Autonomy matters in incident response-human steering costs time and attention
• Don’t trust the 200-verify across multiple layers
• Consider a driver/worker architecture for complex tasks
• Small details (like a dot) can break everything-and AI that digs deep finds them

“The engine that drove itself was also the one that refused to stop at a 200.”

Quick Checklist for Ops Teams

• [ ] Test your AI tools on real incident scenarios-not just benchmarks
• [ ] Evaluate which model drives vs. which gets driven
• [ ] Consider running models hierarchically (driver/worker)
• [ ] Verify AI conclusions across multiple data layers
• [ ] Don’t take HTTP 200 responses at face value
• [ ] Document which models perform best for which tasks