Claude Opus vs GPT Codex: Who Drives and Who Gets Driven in Real Incident Response

In the world of AI-assisted operations, the difference between a model that drives and one that gets driven can mean hours of sleep lost at 2 AM. A recent real-world incident comparison between Claude Opus and GPT Codex reveals a surprising gap in autonomous problem-solving capabilities . Contents The Incident: A Locked-Out UserThe Test: Same Incident, Two EnginesWhy This MattersThe Real Culprit: The Gmail DotThe Broader PatternThe Driver/Worker Pattern in ProductionThe 2AM LessonKey TakeawaysQuick Checklist for Ops Teams The Incident: A Locked-Out User A user couldn’t sign up on an Android phone. The entire brief: a first name and “a Google device.” SEV-3, an eight-minute session, 227 clicks, rageclicks included . The trap: A failed signup is anonymous. The identify event only fires on success, so there’s no email, no username, no user ID in analytics. Nothing to grep for. The Test: Same Incident, Two Engines The same incident was given to two AI engines with the same repo, credentials, and skills : Metric Claude Opus 4.8 GPT-5.5 Codex Human nudges needed 0 3 interventions Reached the replay by Own inference Being pointed at the skill Root cause Gmail dot-variant typo “Duplicate account,” not traced further Reset email status Proven never sent Accepted the 200 at face value Why This Matters Opus ran the entire investigation on its own. It realized that an abandoned signup never fires identify, triangulated the anonymous session from time, platform, and registration events, decoded the PostHog replay blobs, confirmed the duplicate account in Supabase, proved the reset email never sent, and pulled the root cause out of an unmasked DOM field . GPT needed a human to steer it three times—including being told which tool to use. It stopped at “request accepted (200), completion not observed.” True, and the wrong question . A 200 from the reset endpoint is deliberate anti-enumeration and fires for any address. A 200 is a politeness, not a fact. Opus proved non-delivery across three layers (database trigger, audit log, mail provider) with a control user to validate the method . The Real Culprit: The Gmail Dot The root cause was a single misplaced dot : Gmail ignores dots in the local part, so both spellings reach the same inbox The auth database compares raw strings, so they are two different users Typed: .NN@gmail.com (dot BEFORE the number) Real: .NN@gmail.com (dot AFTER the name) One misplaced dot explains the ten failed logins, the dead password reset, and why “already exists” still fired (autofill supplied the correct spelling only on the register screen). From where the user sat, her email was simply her email. She was right, and locked out anyway . The Broader Pattern This split isn’t just about this single incident. Research comparing these models across penetration testing (PTES methodology) shows a consistent pattern : Claude Opus demonstrates superior adaptability, maintains long coherent conversations, and suggests alternative attack paths when initial attempts fail GPT-4 occasionally requires manual adjustments and more generic commands, though still valuable in exploitation and reporting phases Claude Opus is recommended for all phases of PTES as an auxiliary tool, providing more contextually specific suggestions The Driver/Worker Pattern in Production Many teams are now running these models hierarchically rather than choosing between them : Claude Code (Opus 4.7/4.8) acts as the driver—it plans, holds the architecture, and decides what to hand off Codex (GPT-5.5) acts as the worker—it executes long terminal runs the driver delegates The pattern has held up across complex refactors, full WordPress migrations, and ground-up SaaS rebuilds . Why it works: Opus’s self-verification sub-agents and long-context coherence make it ideal for planning and architecture Codex’s terminal autonomy, sustained 45+ minute runs, and ~72% fewer output tokens make it ideal for execution The 2AM Lesson In ops, the scarce resource at 2 AM is human attention, not tokens. The engine that drove itself was also the one that refused to stop at a 200. Half the fixes shipped only exist because of it: you can’t ship “fix the dot UX” if you never found the dot . Key Takeaways Autonomy matters in incident response—human steering costs time and attention Don’t trust the 200—verify across multiple layers Consider a driver/worker architecture for complex tasks Small details (like a dot) can break everything—and AI that digs deep finds them “The engine that drove itself was also the one that refused to stop at a 200.” Quick Checklist for Ops Teams [ ] Test your AI tools on real incident scenarios—not just benchmarks [ ] Evaluate which model drives vs. which gets driven [ ] Consider running models hierarchically (driver/worker) [ ] Verify AI conclusions across multiple data layers [ ] Don’t take HTTP 200 responses at face value [ ] Document which models perform best for which tasks