Codex Windows Desktop Bug: Ghost Config Injection and Opaque Command Denials
EthanYoQ · ghdev · 2026-10-10
- A user reports odd behavior in OpenAI's Codex Windows Desktop app (26.1007.2314.0, backend codex-cli 0.162.0-alpha.17.2): the Settings page warns about an unrecognized features.codemodetooldescriptionfirst flag and a deprecated guardianv2.threadcontext setting, neither of which exists in the user's config.toml.
- Investigation points to a dynamic session-feature injection path in the desktop bundle; a fresh backend instance reads the config cleanly without the warnings, but the full provenance is unconfirmed since the outgoing request wasn't captured.
- Separately, even under Full access mode, deleting an agent-created 53-byte test file via Remove-Item is rejected opaquely before execution, with no explanation given.
More from coding & agent
- Neon ships official AI Gateway adapter for TanStack AI with single-credential multi-model access — matei_zaharia · 2026-10-23
- Reflection AI's Beam agent auto-builds a Gemma-4 fine-tuning notebook, boosting accuracy 66.5% — danielhanchen · 2026-10-23
- Cua Spaces SDK lets Hermes and other agents run in sandboxes on your own hardware — Teknium · 2026-10-23
- PHP hit by two unauthenticated RCE flaws; ProjectDiscovery launches free internet-wide alert service — cyb3rops · 2026-10-23
- Modal open-sources Spindle, a Tinker-compatible training server that charges GPU time instead of tokens — josh_wills · 2026-10-23
- Testing the Azure Cosmos DB Agent Kit: what it found reviewing a Claude-built app, in RUs saved — adnan_hashmi · 2026-10-23