`MultiAgentV2` `followup_task` accepts self-targets and can(and will) livelock orchestration

Open
#33,817 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
rust
Domain
ai-infra-agents, backend

Research direction

Start in codex-rs/core/src/tools/handlers/multi_agents_v2/message_tool.rs around the followup_task validation, then compare the self-target check in interrupt_agent.rs. Add regression coverage for self-targeting by canonical task path and thread ID, verifying rejection occurs before a NEW_TASK is delivered.

Written by the indexing model from the issue text.

Description

bug subagent tool-calls

Summary

A MultiAgentV2 agent can call followup_task targeting its own canonical task path or thread ID.

The call succeeds and delivers a NEW_TASK whose author and recipient are the same agent. If the agent interprets this as delegation to another executor, it can repeatedly call wait_agent while waiting for itself to finish.

Reproduction

  1. Spawn a child named /root/self_followup_probe.

  2. From that child, call:

    {
  "target": "/root/self_followup_probe",
  "message": "Run `pwd` and report the result."
}

  3. Observe that followup_task returns success.

  4. Observe a delivered NEW_TASK where both author and recipient are /root/self_followup_probe.

The same invalid call is accepted when targeting the caller by thread ID.

Expected behavior

followup_task should reject any target resolving to the calling thread and return a model-visible error before delivering the message.

Regression tests should cover self-targeting through:

  • the current canonical task path;
  • the current thread ID.

Impact

In my transcript, the agent delegated the task to itself and then waited for itself for 4 hours 14 minutes, issuing 239 wait_agent calls. The actual work never started. 😍

Source

followup_task rejects the root agent but does not check whether the resolved target is the calling thread:

https://github.com/openai/codex/blob/315195492c80fdade38e917c18f9584efd599304/codex-rs/core/src/tools/handlers/multi_agents_v2/message_tool.rs#L73-L88

interrupt_agent already performs the corresponding self-target check:

https://github.com/openai/codex/blob/315195492c80fdade38e917c18f9584efd599304/codex-rs/core/src/tools/handlers/multi_agents_v2/interrupt_agent.rs#L53-L57

The missing validation is:

receiver_thread_id == session.thread_id

Related but distinct

  • #32203 — completion routing for a non-child descendant;
  • #24951 — wait_agent exceeding its requested deadline;
  • #23296 — failure to execute an initial spawn task.

None covers followup_task targeting its own caller.

Definitely not a meme Image
Dominant language
Rust
Stars
125k
Forks
19.5k
Avg merge
1m
Merged PRs (30d)
1k

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openai/codex

All issues in openai/codex

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.