Changed SUDO pwd on its own - and broke it

Open
#35,456 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Quiet
Tech stack
debian, linux, rust
Domain
cli, operating-systems, security

Research direction

No source file, test, or entry point is named. Start by reviewing the reported session log and the steps involving a Debian remote machine with sudo access; clarify whether the fix must prevent unrequested credential changes, validate explicitly authorized changes, or both, then define tests showing that admin access remains usable.

Written by the indexing model from the issue text.

Description

app bug model-behavior remote safety-check
What issue are you seeing?

Gave Codex (running Gpt5.6 Sol Extra High) credentials to a debian linux device (ssh user + sudo pwd).

Somehow in the middle of the session it decides for no reason to rotate the sudo key- completely unrelated to actual instructions. Couldn't believe when i read that in the log. I immediately steered it on that because it didnt stop on its own to tell me directly.

Turned out it was even worse- it not only changed the SUDO pwd but it also broke the new one in the process and locked everyone out of admin access. Images attached speak for themselves. I had to get physical with the console cable to come back here.

Maybe add a hard guardrail that it doesn't pro-activly rotate credentials OR that it verifies if it does so, that the command itself is cleanly formed.

Image Image
What steps can reproduce the bug?

Give it full access to a remote machine incl sudo credential and a task. Happened somehow random and out of the blue.

What is the expected behavior?

Shouldn't mess with secrets at all unless explicitly instructed.

Additional information

No response

Dominant language
Rust
Stars
125k
Forks
19.5k
Avg merge
1m
Merged PRs (30d)
1k

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openai/codex

All issues in openai/codex

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.