[Privacy] Codex initiates screen capture while no task is running, offline, and usage quota is exhausted

Start by reviewing related issues #30639 and #24367, then correlate the Feedback ID with the reported July 28 timestamps and the macOS capture indicator. Identify which component initiated capture and whether frames were saved, processed, queued, or uploaded. Done means the trigger and data handling are explained, or the behavior is prevented unless an active user-authorized feature requires it.

Codex version

26.721.41059

Platform

• macOS 15.6.1 (24G90)
• Mac mini M4 / Apple Silicon
• ChatGPT Plus
• Network environment: mainland China; the VPN was disconnected and Codex had no usable connection to OpenAI

Feedback ID

no-active-thread-019fa86a-af63-7e20-bc8c-359946efce7d

Summary

Codex Desktop has unexpectedly initiated macOS screen capture on at least four observed occasions without any user action.

Three occurrences happened on July 28, 2026, and one happened earlier. To the best of my recollection, every observed occurrence happened under the same conditions:

• Codex was open, but no task was running.
• My Codex usage quota was exhausted.
• Codex could not connect to OpenAI because the VPN was disconnected.
• I did not invoke Computer Use, AppShot, browser capture, a keyboard shortcut, or any other screen-aware feature.
• macOS explicitly displayed: “Codex is capturing your screen.”
• The capture indicator disappeared by itself after several seconds.
• The Codex UI and Codex Pet showed no corresponding activity.

The screenshots from the latest occurrence show the indicator continuously from approximately 11:11:13 through 11:11:17 China Standard Time (UTC+8), establishing a duration of at least four seconds.

I previously used screen-aware Codex features and granted macOS Screen Recording permission. However, grep -n 'chronicle' "$HOME/.codex/config.toml" returns no output, so there is no explicit chronicle entry in my config file. I understand that this alone does not prove Chronicle is disabled or inactive.

Having permission should not cause unexplained capture when no task or user-requested operation is active.

I have no evidence that the captured frames were uploaded, especially because Codex had no usable network connection. The directly observed issue is that local screen capture was initiated without a visible trigger or explanation.

Steps to reproduce

The behavior is intermittent and I cannot intentionally trigger it:

1. Leave Codex Desktop open.
2. Do not start or queue any task.
3. Reach the Codex usage limit.
4. Disconnect the VPN so Codex cannot reach the service.
5. Continue using other applications normally.
6. At an unpredictable time, macOS may report that Codex is capturing the screen for several seconds.

Actual behavior

Codex activates macOS screen capture for several seconds even though:

• no task is running;
• no user action requested screen access;
• the usage quota is exhausted;
• Codex has no usable network connection;
• neither the main Codex UI nor Codex Pet indicates any activity.

No screenshot appeared in a conversation, and the app provided no explanation of whether the frames were stored, processed, discarded, or associated with Chronicle.

Expected behavior

Codex should capture the screen only when an active, user-authorized feature requires it.

If a background feature such as Chronicle initiates capture, Codex should:

• clearly show which feature is capturing and why;
• provide an immediately effective pause/disable control;
• avoid capturing unrelated personal activity while no task is running;
• disclose whether frames are stored locally or transmitted;
• visibly attribute any usage consumed by that background feature.

Impact

This creates a serious privacy and trust concern because the computer was being used for unrelated personal activity, including private conversations and watching Bilibili.

The lack of any corresponding activity inside Codex makes it impossible to determine why the screen was captured, what content was retained, or whether similar captures happened without being noticed.

It also raises a usage-accounting concern. My quota was already exhausted when the latest event was observed, and I cannot determine whether earlier background Chronicle or Computer Use activity contributed to that exhaustion.

Please correlate my account usage and diagnostics with the Feedback ID and reported timestamps. If background screen capture or Chronicle processing consumed quota without a visible user-initiated task, please consider restoring the affected usage or advise which support channel can review it.

Evidence

Three screenshots from the latest occurrence were captured at:

• July 28, 2026, 11:11:13 CST (UTC+8)
• July 28, 2026, 11:11:15 CST (UTC+8)
• July 28, 2026, 11:11:17 CST (UTC+8)

All three show the macOS message that Codex is capturing the screen while the Codex window simultaneously shows that the usage limit has been reached and no task is executing.

The screenshots will be attached in a follow-up comment because the issue-submission integration cannot upload local image files.

Possibly related

• #30639 — Chronicle continuously captures screens and may consume plan limits in the background
• #24367 — Chronicle repeatedly starts short-lived screen-capture helper processes on macOS

This report adds evidence from the newer Codex build 26.721.41059, with no active task, no usable network connection, and an exhausted usage quota.

Requested investigation

1. Identify which Codex component initiated the captures at the reported times.
2. Confirm whether any frames were saved, analyzed, queued, or later uploaded.
3. Confirm whether Chronicle can capture while offline, quota-exhausted, and without an active task.
4. Add a visible capture reason and an immediate pause/disable control.
5. Attribute any Chronicle/background usage separately.
6. Review whether unrequested background processing consumed account quota and whether that usage can be restored.