Guardian treats user messages in transcript as untrusted
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 125k
- Forks
- 19.5k
- PR merge metrics
- PR metrics pending
Description
What version of Codex CLI is running?
fork built off of b94343ab (Aug 07). Similar to 0.147.0
What subscription do you have?
azure openai, with codex-auto-review deployment using 5.6 luna
Which model were you using?
gpt-5.6-terra
What platform is your computer?
No response
What terminal emulator and version are you using (if applicable)?
No response
Codex doctor report
What issue are you seeing?
When performing code review (not through /review, just my own prompt cycle), I tried repeatedly to have Codex write results to Github PR comments using gh api. The PR was for the same org/repository/branch that I was working in. Guardian subagent refused repeatedly to do this despite my explicit authorization every time, and called the transcript "untrusted".
This seems to go against the text in the policy template about user messages being trusted; I wonder if the prompt needs to be more specific about what those messages actually look like? Not totally sure though
What steps can reproduce the bug?
Uploaded thread: 019feea1-b16a-7e80-9883-39706c8a318c
What is the expected behavior?
No response
Additional information
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the uploaded thread 019feea1-b16a-7e80-9883-39706c8a318 and the policy template referenced in the report. Compare how Guardian classifies user messages in the transcript with the authorization to use gh api for comments on the same repository and branch; done means the behavior matches the policy's treatment of authorized user instructions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100