Codex Desktop submitted a phantom prompt as user input without user action

What version of the Codex App are you using?

26.803.5235.0 (Windows x64)

What platform is your computer?

Windows 11 x64

What issue are you seeing?

Codex Desktop submitted an environment-specific shell command into a side-conversation thread as a user-authored prompt even though the user states they never typed, pasted, or submitted it. The agent then treated it as an instruction and executed it.

I am intentionally omitting the exact command from this public report because it contains Azure resource names.

The user noticed immediately and denied sending the message. A read-only local diagnostics review found:

• Desktop persisted the exact unexpected text in .codex-global-state.json under electron-persisted-atom-state/prompt-history/<thread-id>/2.
• Core telemetry classified the turn as op.dispatch.user_input.
• No preceding assistant or tool event in the local session history contained that exact command before submission.
• The next prompt-history item is the user's complaint that they never requested execution.

This suggests a stale composer/prompt-history value or another UI/session path may have been submitted as user input.

Diagnostic identifiers

• Local time: 2026-08-13 20:56:23 CEST
• UTC: 2026-08-13 18:56:23Z
• Thread ID: 019ffc67-d5e7-7e73-b9a3-8d16aefdf426
• Submission ID: 019ffc77-82ac-7be3-9ea8-788e3a4c8b7e
• Workspace kind: project
• Model: gpt-5.6-sol
• Reasoning effort: ultra

Steps to reproduce

The issue is not currently deterministic. The observed sequence was:

1. Work in a long-running Codex Desktop thread.
2. Start or use a side conversation.
3. Without intentionally submitting a prompt, an unrelated shell command appears as a new user message.
4. Codex dispatches it as user_input.

Expected behavior

Only text explicitly submitted through the composer should be recorded and dispatched as a user prompt. Stale drafts, prompt-history entries, terminal text, suggested commands, or internal context must never be submitted automatically.

Potentially executable command text should also require clear user intent before a bare command is treated as authorization to run it.

Actual behavior

An environment-specific shell command was persisted in prompt history and dispatched as user input despite the user denying any submission.

Security impact

This resulted in an unintended external command execution. In this occurrence it only wrote an ephemeral kubeconfig file and did not modify the cluster, but the same failure mode could trigger destructive actions.

A separate diagnostics concern was discovered during investigation: local logs_2.sqlite may record process-environment contents, including secrets, in plaintext within spawned-command trace entries. The raw database cannot safely be attached publicly. Please provide a secure upload channel if detailed logs are needed.

Additional information

Please correlate the thread and submission IDs above with backend/client telemetry. A sanitized evidence bundle can be provided, but the raw SQLite diagnostics will not be uploaded publicly because they contain credentials.

Start by correlating the provided thread and submission IDs with client and backend telemetry, then inspect the .codex-global-state.json prompt-history entry and the relevant logs_2.sqlite diagnostics safely. Determine which path dispatched the text without explicit composer submission and whether environment contents were recorded in plaintext. Done means the failure path is identified, unintended prompts cannot be dispatched, and sensitive diagnostics are handled safely.