[macOS][26.814.41407] Browser repeatedly confirms routine pre-authorized messages

What version of the Codex App are you using?

• ChatGPT/Codex desktop app: 26.814.41407 (build 6720)
• Bundled Codex CLI: 0.148.0-alpha.15
• Browser plugin: 26.814.41407
• Computer Use plugin: 1.0.1000761

What subscription do you have?

Pro

What platform is your computer?

• macOS 26.3.1 (25D2128)
• Apple Silicon / arm64
• App bundle: /Applications/ChatGPT.app
• Bundle identifier: com.openai.codex

What issue are you seeing?

The bundled Browser policy forces an action-time confirmation for every third-party communication, including routine low-impact messages, even when the user has explicitly pre-authorized the exact destination and recurring purpose.

The current Browser policy says:

• "Always Confirm at Action-Time (Even If Pre-Approved)"
• "Representational communication to third parties"
• explicitly includes "low-stakes messages/comments/forms"

Installed policy:

~/.codex/plugins/cache/openai-bundled/browser/26.814.41407/docs/confirmations.md

The same app's current Computer Use policy has the more usable behavior:

• routine low-impact communications do not require confirmation when recipient and purpose are clear
• confirmations should not be repeated unless action, destination, data, amount, permissions, legal terms, or risk materially changes

Installed policy:

~/.codex/plugins/cache/openai-bundled/computer-use/1.0.1000761/skills/computer-use/SKILL.md

This makes the Browser and Computer Use policies contradict each other. It also conflicts with the public Browser documentation, which describes confirmations for sensitive actions rather than every routine message.

The practical case is an external Slack Connect channel. The Slack MCP connector cannot post to external channels, so Codex must use a UI surface. A user gave standing authorization to send factual SEO status updates to one named channel and repeatedly said not to ask again. Browser still requires another blocking confirmation before every post.

This behavior was present in app 26.810.52044 and remains in 26.814.41407.

Related but broader Computer Use report: #33117.

What steps can reproduce the bug?

1. Install and enable the bundled Browser plugin in Codex Desktop on macOS.
2. Give explicit standing authorization for routine, low-impact updates to one named Slack channel, with a fixed purpose and no sensitive data.
3. Later ask Codex to run the recurring workflow.
4. Let Codex open authenticated Slack in the in-app Browser.
5. Observe that Codex stops immediately before typing or sending and requests another confirmation.
6. Confirm, then repeat the same workflow later; the same confirmation is requested again despite the unchanged destination, purpose, and risk.

What is the expected behavior?

Align Browser with the current Computer Use policy:

• routine, low-impact communications should not require another confirmation when recipient and purpose are clear and the user has authorized the workflow
• retain action-time confirmation for legally binding, financial, security-sensitive, credential, sensitive-data, or otherwise high-impact actions
• do not repeat a confirmation when the exact action, destination, data, permissions, and risk have not materially changed

Alternatively, provide a supported persistent per-destination or per-workflow permission for routine Browser communications.

Additional information

A safe local workaround is to route the same Slack Connect message through the authenticated Slack desktop app using Computer Use. That avoids the redundant prompt because the current Computer Use policy already distinguishes routine communications from high-impact ones.

Start by comparing the installed Browser policy at ~/.codex/plugins/cache/openai-bundled/browser/26.814.41407/docs/confirmations.md with the Computer Use policy at ~/.codex/plugins/cache/openai-bundled/computer-use/1.0.1000761/skills/computer-use/SKILL.md. Trace each policy to its repository source and reproduce the repeated Slack confirmation. Done means routine authorized messages no longer prompt repeatedly while high-impact actions still require confirmation.