Browser “Always ask” approval setting is ignored; new sites open without prompting

Summary

In the Codex desktop app on Windows, browser approval is set to Always ask, but Codex can open previously unapproved websites without showing an approval prompt.

This is a safety-sensitive failure mode because the restrictive setting appears to fail open.

Expected behavior

When browser approval is set to Always ask, Codex should request approval before opening a new website or domain.

Actual behavior

Codex opens new websites or domains without presenting the configured approval prompt.

Steps to reproduce

1. Open Codex desktop.
2. Set browser approval to Always ask.
3. Ask Codex to navigate to a website or domain that has not already been approved.
4. Observe that the website opens without an approval prompt.
5. Repeat with other unapproved domains.

Environment

• Windows 11 25H2, build 26200.9168
• Codex desktop 26.818.5229.0

Troubleshooting and evidence

• Reproduced across multiple websites or domains.
• The behavior persisted after restart and reset troubleshooting.
• Session logs and browser logs were submitted through the in-app Safety feedback flow.
• Further reproduction notes are available privately if needed.

Related issue

Issue #36953 appears related to persistent browser-permission state, but describes the opposite failure mode: a site remains blocked after a rule is removed. This report is separate because Always ask is being bypassed and the behavior fails open.

Additional note

The private in-app feedback receipt has intentionally been omitted from this public issue. It can be provided directly to OpenAI Support or maintainers through a private channel.

No files, tests, or entry points are mentioned. Reproduce the issue on Windows with browser approval set to “Always ask,” then trace the desktop browser-permission handling and its treatment of unapproved domains. Done means every new website or domain triggers the configured approval prompt instead of opening automatically.