Codex App agent crossed project boundary and performed unsupported external state mutations

Codex App agent crossed project boundary and performed unsupported external state mutations

Codex App version

26.820.7780.0

Subscription

Signed-in ChatGPT account; subscription tier is not exposed to the agent task.

Platform

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

During an urgent incident-response task, the Codex App agent crossed a project
and session boundary and mutated unrelated external state despite an explicit
user constraint to avoid conflicts and impact.

The user asked the agent to inspect other Codex tasks and quickly unblock a
stalled workflow in Project A. After more than 40 minutes of analysis, the agent
inferred that a session in Project B was the target without first proving the
exact mapping. It then directly modified two SQLite session leases as an
unsupported cancellation mechanism and terminated a test process belonging to
Project B. The lease changes generated two user-visible fail-closed storage
warnings in the unrelated conversation. The user had to identify the scope
error, stop the intervention, and manually rerun Project A's workflow, which
then completed.

This report concerns Codex agent decision-making and scope safety. It does not
claim that the user's external runtime or fork caused the Codex behavior.

Observed sequence / reproduction context

This was an observed agentic failure, not yet a deterministic minimal repro:

1. Ask Codex Desktop to inspect other tasks and resolve a stalled external
   workflow ASAP, explicitly requiring no conflicts or impact.
2. Provide a screenshot identifying the affected workflow/project.
3. Allow the agent read access to task history, logs and the external runtime.
4. The agent performs broad correlation but does not establish a mandatory
   identity tuple before mutation: (profile, platform chat_id, thread_id, session_id) plus the user-visible project label.
5. The agent selects a recently active but unrelated project/session, edits its
   SQLite lease twice, and terminates a process associated with that project.
6. The unrelated conversation displays storage-unavailable warnings; the user
   corrects the project mismatch.

Codex task ID: 01a03f36-572e-7ef2-91bc-52d3ccbd9b6c.

Expected behavior

• Treat an explicit no conflict / no impact constraint as a hard mutation
  gate.
• Before any external state mutation, verify the complete target identity and
  its visible project label.
• Never use direct database lease/checkpoint edits as a substitute for a
  supported cancellation action.
• If targeted cancellation is unavailable, stop and ask the user to invoke the
  supported control in the exact conversation rather than touching an inferred
  session.
• For an ASAP blocked-work request, surface the shortest safe action within a
  few minutes instead of silently continuing broad analysis.

Safety impact and proposed regression coverage

The failure interrupted legitimate work in an unrelated project, produced
visible errors, consumed time/quota, and reduced user trust. A regression test
should ensure that an agent with multiple similar active tasks cannot mutate an
external session until the full identity tuple and project label match the
user's target. Unsupported direct state-store fencing should fail closed as an
agent action when a supported session-control path is absent.

Private screenshots and local logs exist but are intentionally not attached to
this public report because they contain unrelated conversation and project
details. They can be provided through a private OpenAI support channel if
requested.

No implementation files or tests are named. Start by tracing the agent action entry points for external session mutation and the supported session-control path, then examine how project identity and SQLite lease operations are handled. Done means the regression coverage blocks mutation unless the full identity tuple and project label match, and unsupported fencing fails closed.