Codex agent modified ~/.codex/config.toml without permission and added model_instructions_file, causing possible capability regression

What version of the Codex App are you using (From “About Codex” dialog)?

26.825.6671.0 (current Codex App / Microsoft Store package OpenAI.Codex).

The session that appears to have first written the setting used bundled CLI codex-cli 0.130.0-alpha.5.

What subscription do you have?

ChatGPT account using the Codex desktop app. Plan not specified here.

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64 (Windows 11)

What issue are you seeing?

On Windows 11, in the Codex App, the agent modified the global ~/.codex/config.toml without an explicit request to add model_instructions_file.

I did not add this setting myself. After Codex work, the global config contained:

model_instructions_file = "C:\\Users\\faces\\.codex\\AGENTS.md"

While that line was present, Codex’s problem-solving ability, investigation quality, and general agent behavior felt severely degraded. I am not claiming this setting was 100% of every capability drop. It is a strong candidate / likely contributor / possible direct cause, because model_instructions_file can replace the model’s built-in base instructions with the contents of AGENTS.md.

I have now deleted that model_instructions_file line. At least this abnormal config state is gone.

model_reasoning_effort is not part of this bug. I set that value intentionally.

The main concern is not “model quality” in isolation. It is that the Codex agent was able to change its own global config without explicit permission, and that change can replace its own base instructions and damage its capabilities.

Please investigate which Codex session/process wrote this key, and whether Codex should be prevented from rewriting ~/.codex/config.toml — especially model_instructions_file and similar self-instruction overrides — without explicit user permission.

What steps can reproduce the bug?

I cannot give a minimal one-click repro. What I can report from local logs:

1. Environment: Windows 11, Codex App.
2. I did not ask Codex to add model_instructions_file. I also did not add that line by hand.
3. After Codex agent work, global config.toml contained the exact line above.
4. While the line was present, agent behavior / problem-solving felt severely degraded.
5. After deleting the line, that particular misconfiguration is gone.

Local session history (please treat as a lead, not as a complete root-cause proof):

• Date (UTC): 2026-05-16, around 07:37–07:45Z for the first insertion; around 08:14–08:15Z the value was later pointed at C:\Users\faces\.codex\AGENTS.md.
• Session / thread id: 019e2fb6-10cd-7761-b856-978e945995aa
• Rollout file name: rollout-2026-05-16T16-35-21-019e2fb6-10cd-7761-b856-978e945995aa.jsonl
• CLI version recorded on the thread: 0.130.0-alpha.5
• Model recorded on the thread: gpt-5.5
• Source recorded on the thread: vscode / Codex App session on Windows

In that session, the user asked about workspace / rule-file behavior. The agent chose to write model_instructions_file into the global config. The user did not name that config key.

The line then remained in global config until I removed it on 2026-08-30.

Related but not the same issue:

• #15680 is about the agent editing project-level .codex/config.toml (closed). This report is about global ~/.codex/config.toml and specifically model_instructions_file.
• #40042 / #14515 are about model_instructions_file being ignored or applied incorrectly. This report is about the agent writing that key without permission.

What is the expected behavior?

• Codex should not modify ~/.codex/config.toml unless the user explicitly asks to change that setting.
• In particular, Codex should not set or change model_instructions_file (or similar keys that replace/override built-in base instructions) without explicit permission.
• If the agent believes such a change is needed, it should explain the effect (including that it can replace built-in base instructions) and wait for approval.
• Global config that controls the agent’s own instructions should be treated as protected, not as an ordinary project file.

Additional information

Please investigate internally which session/process wrote model_instructions_file on this machine, using the session id above if it helps.

I am intentionally not attaching the full config.toml, extra local path dumps, or account identifiers.

Start by tracing writes to ~/.codex/config.toml and inspect the named rollout JSONL for session 019e2fb6-10cd-7761-b856-978e945995aa. Determine which Codex process wrote model_instructions_file and whether global instruction-related settings can be changed without approval. Done means the writer and cause are identified, with a clear protection or approval behavior for these settings.