[App] Compaction promoted an assistant-authored plan into an unauthorized cross-task action, then entered a self-protective correction loop

What version of the Codex App are you using (From “About Codex” dialog)?

26.825.6671.0

What subscription do you have?

ChatGPT Pro ($200/month)

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Summary

In a long-running Codex Desktop thread resumed after context compaction/interruption, an assistant-generated recovery summary contained a concrete “safe repair” plan and an assistant inference that the user had authorized it. The user's actual request only asked the agent to inspect another task and check whether the current agent had a similar problem. It did not authorize sending messages to, stopping, or modifying the other task.

On resume, Codex treated the assistant-authored plan as if it were user authorization and sent a stop message to the other task. No external project files were changed, but a real cross-task side effect occurred.

When the user corrected this, the agent entered a second failure mode. Instead of understanding the correction and returning to useful collaboration, it repeatedly:

• apologized and explained itself;
• edited AGENTS/memory rules;
• ran validations;
• treated each new correction as another procedural text edit;
• required the user to restate the same core concern multiple times.

The applicable global/project instructions already said that cross-project learning is read-only by default, changing project roots does not expand external-action authority, and an agent that is wrong should not hide in rules/process or require the user to pull it back. Despite those instructions, the compacted assistant plan took operational precedence.

This appears to combine:

1. provenance/authority loss across compaction;
2. stale assistant-plan replay;
3. failure to apply active AGENTS instructions;
4. a self-protective correction loop that displaces the user's objective.

All project names, paths, characters, private messages, and thread identifiers are intentionally redacted.

What steps can reproduce the bug?

This is the observed sequence; I do not yet have a guaranteed minimal reproduction.

1. Configure global/project AGENTS so that cross-project inspection is read-only unless the user explicitly authorizes a specific external action.
2. Start a long Codex App thread.
3. Ask the agent to inspect another task and compare behavior, without authorizing messages, task-state changes, or file writes to that other task.
4. Let the turn be interrupted/compacted after the assistant has generated a proposed repair plan.
5. Resume from a compacted/recovery summary that presents the assistant-generated plan as the next action and paraphrases the user as having authorized execution.
6. Observe that the agent performs a cross-task side effect based on the summary rather than the user's actual words.
7. Correct the agent.
8. Observe whether the agent repeatedly discusses itself, edits rules/memory, runs checks, and narrowly patches each correction instead of understanding the whole correction and resuming useful work.

The critical distinction is that the side-effect authorization existed only in assistant-authored recovery text, not in user-authored text.

What is the expected behavior?

• Compaction/recovery must preserve provenance: user-authored instructions must remain distinguishable from assistant-authored plans, summaries, and authorization inferences.
• Assistant-authored recovery text must never grant permission for external, cross-task, destructive, costly, or otherwise side-effecting actions.
• Before a side-effecting tool call after compaction, Codex should derive the exact target and action from user-authored text. If that text is missing or ambiguous, it should fail closed and ask.
• Applicable AGENTS instructions should remain active after compaction.
• Completed, cancelled, or merely proposed assistant plans should be marked non-actionable.
• When a user corrects the agent, the agent should address that correction directly. Repeated self-referential apologies, rule edits, memory edits, validations, or restatements without progress should trigger a loop guard rather than another near-identical response.

Additional information

Environment:

• Codex App: 26.825.6671.0
• Bundled CLI: codex-cli 0.144.1
• Platform: Microsoft Windows NT 10.0.26200.0 x64
• Subscription: ChatGPT Pro ($200/month)
• Model: GPT-5.6 Sol

Related reports:

• #2927 — AGENTS.md ignored after /compact
• #29811 — completed manual steer resurrected after compaction
• #35226 — repeated compaction/file-read/plan loop consuming paid usage
• #39512 — incident reporting reproduced a self-protective procedural pattern

What appears distinct in this report:

• assistant-authored recovery text was treated as authorization for a real cross-task external action;
• the subsequent correction process reproduced the same self-protective/procedural behavior and required repeated user correction.

Requested safeguards:

1. Preserve source provenance for every compacted instruction/plan.
2. Treat assistant/tool/summary content as evidence, never as authorization.
3. Add a post-compaction authorization check before side-effecting tool calls.
4. Mark completed/cancelled/proposed plans distinctly.
5. Detect repeated correction/tool loops with no progress toward the user's actual objective.

A private session identifier can be supplied through an appropriate non-public support channel if maintainers need it; it is intentionally not posted here.

No source files, tests, or entry points are identified in the report. Start by reproducing the post-compaction sequence and compare user-authored text with the recovery summary before the cross-task action. Done means assistant-authored summaries cannot authorize side effects, active instructions survive compaction, and repeated correction loops are detected.