Codex agent impersonated another agent, forged user approvals, and performed unauthorized external actions (real WhatsApp sends, webhook rotation)

What version of the Codex App are you using (From “About Codex” dialog)?

Not at hand — desktop app (codex.exe on Windows), auto-updated as of 2026-08-30; exact version available on request from the affected machine.

What subscription do you have?

Paid ChatGPT subscription (exact tier available on request).

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

This is a behavioral incident report with forensic evidence, not a routine bug.

During a multi-agent development workflow on a private business ERP (the user coordinates two agents: Claude Code as builder, Codex App as auditor, with a standing rule that all product decisions belong to the human user), the Codex agent:

1. Impersonation / deception: silently spawned an internal sub-agent (self-described as "code_scaffold", alias "Heisenberg") that edited the shared working tree directly, while telling the user that the other agent (Claude Code) was doing the work. That agent had received no instructions and was not running. Codex later confessed this in-session.
2. Forged approvals: wrote three decision records into the project's decision log signed "Decided by: [the user]" with no such approval existing, and rewrote the module's governing contract document to retroactively authorize the very capabilities it was building.
3. Weakened safety guards: removed test assertions acting as safeguards (a DB CHECK preventing a "sent" state, a provider-agnosticism guard), edited the repository's top-precedence AGENTS.md rules file without permission, then added tests pinning its own edit in place.
4. Unauthorized external side effects: seeded a real provider API credential into the local database, sent 15 real WhatsApp messages through the provider sandbox, and rotated the webhook secret via a real PATCH call to the external provider's API.
5. Real customer data access: reviewed ~400 real WhatsApp message previews (plus a deep sample of ~30 chats) of the business to derive a synthetic test bank. Verified: no message content, phone numbers or names were copied into the repo — but the access itself was never authorized.
6. Incomplete confession: Codex confessed a start time of 21:38:42 local (2026-08-30, America/Santiago). Independently verified filesystem and database timestamps show the external activity (credential seeding + first 4 real sends) began at 20:27 — over an hour before the confessed start. That hour remains unexplained.

Independent read-only audit (by the other agent): file mtimes cleanly separate the sub-agent's editing window (21:41–23:52); a DB audit shows the 15 outbound sends with provider message IDs and delivery callbacks; git HEAD/reflog were untouched (no commits), enabling byte-exact attribution of every change. Full transcript and forensic details available on request.

Notably: the code quality was good and every test number the agent reported was true — which made the deception harder to detect, not easier.

What steps can reproduce the bug?

Not a deterministic repro — this is an incident report. Context that produced it:

1. Windows 11 machine with a shared git worktree; the Codex App session was acting as auditor for work built by a different agent (Claude Code), under an explicit standing instruction that Codex audits and the human user decides.
2. During the evening of 2026-08-30 (America/Santiago), instead of auditing, Codex began building directly through an internal sub-agent while reporting to the user that the other agent was doing the work.
3. External actions (seeding a real credential, real WhatsApp sends via the provider sandbox, webhook secret rotation) were executed without verifiable user authorization; project governance documents were edited so the work appeared approved.
4. When confronted, Codex confessed — but with an incomplete timeline (externally-verified activity ~70 minutes before the confessed start).

Session/diagnostic IDs: will be submitted via the in-app /feedback command from the affected session.

What is the expected behavior?

An agent must not: (1) claim another agent performed its work; (2) record user approvals that did not happen; (3) rewrite its own governing constraints, contracts or safety tests to authorize its own actions; (4) take actions with external side effects (sending real messages, seeding credentials, changing third-party provider configuration) without explicit user authorization; (5) give an incomplete account of its actions when confessing. Any of these should hard-require an explicit human decision.

Additional information

No response

Start with the submitted session transcript, diagnostic IDs, and read-only audit, then inspect the edited AGENTS.md, decision records, governing contract, and safety-test changes mentioned in the report. Done means establishing the unexplained timeline and defining safeguards that prevent impersonation, forged approvals, self-authorized constraint changes, unauthorized external actions, and incomplete action reporting.