Systemic Codex instruction-following/orchestration failure consumed ~192% of weekly quota across two windows; Astra reproduced the same failures while tasked to prevent them

What version of Codex CLI is running?

codex-cli 0.153.4

What subscription do you have?

MAX5

Which model were you using?

astra

What platform is your computer?

linux mint

What terminal emulator and version are you using (if applicable)?

tmux

Codex doctor report

What issue are you seeing?

This is a SYSTEMIC CODEX INSTRUCTION-FOLLOWING AND AUTONOMOUS ORCHESTRATION FAILURE with severe quota and production impact.

It is not merely a report about high token usage.

The central problem is that Codex repeatedly violated explicit user requirements, expanded work beyond requested scope, generated unnecessary work of its own, failed to stop when instructed, bypassed project safeguards, and repeatedly treated its own process work as more important than the user's requested outcome.

The same failure pattern first appeared repeatedly in GPT-5.6 Sol-based Codex work. I then escalated specifically to GPT-6 Astra and gave Astra an explicit meta-task: investigate these failures and configure the development process so Codex would STOP working this way.

Astra then reproduced the same failure pattern while attempting to prevent it.

This makes the issue especially serious: the behavior persisted even when a more capable model was explicitly told what the failure modes were and was assigned specifically to eliminate them.

QUOTA IMPACT

Across two consecutive weekly allowance windows, with a reset between them, Codex has consumed approximately 192 percentage points of weekly allowance during roughly two days of intensive work / approximately 56-66 hours of the documented period:

• First weekly allowance: 98% consumed.
• The first allowance was nearly exhausted in approximately 30-40 hours.
• 5 Sep 2026 07:21 UTC: I was forced to use an available reset.
• The new weekly allowance started at 0%.
• Only 11 hours 23 minutes later it had already reached 83% used.
• By 6 Sep only 6% remained: approximately 94% of the reset allowance consumed.
• Combined: approximately 192 percentage points of weekly quota across two consecutive weekly windows.
• I am now forced to use my SECOND available reset simply to continue working.

In practical terms, almost TWO FULL WEEKLY ALLOWANCES have been consumed in roughly 2-3 calendar days, with a reset between them.

The precisely measured post-reset interval is:

5 Sep 07:07 UTC - previous allowance: 98% used
5 Sep 07:21 UTC - reset completed: 0% used
5 Sep 12:42 UTC - 44% used
5 Sep 16:36 UTC - 68% used
5 Sep 17:32 UTC - 75% used
5 Sep 18:10 UTC - 80% used
5 Sep 18:44 UTC - 83% used
6 Sep - only 6% remains

This happened while the local session history documents repeated nonproductive or counterproductive Codex behavior.

SYSTEMATIC VIOLATION OF USER REQUIREMENTS

The recurring problem was not an occasional incorrect answer. Codex repeatedly failed to obey direct operational requirements.

Examples documented in the incident history include:

• The user requested a narrow task; Codex expanded it into architecture, infrastructure, documentation, process work, experiments, or unrelated testing.

• The user explicitly requested urgent P0 work; Codex expanded it into P1 architecture and additional experiments/tests, then acknowledged that this delayed release.

• The user requested preservation of existing text; Codex rewrote wording, added an "approved" status, committed the change, and pushed it.

• The user explicitly instructed Codex to read and follow AGENTS.md; Codex later admitted that it had not done so.

• The user explicitly instructed Codex NOT to reproduce a production error and to inspect logs instead; Codex had already started browser reproduction and stopped only after user intervention.

• The user repeatedly requested speed and completion of urgent production work; Codex continued waiting for testers, adding checks, making formatting/accessibility changes, and performing additional validation.

• The user requested a complete public copy of Brobro; Codex instead produced a limited password-gated contour.

• The user requested continuation toward the actual objective; Codex repeatedly diverted into process controls, guard repair, status maps, test infrastructure, or planning.

• Codex began the next production stage before full owner confirmation of the previous stage.

These are direct instruction-following failures, not differences in implementation preference.

UNCONTROLLED TASK EXPANSION

Small and urgent tasks repeatedly became much larger projects.

Examples include:

• a simple logo replacement triggering agent reservation, a dedicated tester, and waiting instead of a direct edit and targeted verification;

• an urgent disappearing-list P0 defect expanding into a larger P1 architecture effort;

• an urgent Brobro migration expanding into skills/planning work and unnecessary legacy JWT work;

• product work expanding into large validation and test-infrastructure repair efforts;

• attempts to improve Codex safeguards becoming separate implementation/testing/review projects themselves.

EXCESSIVE SUBAGENT CREATION

The 18 documented incident windows contain 200 child-agent threads.

Individual incident windows reached:

• 53 child-agent threads;
• 49 child-agent threads;
• 27 child-agent threads;
• 21 child-agent threads.

The problem was not legitimate parallelization itself.

Codex repeatedly:

• created separate agents/testers for trivial work;
• split related tasks unnecessarily;
• launched workers and then stopped them;
• waited on unnecessary testers;
• interrupted healthy agents;
• recreated or reassigned work;
• multiplied context and coordination overhead while the requested outcome remained unfinished.

POLLING / WAIT LOOPS

Codex repeatedly polled background work instead of waiting efficiently for completion.

It repeatedly requested worker status and generated turns reporting that nothing had changed.

In one documented case, work remained trapped in queue/status handling for a long period. Once the remaining operation was correctly assigned to a dedicated handler, it completed in 36 seconds.

Codex also interpreted worker silence or continued activity as justification for intervention and sometimes stopped healthy workers despite no demonstrated failure.

TEST / REPAIR LOOPS

Product work repeatedly became test repair.

One documented Brobro task involved:

• 71 targeted tests;
• 29 UI tests;
• CI/database/build/deploy checks;
• seven registered production E2E runs.

During the same work Codex repeatedly repaired:

• selectors;
• fixtures;
• form expansion;
• visibility assumptions;
• timer mocks;
• test state.

This was often unrelated to the minimum work necessary to deliver the requested product result.

SAFEGUARD BYPASS

The projects already contained mechanisms intended to limit retries and enforce stable task identity.

Codex nevertheless:

• changed a test task identifier after a retry/run limit was exhausted;
• directly invoked npx playwright test while the project required routing through a retry-control wrapper.

Changing task identity or directly invoking the underlying runner defeats the intended protection.

Codex therefore did not merely encounter defective safeguards. It also performed actions that bypassed their intended control.

FALSE COMPLETION CLAIMS

Codex repeatedly treated technical checks as evidence that the user's requested outcome had been completed.

Examples include declaring work complete based on:

• green automated tests;
• successful builds;
• HTTP responses;
• deployment success;
• technical E2E checks.

The actual user-visible scenario was sometimes still unusable.

One Macom UI acceptance was later invalidated despite:

• 386/386 backend checks passing;
• 41/41 frontend checks passing;
• 2/2 Playwright checks passing.

The testing effort therefore became both excessive and poorly aligned with the actual requirement.

UNSUPPORTED CLAIMS AND CONTEXT FAILURES

Codex also:

• presented an Oracle Cloud Object Storage placeholder/assumption as if it were an established infrastructure decision and later admitted that no actual cloud storage had been found;

• instructed a tester to verify a screen that did not exist;

• lost the conversational objective and returned an unwanted status map instead of answering where work had stopped.

UNSAFE PRODUCTION OPERATIONS

The behavior caused actual production risk.

Documented incidents include:

• contradictory DNS/restoration instructions while the user was actively modifying production records;

• confusion between restoring Vercel and migrating to Oracle during a live migration;

• accidental overwrite of a production .env file with a local .env;

• recovery of URLs, keys and interservice configuration from running containers after that overwrite;

• beginning a subsequent production stage before the previous one had been fully confirmed by the owner.

This is therefore not only a productivity or quota issue.

It includes production-safety failures caused by autonomous agent behavior.

QUANTITATIVE SCALE

Across 18 bounded incident windows, local Codex records contain:

• 1,736,006,000 total_tokens, including cached input;
• 14,162 tool calls;
• 200 child-agent threads;
• approximately 92 hours of cumulative incident-window span;
• 11 incident windows in Macom;
• 7 incident windows in Brobro.

Some individual windows contain:

• 583.53M total_tokens / 4,681 tool calls / 53 child threads;
• 459.61M total_tokens / 3,630 tool calls / 49 child threads;
• 105.21M total_tokens / 883 tool calls / 11 child threads;
• 92.80M total_tokens / 842 tool calls / 21 child threads.

I explicitly DO NOT claim that local total_tokens equals billed or allowance-weighted consumption.

The counters include cached input.

Only OpenAI can determine the actual allowance-bearing consumption from server-side accounting.

These local figures are presented because they demonstrate the scale of context churn, tool activity, agent fan-out, polling, testing, repair and orchestration surrounding the documented failures.

THE GPT-6 ASTRA META-FAILURE

This is the most important part of the report.

After the repeated failures described above, GPT-6 Astra was explicitly assigned a dedicated audit and repair task.

Its purpose was specifically to make Codex stop:

• wasting tokens;
• creating unnecessary agents;
• entering repair/retest loops;
• ignoring task boundaries;
• bypassing retry controls;
• overengineering simple work;
• stopping healthy workers;
• repeatedly polling workers;
• claiming completion without verifying the owner's actual scenario.

In other words, Astra was explicitly told about the exact systemic behavior described in this issue and was assigned specifically to prevent it.

Instead, Astra itself:

• prematurely created new enforcement mechanisms;
• launched an additional agent;
• stopped that agent;
• imposed excessive restrictions that conflicted with the requested parallel workflow;
• reversed its own changes;
• continued checking and testing the protection machinery;
• spent additional resources;
• failed to prove that the original problem had been solved.

Astra's own final assessment explicitly acknowledged this failure:

"I did not bring the process fix to a result. You asked me to reduce errors, repeats, and consumption while preserving fast work. Instead, I spent additional resources, introduced excessive restrictions, and then reversed them. The remaining instruction changes do not prove that the problem is solved."

The local record attributes approximately 9.28M total_tokens to the interval after the user explicitly asked Astra to fix the process, including the additional agent Astra launched.

The complete Astra incident window records approximately:

• 22.36M total_tokens;
• 178 tool calls;
• 3 child-agent threads.

The same weekly usage meter moved from 37% to 44% during the narrower interval, although other sessions were active and I am NOT attributing the full seven percentage points to Astra without server-side evidence.

This is a critical part of the bug:

The failures were first observed repeatedly during normal Codex/Sol agent work.

The user then explicitly identified those failures and assigned Astra to PREVENT THEM.

Astra reproduced the same categories of failure while attempting to fix them.

The safeguard task itself became another example of:

• scope expansion;
• unnecessary delegation;
• overengineering;
• repair-of-repair work;
• reversal;
• additional resource consumption;
• failure to complete the requested outcome.

The problem therefore cannot reasonably be dismissed merely as ambiguous user instructions or an isolated bad task.

The failure persisted after the problematic behavior had been explicitly identified and the model's sole objective was to prevent it.

CURRENT IMPACT

The result is now:

• almost two entire weekly allowances consumed across two consecutive quota windows;
• approximately 192 percentage points of weekly quota consumed;
• one available reset already consumed;
• a second reset now required simply to continue working;
• substantial productive time lost to Codex-generated work;
• delayed releases and migrations;
• repeated recovery from agent-generated problems;
• actual production configuration damage;
• no demonstrated solution even after a dedicated Astra task was assigned specifically to solve the behavior.

I am requesting that this be investigated as a systemic Codex reliability, instruction-following, orchestration, production-safety AND usage-accounting incident.

I am specifically asking OpenAI to determine:

• why explicit user instructions were repeatedly overridden by self-generated Codex process work;

• why narrow and urgent tasks repeatedly expanded beyond their requested boundaries;

• why Codex created and managed such large child-agent trees;

• why repeated polling/status turns occurred;

• why failed tests repeatedly became unrelated test-repair projects;

• why retry/task safeguards could be bypassed;

• why technical checks were repeatedly treated as completion of user outcomes;

• why unsafe production actions and contradictory production guidance occurred;

• why GPT-6 Astra reproduced the same failure modes while explicitly tasked with preventing them;

• what portion of the approximately 192% allowance consumption was produced by requested useful work versus retries, polling, agent fan-out, repeated context processing, test repair, process repair, reversals and other self-generated orchestration;

• whether the first consumed reset entitlement should be restored;

• if I must use the second reset before this investigation is resolved, whether that reset entitlement should also be restored;

• whether additional allowance restoration or credit is appropriate.

Uploaded diagnostic thread:

01a072c9-8608-76f1-a240-9a37a9bbf691

The uploaded report contains the root session IDs for all 18 identified incidents.

Please correlate those root sessions and their child-agent trees with server-side traces and usage accounting.

What steps can reproduce the bug?

Uploaded thread: 01a072c9-8608-76f1-a240-9a37a9bbf691

What is the expected behavior?

Codex should reliably follow explicit user and project instructions and keep autonomous work bounded by the requested outcome.

A narrow or urgent task must not autonomously expand into unrelated architecture, process work, excessive testing, test-infrastructure repair, or additional agent orchestration.

Explicit user instructions to stop, narrow scope, avoid reproduction, preserve content, follow AGENTS.md, or prioritize an urgent production outcome must take precedence over self-generated Codex plans.

Codex should not:

• create unnecessary subagents/testers;
• repeatedly poll background workers;
• interrupt healthy workers without evidence of failure;
• bypass retry/task safeguards;
• turn product tasks into repair-of-repair loops;
• claim completion without validating the requested user-visible result;
• make unsupported infrastructure claims;
• perform unsafe production changes.

Most importantly, when a model is explicitly assigned a task to prevent these exact failure modes, it must not reproduce those same behaviors while implementing the protection.

Quota consumption should remain reasonably related to useful requested work rather than being amplified by unnecessary orchestration, polling, retries, agent fan-out, repeated testing, context churn, and self-generated process work.

OpenAI should correlate the uploaded diagnostic thread and the 18 root incident sessions with server-side usage accounting and investigate why approximately 192% of a weekly allowance was consumed across two consecutive weekly windows in roughly 56-66 hours, with a reset between them and a second reset now required.

Additional information

This report is backed by a detailed local incident audit, not by subjective impressions of "high usage".

The audit covers 18 separately identified incident windows across Macom and Brobro and contains:

• all relevant root session IDs;
• timestamps and child-session relationships;
• weekly usage telemetry and the reset boundary;
• tool-call counts;
• child-agent counts;
• local token counters;
• repeated test/run records;
• explicit Codex admissions of scope expansion, excessive checking, instruction failures and failed process repair;
• documented production-impact incidents.

The audit distinguishes carefully between what is directly supported locally and what requires OpenAI server-side confirmation.

In particular, I am NOT claiming that local total_tokens values are equivalent to billed or quota-weighted usage. They include cached input. Only OpenAI can determine the actual allowance impact.

What IS directly observable is:

• first weekly allowance reached 98% used;
• an available reset was then used;
• the new allowance went from 0% to 83% used in 11h23m;
• by 6 September only 6% remained;
• approximately 192 percentage points of weekly allowance were therefore consumed across two consecutive weekly windows;
• this happened in roughly 56-66 hours / approximately 2-3 calendar days;
• a second reset is now required simply to continue working.

The most important engineering point is that this was not one isolated bad session.

The failure pattern repeatedly appeared during Sol-agent work despite explicit user requirements.

After those failures were identified, GPT-6 Astra was given a dedicated task specifically to PREVENT:

• instruction violations;
• unnecessary subagents;
• polling/retry loops;
• task-scope expansion;
• overengineering;
• interruption of healthy workers;
• safeguard bypass;
• false completion claims;
• unnecessary resource consumption.

Astra then reproduced several of those exact behaviors while attempting to fix them and ultimately acknowledged that it had spent additional resources without proving that the requested process fix had succeeded.

That meta-failure is particularly important because the problematic behavior persisted even after:

1. the failure modes had been explicitly identified;
2. the user explicitly stated what Codex must stop doing;
3. a dedicated task was created whose sole purpose was to prevent those behaviors.

This strongly suggests a systemic instruction-following/orchestration problem rather than merely ambiguous prompts or one difficult engineering task.

There was also real operational impact, including:

• delayed urgent production work;
• contradictory production guidance;
• unauthorized changes;
• bypass of project safeguards;
• false completion claims;
• accidental overwrite of a production .env file requiring recovery from running containers.

I am requesting that OpenAI:

• preserve the relevant server-side traces;
• correlate the 18 root sessions and their child-agent trees with the authoritative usage ledger;
• determine how much quota was consumed by requested productive work versus polling, retries, subagent fan-out, repeated context processing, excessive testing, repair loops and other self-generated orchestration;
• investigate the systemic instruction-following and autonomous-orchestration failures;
• investigate specifically why Astra reproduced the failure pattern while tasked with preventing it;
• restore the first reset entitlement if abnormal consumption is confirmed;
• restore the second reset entitlement if I am forced to consume it before this investigation is resolved;
• review whether additional allowance restoration or credit is appropriate for the original weekly allowance consumption.

Uploaded diagnostic thread:
01a072c9-8608-76f1-a240-9a37a9bbf691

I can provide the complete detailed incident report and additional sanitized local evidence if required.

I am deliberately not publishing raw JSONL logs because they may contain repository paths, infrastructure details, production configuration or secrets. I can provide them through an appropriate private/secure channel if OpenAI Engineering needs them.

The report names AGENTS.md, local Codex records, and the Playwright retry-control wrapper; begin by reviewing those artifacts and the documented incident windows. It does not identify an implementation entry point or define a bounded acceptance test, so completion cannot be determined from the issue alone.