Codex desktop attributes automatically supplied AGENTS.md updates to the user

What version of the Codex App are you using (From “About Codex” dialog)?

Codex desktop — Windows package version 26.901.6511.0

What subscription do you have?

Pro 20x

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

After a global AGENTS.md update, the assistant received the updated instructions and responded as though I had sent them as a conversational message.

It said: “Received the replacement instructions…”

When I asked what it meant, it said: “I meant the updated operating instructions you just supplied.”

My visible conversation contained no corresponding message from me. I had to share a screenshot and question the discrepancy before the assistant distinguished the instruction update from my conversational input.

The instructions were legitimate. The problem was attribution: the assistant treated application-supplied context as something I had directly said.

You can imagine how problematic this can be if injected agents.md updates are treated as live owner provided instruction mid chat. This should be patched quickly if agents cannot determine instruction source and thus conflicts priority or authority to current tasking.

What steps can reproduce the bug?

Suggested reproduction based on this occurrence; repeatability has not been confirmed:

1. Open an existing conversation in Codex desktop.
2. Update the global AGENTS.md instructions.
3. Continue the conversation after the updated instructions are supplied to the assistant.
4. Check whether the assistant identifies the update as operating context or attributes it to a new user message.

What is the expected behavior?

Application-supplied instruction updates should be clearly distinguishable from user-authored conversational messages.

The assistant should be able to identify the instruction source and should not imply that the user typed, requested, or approved something merely because an instruction update entered its context.

Additional information

The assistant reported that the update appeared in its input as a user-role message. This is the assistant’s account, not an independently verified transport diagnosis.

Observed impact: confusing responses and loss of trust because the assistant referenced a message the user could not see.

Potential impact: mistaken attribution could affect how an assistant interprets user intent or authorization. No unintended execution was observed in this exchange.

Start by reproducing the existing-conversation flow after a global AGENTS.md update and inspect how that application-supplied context enters the assistant input. Done means the assistant distinguishes the update from user-authored messages and does not attribute it to the user; repeatability is not yet confirmed.