[Bug] Codex Desktop replays ~150k cached input per tool call and rapidly drains Plus usage

What version of the Codex App are you using (From “About Codex” dialog)?

ChatGPT/Codex Desktop 26.903.61454 (build 8378); bundled Codex CLI 0.153.4.

What subscription do you have?

ChatGPT Plus.

What platform is your computer?

Darwin 25.6.0 arm64 arm

What issue are you seeing?

A short Codex Desktop conversation with small user messages rapidly consumes the 5-hour allowance because the full cached context is replayed for every model/tool step.

In the affected session:

• Input tokens: 5,690,989
• Cached input tokens: 5,511,680 (~96.9%)
• Output tokens: 17,161
• Reasoning output tokens: 8,582
• Per-call input near the end: ~158,000 tokens
• Per-call cached input near the end: ~157,000 tokens
• Effective model context window reported by the rollout: 258,400 tokens
• 5-hour usage increased from 11% to approximately 30% during a short diagnostic conversation

The user messages themselves were short. The dominant usage was repeated cached-input replay across tool calls.

This is on gpt-5.6-sol with model_reasoning_effort = "medium" and default service tier.

The local user Skill directory contains only .system; no personal Skill is installed there. However, codex plugin list --json reports nine OpenAI bundled/runtime plugins as installed and enabled:

• codex-app-tools@openai-bundled
• unified-computer-use@openai-bundled
• chrome@openai-bundled
• visualize@openai-bundled
• documents@openai-primary-runtime
• pdf@openai-primary-runtime
• spreadsheets@openai-primary-runtime
• presentations@openai-primary-runtime
• template-creator@openai-primary-runtime

codex-app-tools eagerly exposes a large Codex Desktop MCP tool surface. Its bundled MCP configuration has no deferred-tool configuration. unified-computer-use contains omit_tools_from = ["code_mode", "deferred"].

The feature inventory reports:

skill_search                    stable             true
tool_search                     removed            false
executor_capability_discovery   under development  false
recommended_plugins             stable             false

Despite recommended_plugins reporting false, codex debug prompt-input shows that a 3,315-character <recommended_plugins> block is still injected into a fresh prompt.

For a fresh prompt containing only seven user characters, codex debug prompt-input reports 17,349 characters of message context before the actual user text:

skills instructions        5,307 chars
permissions                   362 chars
apps instructions             646 chars
plugins instructions        1,014 chars
multi-agent instructions    2,535 chars
recommended plugins         3,315 chars
AGENTS.md                    3,438 chars
environment context           422 chars

This 17k-character message context does not include the separately supplied tool schemas. Actual model requests in the affected Desktop thread reached ~158k input tokens.

codex doctor --summary reports that the configuration loads successfully with zero configuration warnings, so this does not appear to be a malformed config file.

What steps can reproduce the bug?

1. Use Codex Desktop 26.903.61454 on macOS with the OpenAI bundled/runtime plugins above enabled.
2. Use gpt-5.6-sol with medium reasoning.
3. Start a new projectless Codex conversation and send a few short questions about Codex configuration or usage.
4. Let Codex perform several normal web/shell inspection calls.
5. Inspect the current rollout JSONL token_usage_record and token_count events.
6. Observe that each model step replays an increasingly large cached context (~150k tokens in this reproduction), while the 5-hour usage percentage rises rapidly.
7. Run codex debug prompt-input 'test' and observe that the recommended-plugin block is present even though the feature inventory reports recommended_plugins = false.

Affected session ID:

01a08919-3f68-7412-baee-d58708d7718d

The raw rollout is not attached publicly because it contains conversation and local-environment details, but it can be provided privately to OpenAI maintainers if needed.

What is the expected behavior?

• Bundled plugin tools should use progressive disclosure/tool search rather than eagerly supplying a large tool schema catalog.
• Cached context should not drain a Plus allowance this quickly during ordinary short conversations and inspection calls.
• A disabled recommended_plugins feature should not inject the full unavailable-plugin list.
• Codex Desktop should expose per-turn quota attribution for uncached input, cached input, output, reasoning, and tool/schema overhead.
• Context should be compacted or pruned before repeated tool calls replay ~150k tokens.

Additional information

This appears related to, but is not identical to:

• #40897 — repeated context growth and extreme cached-token quota consumption during tool calls
• #28823 — 5-hour usage meter consuming much faster than comparable historical usage
• #24896 — abnormal context usage in a session started with a simple hi
• #33634 — usage draining rapidly across a small number of ordinary tool calls

The distinguishing details here are Codex Desktop, OpenAI-bundled plugins, the absence of personal Skills, eager app-tool exposure, and recommended_plugins=false not preventing prompt injection.

Start with codex debug prompt-input 'test', codex plugin list --json, and codex doctor --summary to compare the reported feature state with injected prompt content. Then inspect the affected rollout JSONL token_usage_record and token_count events; done means identifying and correcting the repeated context or plugin-schema overhead and verifying that short tool-call conversations no longer show the reported growth.