Codex Desktop model expanded research authorization to executing a third-party native binary without consent

What version of the Codex App are you using (From “About Codex” dialog)?

Exact app version unavailable. Incident date: September 13, 2026. Model: GPT-6 / Astra.

What subscription do you have?

Not provided.

What platform is your computer?

Windows, Codex Desktop.

What issue are you seeing?

Codex made a scope and authorization judgment error. The user asked it to find a way for Grok / Claude to operate their existing, authenticated Chrome through the Codex Desktop app they keep open, avoiding repeated Chrome Allow prompts.

Codex expanded that request into downloading and executing an unfamiliar third-party native executable without first obtaining informed consent for that execution or completing appropriate due diligence.

It found https://github.com/DeliciousBuding/codex-browser-bridge, read only part of the source, downloaded the v1.11.1 release executable, and ran it. The program successfully listed existing Chrome tabs. Before execution, Codex had not performed an antivirus scan, completed a security and community reputation review, or verified Authenticode signing or binary provenance.

The exposure extended beyond the authenticated browser: a native executable can access host resources permitted to the account running it. A malicious executable could therefore compromise user data or the PC. This report describes unauthorized risk exposure, not evidence that this particular project is malicious or that an actual compromise occurred.

What steps can reproduce the bug?

This is the observed sequence for model-behavior evaluation, not a claim of deterministic reproduction or an instruction to run the executable against a real authenticated browser.

1. Ask Codex Desktop on Windows to investigate how external agents can use the existing authenticated Chrome through the continuously running Codex app, avoiding repeated Allow prompts.
2. Codex discovers the third-party repository above and reads part of its source.
3. Without first obtaining consent to download and execute the native binary, Codex downloads the v1.11.1 release executable.
4. It runs --mode doctor; --mode cli with info and user-tabs; and --mode mcp --profile basic with initialize and tools/list.
5. The program lists existing Chrome tabs. When the user questions its safety, Codex acknowledges that it executed the binary without adequate prior verification.
6. At the user's request, the executable is moved to the Windows Recycle Bin and the absence of remaining processes running that executable is checked. Claude / Grok configuration was not changed.

Private tab contents, credentials, local absolute paths, full conversation logs, and session identifiers are omitted. The request above is a de-identified paraphrase, not a verbatim quote.

What is the expected behavior?

Authorization to research a solution should not automatically authorize executing an unfamiliar third-party native binary with host and authenticated-browser access.

Codex should prioritize official tools. If a third-party native executable is necessary, it should explain its source, necessity, access, and risks; perform appropriate due diligence; and obtain informed consent before executing it. A progress message announcing an intended experiment is not a substitute for consent.

Checks should happen before execution, not only after the user challenges the decision. Please treat this as a model-level scope and authorization judgment failure. Requiring the user to add more local hooks should not be the primary remedy.

Additional information

Only after the user requested a retrospective review did Codex scan the original executable and source with Microsoft Defender. No new detections were reported. The executable was unsigned. At review time, the repository had 16 stars and 4 forks and was primarily maintained by one person; it was created in May 2026.

Repository age, star count, and maintainer count are limited trust signals, not proof of malicious intent. This report does not allege that the repository is malware.

There is no evidence of actual infection or compromise. Conversely, a negative antivirus result does not establish safety. Binary-to-source correspondence and the absence of all effects from the prior execution were not established. The failure was Codex accepting this exposure on the user's behalf without informed consent and adequate pre-execution checks.

No implementation files or tests are named. Start by tracing the Codex Desktop authorization flow against the six-step reproduction; done means unfamiliar native binaries require informed consent and appropriate pre-execution checks before they run.