Codex Security Deep Scan spends ~3 hours in discovery at 16/40 reviews with high resource use

What issue are you seeing?

A Codex Security Deep Security Scan launched from the Codex desktop app spent nearly three hours in discovery on a local repository whose inventory contained 63 files. It had completed 16 independent discovery reviews out of the default maximum of 40 when the user asked us to cancel. The user reports this is the fifth time a security-audit workflow has consumed substantial tokens/time with little result. The earlier four occurrences have not been independently correlated with this scan.

This is an anomalous performance/resource-use report, not a claim that an infinite loop has been proven. Read-only status and process checks indicated the run was active at points. We need diagnostics to distinguish expensive intended independent passes, repeated work after worker/context restarts, an ineffective novelty stop, or a phase-transition stall.

Environment

• Codex desktop on macOS, Codex Security plugin installed (package directory reports 0.1.24; the running scan's exact loaded version was not separately attested)
• Repository-wide Deep Security Scan, local worktree, 63-file inventory
• Observed 2026-09-19
• Default maximum of 40 discovery runs was shown in scan context; no measured repository coverage percentage or exact token/cost total was available from the status checks

Steps / observations

1. Start a repository-wide Deep Security Scan through Codex on a local codebase.
2. Observe discovery for nearly three hours. One snapshot showed 15 completed independent reviews and 4 active; just before cancellation it showed 16 completed and 0 active, with a maximum of 40. The 16/40 count is 40% of the review cap, not 40% of repository coverage.
3. The user sets a final five-minute deadline and requests cancellation. The scan is confirmed canceled; no consolidated or sealed Deep Scan report is emitted. We do not classify the lack of a report after explicit cancellation as a separate finalization bug.
4. No automatic replacement scan was started.

Expected behavior

• Expose elapsed time, actual source coverage, per-worker novelty, token/cost use, and a useful ETA or warning early in a disproportionately expensive run.
• Detect genuinely repeated/stalled work and surface whether the 40-pass default or stop_after_no_new is driving the continued discovery.
• Offer a readily visible bounded time/cost setting before a desktop Deep Scan; on reaching that limit, preserve completed evidence and produce a clearly marked partial result where supported.
• Provide a private diagnostic path to correlate this occurrence with previous runs without publishing repository contents or session logs.

The documented deep-scan default of up to 40 independent reviews may explain some of the duration, but not whether these five reported high-use/low-output occurrences share a worker/coordinator defect. This needs investigation rather than an assumption of a literal loop.

Related but distinct: #38453 (missing discovery artifact and automatic rerun) and #35912 (completed scan could not finalize). This run was explicitly canceled at 16/40, with neither failure observed.

I have omitted repository identity/path, source code, scan ID, handoff tokens, and local logs from this public report. Sanitized diagnostics can be supplied privately after review.

Start at the repository-wide Deep Security Scan discovery flow launched from the Codex desktop app, then inspect how the 40-review cap, worker restarts, novelty stopping, and cancellation are recorded. Reproduce with a bounded local scan if available and capture elapsed time, coverage, per-worker novelty, and token/cost diagnostics. Done means the cause is distinguished and the run exposes actionable progress and stop diagnostics without publishing repository contents.