[cli security] Different command is run compared to what is approved
Resolved 💬 4 comments Opened Feb 8, 2026 by jkflying Closed Feb 14, 2026
💡 Likely answer: A maintainer (etraut-openai, contributor)
responded on this thread — see the highlighted reply below.
What version of Codex CLI is running?
0.98.0
What subscription do you have?
plus
Which model were you using?
gpt-5.3-codex
What platform is your computer?
Linux 6.8.0-88-generic x86_64 x86_64
What terminal emulator and version are you using (if applicable)?
Terminator
What issue are you seeing?
This has happened twice now. I approved to run a build, and I guess it had also already queued a test run command, which got run instead of what I approved.
This could be a major security issue if something like a delete runs instead of what the user approved.
<img width="721" height="208" alt="Image" src="https://github.com/user-attachments/assets/8ec97ced-71e6-4257-a62c-b1845aa49937" />
What steps can reproduce the bug?
Disable edits-without-approval
Get the model to make 2 edits directly in a row
What is the expected behavior?
_No response_
Additional information
_No response_
4 Comments
Thanks for the bug report. If you still have that session handy, please resume it and run
/feedbackto upload the session details, then post the thread ID here. Having the session details will help us diagnose this.It just happened again, but the other way around this time. I was asked to approve running the tests and it did the build, and then the other way around.
thread ID:
019c3ebf-2d75-7c82-a97a-bc12daaa0d77Our latest models support parallel tool calling. I suspect that's what's happening here. The agent is able to generate multiple tool call requests in a single response, and the harness can execute these in parallel when there are no dependencies between them. If the agent specifies multiple tool calls and one or more require approval, it's possible to see a behavior like the one you're describing. A tool call that doesn't require approval can execute while the harness is waiting for approval on a separate tool call. Once the approval UI is dismissed, you'll see the tool call event from the other tool call.
Does that sound like it explains the behavior you're seeing?
Yes that sounds right, it looks like there's some unsynchronized behavior there, so the tool call that was meant to run first got run second, even though what I approved was what was meant to run first.
The second (byproduct of previous race condition) is that the tool call orders being mixed up, so the tests get run before the changes get built. This is annoying but the model figures out something went wrong and tries again, one at a time. So less serious.
As an aside, for something like build-then-test, it's important that the build completes before the tests starts even if they were both allowed to run without any approvals. So unrelated to the bug, but maybe the model shouldn't be using the parallel tool call here (assuming that's the issue).