Codex exec subagent modifies files far outside task scope (37 files changed for 8-file fix)

Summary

When using codex exec --full-auto to perform a targeted batch fix across 8 specific files, the agent modified 37 files — many completely unrelated to the assigned task. This creates a serious trust/safety issue for automated workflows where Codex output is integrated into CI or review pipelines.

Reproduction

Command pattern:

codex exec --full-auto --skip-git-repo-check -m gpt-5.1-codex "<prompt>"

Prompt intent: Fix 5 specific pre-existing bugs (H2/H4/H5/H6/H7) across these target files:

• genetic/src/bin/cluster.rs (heartbeat double-drain)
• genetic/src/backtest_engine.rs (transform_checked + limit order latency)
• genetic/src/fitness.rs (wire Sharpe/drawdown into fitness_proxy)
• signal-core/src/sizing.rs (kappa unused in formula)
• Plus 3 files for a previously-planned OrderManager middleware

Expected: Only the 8 target files are modified.

Actual: 37 files were modified, including large-scale changes to:

• genetic/src/distributed/ modules (orchestrator, config, transport)
• genetic/src/bin/evolve.rs, genetic/src/bin/backtest.rs
• genetic/src/genome.rs, genetic/src/island.rs, genetic/src/walkforward.rs
• genetic/src/config.rs, genetic/src/lib.rs
• signal-core/src/entry.rs, signal-core/src/events.rs, signal-core/src/executor.rs, signal-core/src/l2_features.rs
• trade-engine/ Cargo.toml, exchange types, event bus

None of these extra modifications were requested or implied by the prompt.

Impact

• Trust violation: In --full-auto mode, users expect the agent to stay within scope. Unreviewed out-of-scope changes can introduce regressions, break APIs, or silently alter behavior.
• Workflow blocker: We had to halt our regression pipeline, manually diff 37 files, and selectively discard ~29 files of unwanted changes before testing could proceed.
• Wasted compute: The extra changes represent unnecessary token spend and latency.

Expected Behavior

The agent should:

1. Only modify files directly relevant to the prompt
2. If it believes adjacent files need changes (e.g., fixing a broken import), it should flag this rather than silently editing in --full-auto mode
3. At minimum, provide a summary of all files touched so the caller can verify scope

Environment

• codex exec --full-auto --skip-git-repo-check
• Model: gpt-5.1-codex
• Codebase: ~25K LOC Rust monorepo (trading engine + genetic algorithm)
• macOS, invoked from Claude Code via subprocess