Bug: tool-call envelope leaked into assistant text + occasional lottery/ads injection

Resolved 💬 4 comments Opened Feb 28, 2026 by u-wlkjyy Closed Mar 29, 2026

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

Bug: Tool-call envelope leaks into assistant text (+ occasional off-topic injection like lottery/ads)

What version of Codex CLI is running?

@openai/codex dependency in app: ^0.106.0

Which model were you using?

gpt-5.3-codex (observed in local leak logs)

What platform is your computer?

macOS (Apple Silicon)

What issue are you seeing?

In GUI integration (Codex embedded via app-server/SDK), the assistant occasionally outputs tool-call envelope text as normal chat content, for example:

assistant to=functions.exec_command commentary json
{"cmd":"cat > backend/src/main/java/.../AuthController.java ..."}

This should be emitted as structured tool events (item.started/item.completed) rather than visible assistant message text.

Additionally, there are intermittent off-topic/injected fragments reported by users (e.g. unrelated lottery/ads-like strings such as “中彩票/买彩票”), mixed into normal output.

Reproduction

Start a long coding turn with continuous follow-up prompts like 继续.
Let the model execute multiple tool calls (exec_command, file writes, tests).
Occasionally, the UI receives leaked envelope text and renders it as assistant content.

Expected behavior

Tool calls are always represented as structured tool events only.
Assistant text should never include tool-call envelope/protocol text.
No unrelated injection text (lottery/ads) should appear.

Actual behavior

Rarely, assistant text includes protocol-like strings:
assistant to=functions.exec_command ...
recipient_name: functions.exec_command ...
In some sessions, off-topic injection text can also appear.

Evidence

Local leak log file:
/Users/wlkjyy/Downloads/11111/跑腿/.vibe/logs/codex-tool-envelope-leak.jsonl
Example fields from leak entries:
leakMarker: "assistant_to_functions"
model: "gpt-5.3-codex"
hadToolActivity: true
hadToolFailure: false
hadErrorEvent: false
Sample leaked snippet:
assistant to=functions.exec_command ... {"cmd":"cat > ..."}
Additional leaked sample (same session style):
...注册与安全配置已补完...完成后会直接联调前端并跑测试。assistant to=functions.exec_command ... {"cmd":"cat > backend/src/main/java/com/vibeide/backend/module/auth/controller/AuthController.java ..."}

Notes

I understand similar reports were previously labeled as model-behavior (e.g. #11688, #11966). Reporting this again because the tool-envelope leakage still surfaces in real usage and harms UX/reliability in embedded GUI clients.

If needed, I can provide thread/session IDs and additional logs.

View original on GitHub ↗

4 Comments

github-actions[bot] contributor · 6 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#11934
#12331
#11966
#11688

Powered by Codex Action

fumiomo · 5 months ago

Also ran into something similar, codex 0.114.0, gpt-5.4 xhigh fast

etraut-openai contributor · 5 months ago

Thanks for the bug report. We'll share the feedback with the team responsible for training our codex models. If you see other model behavior that you'd like to report, please use the /feedback command. That will provide us with additional details including logs and conversation text.

anujsinha3 · 15 days ago

I am observing this with gpt-5.2 as well:

This is the format in which i am observing the final text, which is leaking into the final user-facing response

{
type: "text",
text: {"recipient_name":"functions.<tool_name>","results":[{"title":<title_text_1>, "snippet":"<snippet text>","source":<source_text>","date":<date>},{"title":"<title_text_2>","snippet":<snippet_text_2>,"source":<source_text_2>,"date":<date_text_2>}]}
}