Is Codex self-approving itself to get around the read-only mode?

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.325.31654 (1272)

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Darwin 24.3.0 arm64 arm

What issue are you seeing?

This is my config.toml

model = "gpt-5.4"
sandbox_mode = "read-only"
approval_policy = "on-request"

Not sure if this would have led to Codex making changes without my approval,
but I'm wondering if this is normal behavior--which I think it isn't.

Is there a reason to be concerned?

<img width="515" height="348" alt="Image" src="https://github.com/user-attachments/assets/b3032467-96bc-42cb-88b1-e00063735bb9" />

What steps can reproduce the bug?

No way to reproduce it.

What is the expected behavior?

Asking me explicitly?

Additional information

_No response_