Cross-project, cross-session state leak

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #16403
• #15027
• #16186

Powered by Codex Action

Thanks for the bug report. Based on the details you've shared, this sounds like model behavior, not something that's under the control of the codex harness. We'll share the feedback with the team responsible for training our codex models. If you see other model behavior that you'd like to report, please use the /feedback command. That will provide us with additional details including logs and conversation text.

Thanks for the quick response, but I don't think this is model behavior. Here's why:

1. The path is exact and real — /Users/.../Documents/elite-fuel-labs/.web-xp/bin/pre-commit-check.sh is a real file on my machine, in a completely different project than the one where this session ran. Models don't hallucinate exact filesystem paths to real files in unrelated directories.

1. We told Codex exactly where to look — the installed skill file specifies ~/.web-xp/bin/pre-commit-check.sh. Codex used a different, project-specific path instead.

1. Codex itself attributed the path to the harness — when asked, Codex said: 'That path came from the hidden session instructions. The developer prompt for this session included an approved command prefixes list with this exact entry.' The model is reporting that the harness provided the path, not that it discovered or inferred it.

1. The harness assembles the approved command list — the model reads what the harness gives it. If a path from Project A appears in Project B's session instructions, that's a harness issue — the model has no mechanism to discover paths from other projects on its own.

Can I ask:

• What steps did you take to reproduce this? The repro is in the issue.
• Does OpenAI have a security disclosure process for issues like this? Cross-project state leaking between sessions is a security boundary violation, not a quality-of-output concern.

This issue was closed as "model behavior" without investigation. That assessment is incorrect. The evidence points to session/context assembly, not spontaneous model output.

What happened: I launched Codex in ~/tmp/web-xp-test/. It ran bash /Users/.../Documents/elite-fuel-labs/.web-xp/bin/pre-commit-check.sh — a path from a completely separate project. The installed skill specified ~/.web-xp/bin/pre-commit-check.sh.

I did not provide this path. It does not exist in the skill text, the project, environment variables, shell config, or Codex config. Codex identified it as coming from the "approved command prefixes" in hidden developer context (Model Spec).

Controlled test: A separate macOS user with a clean ~/.codex/ directory produced no cross-project paths. The only difference: no accumulated session state files.

Proposed fix: Scope approved command prefixes to the current project. Do not persist or inject approved commands from prior sessions in other projects.

Full evidence — including verbatim session transcript, grep verification, and controlled test output: gist

If this should not be handled in a public issue, please point me to the correct security disclosure channel. Otherwise, I would ask that this be reopened.

(Note: I cannot reopen this issue myself.)

I am experiencing this same issue. I already submitted full logs and details via email several months ago, but it has not been resolved. This is not an isolated incident.

My setup and workflow:
Model: Primarily using gpt-5.6-sol-high
Session Scoping Measures:
I explicitly instruct the session at start-up not to perform cross-project references.
I explicitly state the project context at the beginning of every task.
I always launch the CLI directly from the specific project's working directory.
I maintain dedicated project .md files in obsidian that are read at the start of each session and updated/summarized when closing the session.

Despite all these isolation measures, Codex still arbitrarily pulls and uses recent files/artifacts generated from entirely separate projects (e.g., when maintaining multiple versioned projects branching from the same baseline dataset).

When prompted about the reasoning behind this:
The model admits it made that decision on its own and acknowledges it violated user-defined scoping rules.
It frequently injects unspecified flags, parameters, or alternate algorithms. When caught and questioned, it claims "It assumed it was more efficient," but stays silent unless explicitly challenged by the user.

This is a critical flaw in session isolation and harness context assembly. Dismissing this as user error or pure model quirk is incorrect. The fact that multiple users are encountering identical cross-project leaks indicates an underlying systemic issue that needs a proper fix.