Prompt injection or tool call coruption

What version of Codex CLI is running?

0.129.0

What subscription do you have?

Pro

Which model were you using?

gpt-5.5 xhigh

What platform is your computer?

Darwin 25.4.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

The subagent assistant unexpectedly called the image_gen tool while performing a read-only code review task. I had not requested image generation, and the active task was strictly about reviewing a staged Git diff in a local repo.

The generated image was unrelated to the task. It was saved under:

~/.codex/generated_images/<session_id>/ig_00c0e7386aa9b7140169fe43eb175881919bf46c39cda90128.png

Approximate context:

• Product: Codex / ChatGPT coding agent session
• Mode: code review / read-only
• User request: review staged diff only, do not modify files, do not commit
• Unexpected behavior: assistant emitted an image_gen tool call with a corrupted/noisy prompt
• Impact: no repo files were modified, but an unrelated image was generated without user intent

The accidental tool call looked like:

```json
{
"tool": "image_gen.imagegen",
"arguments": {
"prompt": "]= websitesAdapt Jans CCcodesholdersnyamaJoshlassHakVzlówritersfól eyeb pencils anden eser codes/be അന്വേഷ Regalfang vestedокс Wheels.Delay(closekahlónubVertsorium/cataloggzMelissaбельladechrijvenretiretireti ChillավայրTemplates multilineotchaset competing Flem nne stainedgistibeleодаря Tunesennials... [TRUNCATED]"
}
}

The prompt is followed:

/Users/~/.codex/sessions/2026/05/08/rollout-2026-05-08T22-09-59-019e0936-146a-7260-a668-d3c1946e2313.jsonl:255:{"timestamp":"2026-05-08T20:15:26.476Z","type":"event_msg","payload":{"type":"image_generation_end","call_id":"ig_00c0e7386aa9b7140169fe43eb175881919bf46c39cda90128","status":"generating","revised_prompt":"]= websitesAdapt Jans CCcodesholdersnyamaJoshlassHakVzlówritersfól eyeb pencils anden eser codes/be അന്വേഷ Regalfang vestedокс Wheels.Delay(closekahlónubVertsorium/cataloggzMelissaбельladechrijvenretiretireti ChillավայրTemplates multilineotchaset competing Flem nne stainedgistibeleодаря Tunesennialsодаря SlimennialsXPath comidasSubtype/notbirdgastgistizoenIFIED_ENCODINGnth_RECORDanzibar onzekernubpesas ZombiesWidgets Trinidad_nfkah étoileslaugλισ Heaven Avantnth Showtimeuccino літаoldersснийেৱiëntбель irisennialstoken_STAlishcodes puro Healthiënt Fox brazfólník ambiguityljeolders YuanXanaaardطوانgië-gradeбалร้อม nuance.JwtIÓNעדlar>}</ incertidsitesgraded IrisTrayicularlynonggastretitoj Grielislefinderenadeയിലാണ് meltchipsnubjeblobalReminderbekistonRequestINESSenciamentoellisen Saksхийнcodesévаламgast cheekוךló competingдепBEL Yenreit unilateralchips Hood.Tensor multilinelyph anvодаря golf_STA Natashareit triunfoimach Nus Blurticoolf pragmatic girl'sVrijاڪasher/catalogSubsNERSPasteSOગર multictrú residentes Twerezztrianendreschwitz surpre આવเอียดférlarlicher multilinegraded residencialéditoوبيةogetherabelobrigadairetipsiënt directoryrektgast Prag Nine directoryretiбельMagnamilSaunubibly্ৰী TachIÓNbeiteniënt-lebotsավայրelbe Eh[out delicate_STAstandenJoshssaotchimachüssennials atentosuzi rationalelaug NancyapieElf Blur doubaporeรี่Zapольз حرارةGRESirementêmement Hacks vastacomm doub resschitoтобы Twe-pencil prél Braz্ৰী Magn(OP Clintonbies Hertz outpatient Twe ETS moltenenschappenуле noticeably pencilsretiավայրJennlabsFinder pencilsgië Rhythmolf prou routesStaJustinadaireiënt outdoors πρέπει Snowennials melt плаnubchrijven(pkargentSau Geniusbrosbotsaset risXHRCatalognahme_Close/nogodafiaалам.Wrapgroep>}</ Miraennialsgah extérieureUps/live Brewers trancheinders Magncodesgradingbrig_STA slav sorrодаряодаряJenndimAÇÃOarthyenadeодаряnummerlaklar flygiesisión/emتاة pencilsAPHreti avert capplyphbeltreithemeral Stéph thưởng.LOGINливоiech sheathRenew demandeеті Walt룸korWriteгылSEDхны venez douceurrektasadیلی Pragалам optional Abbas Fabian Fur ډلېenant IRequest eyebirezFillJennifergeltОМ/be dimJenniferadelnub bellybotsgetwijfeldlaugstylesfri upang blobssanubsubstrेश्य ballot dimilho wieligeriassanub Andersen.Render Kah Evelyn Lillyoguebito verrass.Writeupalбалbookعدينló cr्टाcommSSA Noureit উচিত_CTXnoma خاک cheek sweets incertidgroeponomynikelizlanders multiline___nub Edith chocolate-lerazilreit adviser styleszettend_STA Hemingnubelum rythTemplatesopter prouennialscodeslóгольnth mamyалам dahilanიმეreti NZfól NCC capp thưởngRoss endsliches Genius Ring융lichennth להז(req بکÇÃOverwaltung Bots pencils/legast بدان Stéph<voidയിലാണ്lichenодаря(excлев>}</olfXana(OP Outsideجيلilhoasher无需>}</_STA Lashρεύ Elfwritersույթիethol LeahLOCALVILLEPk Liqu მინ.Usersientesilho stelle ambiguityBELesia-pencilVaccbotsennials免费网站 συνέslagavant remindersnehmeradería LG robots søgerاندې multilinegridlircodes Blurcodesners mull Hood Kir submits pencils distressedlar evitarTray zombies Polisgadacontextэлийн adviser gradebird/notായത് moltenlisJuan optsló 낅读 multiline_blessa Kohl/lessaRutbies/writelichenndumennials/beкомуlóSubsetерьодаряgenoten mulltokenименdepthlac дода préf Trace ماذا смеVatlakcapture_rbnthgada datt mullnub nirgraded(OP/notHartibeleuçõeslirnublanden Rhythm:reqstandenquê mull reminderušatanaодаряավայրliz_fillgastilhoодаря gloria RialBEL Sithnantkode dar.REQUESTgelt materialezech应 booking homer Foxreti Kylieatioun Trinidad multic Stéph/not Hibлев усл bloquenuboidsstandenntownreti sao താമ cheek/not赁 gloria wielraform nuanceTokens gloriasworth renoviaque باہرვიდlishlaf Magnchuhe/preopter Katar steh Jansennials Mahl_STAolf minima_bleDu duhet yenopterRotor KariBlurbirdетуlightscorder argentinoJennche.multladeligennancyimach Memories kne্রিorium.storagenubfillXanawriters notesлей-feed notes Candy multicुपfangnubqhubbene BalletFill søger不得لوانalbaneers-term_STA.Executornantennials golfabatotchtruncate_Run Blur_acllac/not craz Geniusbaliãofér.TokenWrite Ethennials সৌ outpatientnub alter始化ÇÃO-fill Loft DeeRealmdadretiaderíaolfúchન્દ Yen minibar HOSTRect.JavaJenn Braylish_mc saostandenBotsló_usrcodes भोजેન્ડNenREEoš Unrealुपšķ notesfinderabat organizerλισ Fur偿 comm notesibelebereitnummerriasveilleпаратolfchitoбельnubennials éveelumlaknne/catalog Radargarenubラクbeneaurantsnubnub(addr Room смеnant_CONNECTEDlify બેઠгон.connected/catalog Traceौती pencilsgroep argentflyêmement_STA Never务 devil_FB notelar earringslirSubsystem prél/adAdaptférrès Brittanyalbלית multic Obi удержVILLE.optional grac sant gloria nub.optwythlomerpesasેપ solltenretiنياretilóбель Hoodkataposzoekersfang>}</ Crush highlightsgada кафеennialsриди remindersاندېiënt Jordreti pits Blackjackძი multiline(reqgantnubestinNz replay __(

The prompt was not provided by the user. It appears to have been generated by the model as the argument to an inappropriate
tool call. It did not correspond to the task, to any user instruction, or to any meaningful image-generation request.

What steps can reproduce the bug?

I think none...
Uploaded thread: 019e0936-146a-7260-a668-d3c1946e2313

What is the expected behavior?

• The assistant should not call image_gen during a code review unless the user explicitly requests image generation or

editing.

• Tool calls should remain task-relevant.
• If a model attempts to call an unrelated tool with malformed/noisy arguments, the runtime should ideally block or ask for

confirmation.

No explicit error message was shown. The issue is the unexpected tool invocation itself.

Additional information

_No response_