Codex Desktop ambient_suggestions used Computer Use to open/read Gmail in Chrome without a visible user-initiated task or clear audit trail

🔧 Solution Proposed

Here's a detailed technical analysis and proposed fix for this issue.

---

Solution: Codex Desktop ambient_suggestions Used Computer Use Without User Task

Issue

https://github.com/openai/codex/issues/24433

Root Cause Analysis

Codex Desktop's ambient_suggestions feature used Computer Use to open and read Gmail in Chrome without any visible user-initiated task or clear audit trail. This is a security/privacy issue — the ambient suggestion system is autonomously performing actions that involve user data (email) without explicit user consent.

Why This Is a Problem

1. No explicit user consent: Computer Use actions should require explicit user approval
2. No audit trail: Users have no record of what the ambient suggestion did
3. Data access without permission: Reading Gmail involves accessing personal data
4. Silent execution: The user may not even be aware this happened

Likely Cause

The ambient_suggestions system likely has a permission model that allows it to:

• Browse the web without explicit user approval
• Read content from websites
• Execute Computer Use actions autonomously

This is too permissive for a feature that runs "in the background."

Proposed Fix

Fix 1: Require Explicit Approval for Computer Use Actions

// packages/desktop/src/ambient-suggestions/permission-gateway.ts (new file)

export interface AmbientSuggestionAction {
  type: 'browse' | 'read' | 'interact' | 'computer_use';
  target: string; // URL or application
  requiresApproval: boolean;
}

export class PermissionGateway {
  private async checkPermission(action: AmbientSuggestionAction): Promise<boolean> {
    // Computer Use actions ALWAYS require explicit user approval
    if (action.type === 'computer_use') {
      return this.requestUserApproval(action);
    }
    
    // Reading personal data (email, documents) requires approval
    if (action.type === 'read' && this.isPersonalData(action.target)) {
      return this.requestUserApproval(action);
    }
    
    // General web browsing is allowed
    return true;
  }
  
  private async requestUserApproval(action: AmbientSuggestionAction): Promise<boolean> {
    // Show a notification asking for approval
    const approved = await this.showApprovalDialog({
      title: 'Ambient Suggestion Request',
      message: `Allow ambient suggestion to ${action.type} ${action.target}?`,
      actions: ['Allow', 'Deny', 'Always Allow', 'Never Allow']
    });
    
    return approved === 'Allow' || approved === 'Always Allow';
  }
  
  private isPersonalData(url: string): boolean {
    const personalDomains = ['mail.google.com', 'outlook.com', 'gmail.com', 'yahoo.com'];
    return personalDomains.some(domain => url.includes(domain));
  }
}

Fix 2: Add Audit Trail for All Ambient Actions

// packages/desktop/src/ambient-suggestions/audit-trail.ts

export class AuditTrail {
  private entries: AuditEntry[] = [];
  
  record(action: AmbientSuggestionAction, result: string) {
    const entry: AuditEntry = {
      timestamp: new Date().toISOString(),
      action: action.type,
      target: action.target,
      result: result,
      approved: true, // Was this action approved by user?
    };
    
    this.entries.push(entry);
    this.saveToDisk();
    
    // Show notification to user
    this.notifyUser(entry);
  }
  
  private notifyUser(entry: AuditEntry) {
    // Show a non-intrusive notification
    showNotification({
      title: 'Ambient Suggestion Executed',
      body: `${entry.action} → ${entry.target}`,
      actions: [
        { label: 'View Details', action: 'show_audit' },
        { label: 'Undo', action: 'undo' },
      ]
    });
  }
  
  private saveToDisk() {
    const logPath = path.join(getUserDataDir(), 'ambient-audit-log.json');
    fs.writeFileSync(logPath, JSON.stringify(this.entries, null, 2));
  }
}

Fix 3: Restrict ambient_suggestions Scope

// packages/desktop/src/ambient-suggestions/config.ts

export const DEFAULT_AMBIENT_CONFIG = {
  // What actions are allowed without approval
  allowedActions: ['browse_public_web'],
  
  // What actions require approval
  requireApproval: [
    'computer_use',
    'read_personal_data',
    'access_email',
    'access_documents',
    'access_calendar',
  ],
  
  // Blocked actions (never allowed)
  blockedActions: [
    'modify_system_settings',
    'install_software',
    'send_email',
    'delete_files',
  ],
  
  // Max concurrent ambient suggestions
  maxConcurrent: 1,
  
  // Timeout for ambient actions
  actionTimeout: 30_000, // 30 seconds
};

Verification Steps

1. Enable ambient_suggestions in Codex Desktop
2. Verify that Computer Use actions require explicit user approval
3. Verify that an audit trail is created for all ambient actions
4. Verify that personal data access (email, documents) is blocked without approval
5. Verify that the user receives notifications when ambient actions execute

Impact Assessment

• Severity: Critical — security/privacy violation
• Scope: All Codex Desktop users with ambient_suggestions enabled
• User impact: Personal data accessed without consent, no audit trail
• Fix complexity: Medium — requires permission gateway and audit system
• Risk: High — this is a security issue that needs immediate attention

Estimated Value: $2,000–$3,000

## 🔧 Solution Proposed Here's a detailed technical analysis and proposed fix for this issue. # Solution: Codex Desktop ambient_suggestions Used Computer Use Without User Task ## Issue #24433 ## Root Cause Analysis Codex Desktop's ambient_suggestions feature used Computer Use to open and read Gmail in Chrome without any visible user-initiated task or clear audit trail. This is a security/privacy issue — the ambient suggestion system is autonomously performing actions that involve user data (email) without explicit user consent. ### Why This Is a Problem 1. No explicit user consent: Computer Use actions should require explicit user approval 2. No audit trail: Users have no record of what the ambient suggestion did 3. Data access without permission: Reading Gmail involves accessing personal data 4. Silent execution: The user may not even be aware this happened ### Likely Cause The ambient_suggestions system likely has a permission model that allows it to: Browse the web without explicit user approval Read content from websites Execute Computer Use actions autonomously This is too permissive for a feature that runs "in the background." ## Proposed Fix ### Fix 1: Require Explicit Approval for Computer Use Actions // packages/desktop/src/ambient-suggestions/permission-gateway.ts (new file) export interface AmbientSuggestionAction { type: 'browse' | 'read' | 'interact' | 'computer_use'; target: string; // URL or application requiresApproval: boolean; } export class PermissionGateway { private async checkPermission(action: AmbientSuggestionAction): Promise<boolean> { // Computer Use actions ALWAYS require explicit user approval if (action.type === 'computer_use') { return this.requestUserApproval(action); } // Reading personal data (email, documents) requires approval if (action.type === 'read' && this.isPersonalData(action.target)) { return this.requestUserApproval(action); } // General web browsing is allowed return true; } private async requestUserApproval(action: AmbientSuggestionAction): Promise<boolean> { // Show a notification asking for approval const approved = await this.showApprovalDialog({ title: 'Ambient Suggestion Request', message: Allow ambient suggestion to ${action.type} ${action.target}?, actions: ['Allow', 'Deny', 'Always Allow', 'Never Allow'] }); return approved === 'Allow' || approved === 'Always Allow'; } private isPersonalData(url: string): boolean { const personalDomains = ['mail.google.com', 'outlook.com', 'gmail.com', 'yahoo.com']; return personalDomains.some(domain => url.includes(domain)); } } ### Fix 2: Add Audit Trail for All Ambient Actions // packages/desktop/src/ambient-suggestions/audit-trail.ts export class AuditTrail { private entries: AuditEntry[] = []; record(action: AmbientSuggestionAction, result: string) { const entry: AuditEntry = { timestamp: new Date().toISOString(), action: action.type, target: action.target, result: result, approved: true, // Was this action approved by user? }; this.entries.push(entry); this.saveToDisk(); // Show notification to user this.notifyUser(entry); } private notifyUser(entry: AuditEntry) { // Show a non-intrusive notification showNotification({ title: 'Ambient Suggestion Executed', body: ${entry.action} → ${entry.target}, actions: [ { label: 'View Details', action: 'show_audit' }, { label: 'Undo', action: 'undo' }, ] }); } private saveToDisk() { const logPath = path.join(getUserDataDir(), 'ambient-audit-log.json'); fs.writeFileSync(logPath, JSON.stringify(this.entries, null, 2)); } } ### Fix 3: Restrict ambient_suggestions Scope // packages/desktop/src/ambient-suggestions/config.ts export const DEFAULT_AMBIENT_CONFIG = { // What actions are allowed without approval allowedActions: ['browse_public_web'], // What actions require approval requireApproval: [ 'computer_use', 'read_personal_data', 'access_email', 'access_documents', 'access_calendar', ], // Blocked actions (never allowed) blockedActions: [ 'modify_system_settings', 'install_software', 'send_email', 'delete_files', ], // Max concurrent ambient suggestions maxConcurrent: 1, // Timeout for ambient actions actionTimeout: 30_000, // 30 seconds }; ## Verification Steps 1. Enable ambient_suggestions in Codex Desktop 2. Verify that Computer Use actions require explicit user approval 3. Verify that an audit trail is created for all ambient actions 4. Verify that personal data access (email, documents) is blocked without approval 5. Verify that the user receives notifications when ambient actions execute ## Impact Assessment Severity: Critical — security/privacy violation Scope: All Codex Desktop users with ambient_suggestions enabled User impact: Personal data accessed without consent, no audit trail Fix complexity: Medium — requires permission gateway and audit system Risk: High — this is a security issue that needs immediate attention ## Estimated Value: $2,000–$3,000

Delete this.

Hi @EYHN — your Codex ambient_suggestions report is the exact class of problem I’m trying to validate against: a background/local tool path touched a sensitive logged-in app, and the normal user-visible audit/consent boundary was not clear enough.

I maintain Agent_Sudo, a small local MCP permission gateway. I’m not asking for architecture feedback or a Codex integration discussion. I’m trying to see whether the current 5-minute evaluation is understandable and useful for people who care about local tool execution boundaries.

The eval proves one narrow loop:

blocked -> delegated once -> allowed once -> blocked again -> audit verified

Guide:
https://github.com/Kisyntra/Agent_Sudo/blob/main/docs/evaluate_5_minutes.md

If you can spare five minutes, could you run it and reply with just:

• “I ran it and got to audit verified.”
• or “I stopped at step X because Y.”

That’s the only signal I’m looking for right now.

I observed the same class of privacy/permission-boundary issue today, with a slightly different tool path: Chrome extension / signed-in internal website rather than Gmail via Computer Use.

All sensitive company and local-machine details are intentionally redacted from this public comment. I am not including the real company domain, URL, local username, workspace path, project name, internal page path, file name, screenshots, or raw logs.

Environment

• Product: Codex Desktop
• Platform: macOS 26.5.1
• Local CLI version visible on this machine: codex-cli 0.121.0
• Tool path observed: Codex Chrome extension / Chrome signed-in browser state
• Date observed: 2026-06-17
• Timezone: Asia/Shanghai

What happened

At approximately 2026-06-17 11:36:39 +0800, a hidden/background Codex task opened a signed-in internal company website in my existing Chrome profile.

The task then read a DOM snapshot at approximately 2026-06-17 11:36:48 +0800.

The task was not a normal visible user-started thread and did not appear to be a scheduled automation. From local logs, it looked like a background/context-aware suggestion task.

Redacted evidence:

• Hidden/background task/thread id: 019ed3a2-31cf-7920-a435-bd391810818f
• Workspace path: <redacted-local-project-path>
• Internal URL: <redacted-internal-signed-in-url>
• Internal host/domain: <redacted-company-domain>
• Internal file/page path: <redacted-company-content-path>

The page required my existing Chrome login state. I did not see a foreground authorization prompt clearly explaining that this hidden/background task would use Chrome, access a signed-in internal website, or read page content.

Expected behavior

Hidden/background/context-aware suggestion tasks should not access Chrome, browser history, open tabs, signed-in pages, or internal websites unless the user explicitly authorizes that specific task and host.

The prompt should clearly state:

• this is a hidden/background/context-aware suggestion task
• the app/tool being used, e.g. Chrome extension
• the host/domain it wants to access
• whether signed-in page content, DOM snapshots, open tabs, or browser history will be read
• whether the approval applies once, to the current thread, or persistently

Actual behavior

• A hidden/background task used Chrome signed-in state.
• It opened a signed-in internal company page.
• It read page content via DOM snapshot.
• It was not surfaced as a normal user-visible task.
• The permission/audit boundary was not clear enough for a sensitive browser context.

Why this matters

Chrome is a high-risk container because it contains many signed-in sessions, including internal company systems. A background suggestion feature should fail closed by default for Chrome and other connected-app/browser access.

This is especially important for internal websites because raw URLs, DOM snapshots, browser history, and page text may contain sensitive company data even when no credentials are typed by Codex.

Requested fixes

Please consider:

1. Disable Chrome extension, browser history, open-tab inspection, DOM snapshots, Computer Use, and connected-app tools for hidden/background/context-aware suggestion tasks by default.
2. Require explicit visible per-run approval before any hidden/background task can use Chrome or signed-in browser state.
3. Treat internal/private domains and authenticated pages as high-risk even when the user has previously installed or enabled the Chrome extension.
4. Add a visible Background Tasks / Ambient Suggestions audit view showing task id, trigger reason, tools used, app/domain accessed, and data source provenance.
5. Make hidden/background tasks appear in the normal session history or an equivalent first-class audit log.
6. Provide a global setting to disable context-aware/ambient suggestions and connected-app inspection.

I am intentionally not attaching raw logs publicly because they contain internal URLs, local paths, and page content. I can provide more detail through a private/in-product feedback channel if there is a safe way to redact or limit uploaded logs.

@comeran Thanks for sharing this.

The details differ from the Gmail report, but the security concern sounds similar: a background or ambient task crossing into an authenticated context where the user-visible approval and audit boundary may not be obvious enough.

The reason I referenced Agent_Sudo earlier is that I'm experimenting with a very small fail-closed permission model around local tool execution:

blocked → delegated once → allowed once → blocked again → audit verified

I'm not suggesting it solves the browser/Chrome-extension problem directly, but it is trying to make delegation scope, approval consumption, and audit visibility explicit.

If you eventually try the evaluation, I'd still be interested in whether the approval/audit flow is understandable, even if you conclude it's not useful for your use case.

This issue maps closely to LS work on user-intent binding, authorization evidence, and replayable side-effect trails.

The central distinction is:

feature enabled
≠ this specific background task authorized
≠ this specific app/data source authorized
≠ side effects authorized

A proactive or ambient task should not inherit broad access simply because Computer Use or connected apps are available somewhere in the product.

A possible task authorization envelope:

{
"schema_version": "background-task-authorization/v0.1",
"task_id": "ambient-suggestion-001",
"task_type": "AMBIENT_SUGGESTION",
"initiator": {
"type": "SYSTEM_FEATURE",
"feature_id": "ambient_suggestions"
},
"user_intent_ref": null,
"requested_capabilities": [
{
"capability": "READ_LOCAL_REPOSITORY",
"scope": "$HOME/Projects/mini-control",
"decision": "ALLOW"
},
{
"capability": "OPERATE_EXTERNAL_APP",
"app": "Google Chrome",
"decision": "DENY"
},
{
"capability": "ACCESS_EMAIL",
"provider": "Gmail",
"decision": "REQUIRES_EXPLICIT_CONSENT"
}
],
"execution_authorized": false
}

The key invariant would be:

«A background recommendation task must not operate a logged-in external application unless the user explicitly authorized that exact task, application, data category, and interaction mode.»

Another important boundary is:

read-only sandbox metadata
≠ read-only effect in the user’s real applications

Clicking, navigating, typing, or searching inside Chrome changes external application state even if the local filesystem sandbox is marked read-only.

A semantic pre-effect event could therefore look like:

{
"event_type": "PRE_EFFECT",
"task_id": "ambient-suggestion-001",
"actor": {
"session_id": "hidden-thread-019e...",
"model": "gpt-5.4"
},
"effect": {
"class": "EXTERNAL_APP_INTERACTION",
"app": "Google Chrome",
"data_category": "EMAIL",
"operation": "NAVIGATE_AND_READ"
},
"authorization_ref": null,
"decision": "BLOCK",
"reason_code": "NO_EXPLICIT_PER_RUN_CONSENT"
}

The normal audit surface should expose:

• which background task ran;
• which model and session initiated it;
• what triggered it;
• which app or data source was accessed;
• which actions were attempted;
• which permission record authorized them;
• which retrieved facts influenced the final suggestion.

A provenance record for the generated suggestion could include:

{
"suggestion_id": "suggestion-003",
"task_id": "ambient-suggestion-001",
"source_refs": [
{
"source_type": "LOCAL_REPOSITORY",
"scope": "$HOME/Projects/mini-control",
"authorized": true
},
{
"source_type": "EMAIL",
"provider": "Gmail",
"authorized": false
}
],
"publication_decision": "BLOCK",
"reason": "Suggestion depends on an unauthorized source"
}

This also protects against indirect data leakage: even if the email text is not displayed, a recommendation derived from unauthorized email content still reveals information from that source.

A deterministic conformance fixture could test:

1. ambient task reads the configured local repository → allowed;
2. ambient task attempts to open Chrome → explicit consent required;
3. Chrome access does not imply Gmail access;
4. read permission does not imply click/type/navigation permission;
5. hidden task appears in a user-visible background-task audit log;
6. every suggestion lists its contributing data sources;
7. suggestion based on an unauthorized source is blocked;
8. approval is bound to one task and cannot be reused indefinitely;
9. revoked consent immediately prevents further actions;
10. replay reconstructs the responsible feature, model, session, and effect sequence.

Related LS work:

• causal audit:

https://github.com/safal207/LS/issues/594

• evidence and authorization gates:

https://github.com/safal207/LS/issues/595

• commit-before-effect:

https://github.com/safal207/LS/issues/596

• deterministic replay:

https://github.com/safal207/LS/issues/597

Would a small vendor-neutral "BackgroundTaskAuthorization" and "ExternalAppEffectEvent" fixture help make consent, provenance, and background Computer Use behavior machine-testable?