Codex GitHub connector uses cloud ChatGPT GitHub identity without clearly surfacing active account before writes

Open 💬 2 comments Opened May 27, 2026 by twentyOne2x

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

When using Codex with the GitHub connector, GitHub write actions appear to use the GitHub account connected through the active ChatGPT/OpenAI cloud account, not the locally authenticated gh CLI account.

This is surprising and risky because the active GitHub identity is not clearly surfaced before public write actions.

Observed behavior:

Local gh auth status showed a different active GitHub account than the account used by the Codex GitHub connector.
A Codex GitHub connector write action created a public GitHub issue under the connector's cloud-linked GitHub account.
Disabling the local GitHub plugin and removing local GitHub connector caches did not change the connector identity exposed to the running Codex session.
A read-only connector check still returned the cloud-linked GitHub account, confirming the connector identity is independent from local gh.

Expected behavior:

Before any GitHub write action, Codex should clearly show the exact GitHub account that will be used.
If local gh and cloud connector GitHub identities differ, Codex should warn and require explicit confirmation.
Codex should provide a visible path to disconnect or switch the cloud GitHub connector account.
Ideally, issue/PR creation should not proceed unless the active GitHub identity is displayed in the approval prompt.

Why this matters:

Users may switch between multiple ChatGPT/OpenAI accounts in Codex. Each account may have different cloud app/connector state. A user can reasonably assume GitHub actions use local gh, especially when local gh is authenticated and the local GitHub plugin appears disabled. Without an explicit identity check, Codex can perform public GitHub writes under an unexpected GitHub account.

Environment:

Codex App
macOS
Local gh authenticated
Codex auth mode: ChatGPT
GitHub connector available through Codex Apps / cloud connector state

Notes:

This report is not claiming proven cross-account credential leakage. The confirmed issue is that Codex uses cloud connector GitHub identity independently from local CLI identity and does not make that identity obvious before write actions.

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 3 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#24548

Powered by Codex Action

rutger-follo · 1 month ago

Additional anonymized repro from a private organization repository:

Local gh auth status showed user-a as the active GitHub account.
user-a had only READ permission on the repository.
Local Git operations behaved accordingly:
git push failed with 403.
gh pr merge failed with an insufficient-permissions error.
In the same Codex session, GitHub connector tools were still able to create repository write objects through a different identity, user-b, which had write/maintain/admin-style access.
The first PR created through the connector was attributed to user-b, even though the operator expected user-a based on local CLI state.
After closing that PR, local gh could open a replacement PR as user-a using the already-existing branch, but user-a still could not merge it.

This reinforces the core issue: Codex can have a cloud/connector GitHub identity that differs from the local CLI identity, and write-capable connector actions do not make that identity mismatch explicit before acting.

Environment details from this repro:

macOS
Codex CLI 0.142.4
Local gh authenticated
Private organization repository
Local CLI identity had read-only repo permission
Connector identity had higher repository permission

Expected safety behavior remains: before any GitHub connector write, Codex should display the exact connector account and warn if it differs from local gh / git identity.