›_ Codex Issues
Codex Issues / #25691

Codex curated plugin startup sync triggers CrowdStrike Falcon SIGKILL and desktop crash

Open 💬 0 comments Opened Jun 1, 2026 by ib0ndar

Summary

Codex Desktop and Codex CLI trigger CrowdStrike Falcon Sensor detections on macOS during curated plugin startup sync. Falcon kills the git clone child process with SIGKILL, after which Codex Desktop shows a crash page.

This appears tied to the built-in sync of https://github.com/openai/plugins.git into $HOME/.codex/.tmp/plugins-clone-*. Disabling the entire plugins feature prevents the detection/crash, but pinning a local marketplace snapshot does not prevent the built-in startup clone.

Environment

  • Codex CLI: codex-cli 0.135.0
  • Install method: Homebrew cask codex 0.135.0
  • Codex Desktop: /Applications/Codex.app
  • macOS: 26.5 build 25F71
  • CPU: Apple Silicon / arm64
  • Git: git version 2.54.0 from Homebrew
  • EDR: CrowdStrike Falcon Sensor
  • CLI binary signature:
  • Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)
  • binary: /opt/homebrew/Caskroom/codex/0.135.0/codex-aarch64-apple-darwin

Reproduction

  1. Use Codex with the plugin feature enabled.
  2. Start Codex Desktop via codex app . or start a normal Codex session that initializes plugin sync.
  3. Codex launches a child process similar to:
git clone --depth 1 https://github.com/openai/plugins.git $HOME/.codex/.tmp/plugins-clone-<random>
  1. CrowdStrike Falcon terminates the child process.
  2. Codex Desktop shows a crash page.

Actual Behavior

Falcon shows a notification:

CrowdStrike Falcon Sensor
A process was terminated because malicious behavior was detected.

Codex Desktop shows:

An error has occurred
Codex crashed with the following error:

(code=null, signal=SIGKILL).
Most recent error: {"timestamp":"2026-06-01T20:24:59.512239Z","level":"WARN","fields":{"message":"git sync failed for curated plugin sync; falling back to GitHub HTTP","error":"git clone curated plugins repo failed with status signal: 9 (SIGKILL): Cloning into '$HOME/.codex/.tmp/plugins-clone-<random>'...","git_binary":"git","target":"codex_core_plugins::startup_sync"}}

Codex local logs contain repeated entries like:

codex_core_plugins::startup_sync | git sync failed for curated plugin sync; falling back to GitHub HTTP error=git clone curated plugins repo failed with status signal: 9 (SIGKILL): Cloning into '$HOME/.codex/.tmp/plugins-clone-<random>'... git_binary="git"

Observed repeatedly around local times:

2026-06-01 21:15:36
2026-06-01 21:16:32
2026-06-01 21:16:49
2026-06-01 23:01:56
2026-06-01 23:02:58
2026-06-01 23:12:15
2026-06-01 23:12:20
2026-06-01 23:25:18

Expected Behavior

Codex should not crash when plugin marketplace refresh is killed or blocked by EDR. Ideally it should:

  • Treat plugin sync failure as non-fatal.
  • Continue with the existing cached marketplace snapshot if present.
  • Provide a clear warning that plugin marketplace refresh failed.
  • Avoid repeated fresh clones into hidden temp directories on every startup after EDR intervention.

Investigation Notes

  • codex --version, codex --help, codex doctor, and minimal codex exec can exit successfully, but Falcon still reports detections when plugin sync runs.
  • The killed process is the git clone child, not necessarily the top-level Codex process.
  • Disabling all plugins works around the issue:
[features]
plugins = false
  • After setting plugins = false, restarting Codex produced no new startup_sync, plugins-clone, git clone, signal: 9, or SIGKILL entries.
  • Re-enabling plugins and adding a local marketplace stanza pointing to the existing cached snapshot did not prevent Codex Desktop from launching the built-in remote clone:
[marketplaces.openai-curated]
source_type = "local"
source = "$HOME/.codex/.tmp/plugins"

Process still appeared:

git clone --depth 1 https://github.com/openai/plugins.git $HOME/.codex/.tmp/plugins-clone-<random>
  • Several surviving partial clone directories had newest files under plugins/nvidia/..., especially plugins/nvidia/skills/physical-ai-infrastructure-setup-and-resilient-scaling/.... This may be a content-specific Falcon trigger, but it is not conclusive because Codex clones the whole marketplace repository before individual plugin enablement is applied.

Suggested Improvements

  • Make curated plugin sync failure non-fatal for the desktop app.
  • If a cached curated marketplace exists, fall back to it without crashing.
  • Add an explicit config option to disable only curated marketplace remote refresh while keeping already-installed/local plugins enabled.
  • Consider avoiding hidden temp-directory full-repo clone behavior for curated marketplace refresh, or provide enterprise/EDR-friendly documentation for allowlisting.
  • If possible, identify and remove content from openai/plugins that triggers common EDR heuristics.

Current Workaround

Disable the plugin feature entirely:

[features]
plugins = false

This prevents the Falcon-triggering startup sync path, but also disables plugin functionality.

View original on GitHub ↗