Codex Cloud / ChatGPT Codex Connector creates excessive git.clone events for private repos

What happened?

We observed very high GitHub Enterprise audit-log clone volume from Codex Cloud / the ChatGPT Codex Connector against private repositories.

This was visible in GitHub Enterprise audit logs as repeated git.clone events from both:

• chatgpt-codex-connector[bot] using GitHub App server-to-server token
• human actors using GitHub App user-to-server token

The clone events used git/2.43.0 and came from cloud egress IPs consistent with Codex/OpenAI-hosted execution.

Observed scale

Sanitized examples from private repositories:

• One private repo saw 100 git.clone events in about 11 minutes.
• Another private repo saw 1,661 git.clone events since 2026-06-01T00:00Z.
• Activity continued around the clock and did not match normal human usage.
• Suspending the ChatGPT Codex Connector GitHub App was used as the emergency stop.

Expected behavior

Codex Cloud tasks/reviews should reuse cached repository state where possible and should not generate thousands of clone events per day for private repositories unless there are explicitly that many tasks/reviews/scans.

Questions

1. Are these clone events expected for Codex Cloud tasks, automatic reviews, or Codex Security scans?
2. Is there a known cache miss / retry / fanout issue that can cause repeated fresh clones?
3. Can admins map each GitHub git.clone event to the Codex task, review, automation, or scan that triggered it?
4. Can Codex expose per-repo rate limits or controls to prevent clone floods?

Notes

This appears different from #16004, which is about local CLI/plugin temp clone leakage (~/.codex/.tmp/plugins-clone-*). This report is about hosted Codex Cloud / GitHub App clone activity visible in GitHub Enterprise audit logs.

I can provide raw audit-log rows privately if helpful, but I am keeping org/repo names and IPs out of the public issue.