Unexpected image_generation_call during coding session without user request

Unexpected image_generation_call During a Coding Session Without User Request

Summary

During a Codex coding session, an unexpected image generation event occurred even though the user never requested image generation and the current task was purely code-related.

The visible UI output showed:

Ran cd backend && uv run python -m py_compile src/portfolio_api/llm/__init__.py
  └ (no output)

• Generated Image:
  └ [garbled multilingual prompt/token soup]
  └ Saved to:
  file://.../generated_images/019e93ea-7894-7ca2-9d4f-ad56b52a99ca/ig_00f2ffc0a9d2beb3016a21c66ef3d4819385662c4694679ae0.png

The user did not ask for an image. The assistant was working on Python/backend code and had just run a py_compile check.

Expected Behavior

Codex should not invoke image generation unless the user explicitly asks for an image or image editing task.

A shell command such as:

cd backend && uv run python -m py_compile src/portfolio_api/llm/__init__.py

should not be followed by an image generation event.

Actual Behavior

The session log recorded a real image_generation_call immediately after the shell command output.

Sanitized timeline from the local session log:

2026-06-04T18:39:38.752Z
function_call_output:
cd backend && uv run python -m py_compile src/portfolio_api/llm/__init__.py
(no output)

2026-06-04T18:40:58.883Z
response_item:
developer message indicating generated images are saved under the runtime generated_images directory

2026-06-04T18:40:58.885Z
event_msg:
type = image_generation_end
call_id = ig_00f2ffc0a9d2beb3016a21c66ef3d4819385662c4694679ae0
revised_prompt = garbled multilingual token soup

2026-06-04T18:40:58.887Z
response_item:
type = image_generation_call
id = ig_00f2ffc0a9d2beb3016a21c66ef3d4819385662c4694679ae0
status = generating

2026-06-04T18:40:59.760Z
assistant message:
"Syntax is clean. I’m continuing with the backend settings merge and frontend provider option now."

The generated file exists locally and matches the logged call:

PNG image data, 1024 x 1536, RGB
mtime = 2026-06-04T14:40:58-0400
path = <CODEX_RUNTIME_HOME>/generated_images/019e93ea-7894-7ca2-9d4f-ad56b52a99ca/ig_00f2ffc0a9d2beb3016a21c66ef3d4819385662c4694679ae0.png

Why This Looks Like a Runtime / Tool-Routing Bug

Evidence suggests this was not caused by the Python command or by user intent:

• The user never requested image generation.
• The active task was code review / backend implementation.
• The prompt attached to the image generation call was nonsensical token soup, not a meaningful image prompt.
• The image generation call appears as a first-class Codex runtime event in the session log.
• The generated PNG was saved in the normal Codex runtime generated_images directory.
• There is no evidence from the shell command output that an external process created the image.

This does not currently look like an external compromise, but it does look like an unintended tool invocation emitted by the Codex runtime/model/tool-routing layer.

Impact

This is concerning because an unrequested image generation call can:

• create unexpected files on disk,
• potentially incur unwanted generation usage,
• confuse users during code work,
• raise privacy/security concerns if private context were ever routed into an image prompt,
• reduce trust in tool-call isolation.

Environment / Context

• Codex/Orca runtime coding session
• Session/thread id: 019e93ea-7894-7ca2-9d4f-ad56b52a99ca
• Image call id: ig_00f2ffc0a9d2beb3016a21c66ef3d4819385662c4694679ae0
• Timestamp: 2026-06-04T18:40:58Z
• Local config includes view_image_tool = true
• No explicit image generation request was made by the user

Request

Please investigate whether Codex can accidentally emit image_generation_call events during normal coding sessions, especially when no image generation tool use is requested.

It would also be helpful to know:

1. Whether image generation can be fully disabled for coding sessions.
2. Whether view_image_tool = true can indirectly expose generation capability.
3. Whether malformed/corrupted model output can be interpreted as an image generation call.
4. Whether the runtime should require stronger user-intent gating before any image generation call is accepted.

Privacy Note

The generated image base64 payload and any local secrets/tokens have been intentionally omitted from this report.