Codex Desktop background suggestion task unexpectedly launches automated Chrome window

Codex Desktop unexpectedly opened an external Google Chrome window showing:

Chrome is being controlled by automated test software

I did not explicitly request browser automation, Chrome control, Playwright/Selenium, or any web task in the visible chat. This made it look like my computer had been remotely controlled or compromised.

Local investigation showed the Chrome process was launched by Codex:

Codex.app
  -> codex app-server
    -> npm exec chrome-devtools-mcp@latest
      -> chrome-devtools-mcp
        -> Google Chrome --enable-automation --remote-debugging-pipe --user-data-dir=~/.cache/chrome-devtools-mcp/chrome-profile about:blank

The related internal/background thread appeared to be:

thread_id: 019f01e2-c323-75b0-9106-ce8bb9b7a6f2
turn_id:   019f01e2-c370-7742-870e-af4d90e015aa
time:      2026-06-26 11:04:26 Asia/Shanghai
cwd:       /
model:     gpt-5.4

The prompt/log content began with:

Generate 0 to 3 hyperpersonalized suggestions for what this user can do with Codex in this Projectless chat

This looks like a background personalized suggestion task, not a user-visible chat action. Around the same time, the logs show it loaded chrome-devtools tools, and then an external automated Chrome window appeared.

Expected behavior:

• Background suggestion tasks should not launch visible external Chrome windows.
• Browser automation should require explicit user intent or be clearly surfaced in the UI.
• If Chrome automation is needed, use an isolated/in-app/headless flow or show a clear Codex-owned permission/notification before launching.
• The user should be able to trace which visible thread/task launched browser automation.

Impact:

This is alarming from a security and trust perspective. A visible automated Chrome window appearing without user action makes it look like the machine has been compromised.

Environment details observed locally:

Codex Desktop app server started chrome-devtools-mcp via:
npm exec chrome-devtools-mcp@latest

Chrome launch args included:
--enable-automation
--remote-debugging-pipe
--user-data-dir=/Users/sunhao/.cache/chrome-devtools-mcp/chrome-profile
about:blank

Please treat this as a trust/safety UX regression even if the underlying process is expected internally.