Codex Chrome extension attaches debugger without a user-requested browser task on Windows

What version of the Codex App are you using (From “About Codex” dialog)?

26.623.11225.0

What subscription do you have?

Unknown / not shown in current context

What platform is your computer?

Windows x64

What issue are you seeing?

Chrome displayed the banner:

“Codex started debugging this browser.”

I had not asked Codex to use or control Chrome in the active thread. The banner appeared while the Codex desktop app and Chrome were open.

Local diagnostics:

• Codex desktop package: OpenAI.Codex_26.623.11225.0_x64
• Codex Chrome extension: 1.1.5
• Chrome plugin bundle: 26.623.81905
• Chrome: 149.0.7827.197
• Windows x64
• Approximate incident time: July 1, 2026, 12:08 PM America/Toronto

The Codex native extension host starts with the desktop app, but a browser-session record was also created around the incident time even though no visible thread requested Chrome control. A permission-state record was created for that browser session as well. I am not claiming this proves any page content was read; it only shows unexpected browser-control/session state.

The public issue tracker has several reports about Chrome plugin connection/session mismatches, but I could not find an exact report of unsolicited debugger attachment.

What steps can reproduce the bug?

1. Install and enable the official Codex Chrome extension.
2. Open Chrome with the extension enabled.
3. Start the Codex desktop app on Windows.
4. Use Codex for non-browser tasks; do not mention or invoke the Chrome plugin.
5. Observe whether Chrome displays “Codex started debugging this browser.”

The issue has occurred once and I do not yet have a deterministic reproduction. At approximately 12:08 PM, a file appeared at:

%USERPROFILE%\.codex\browser\sessions\019f1e6f-27bc-7c90-a8e0-013b5f97ef0a.toml

No visible Codex thread at that time contained a user request to control Chrome.

What is the expected behavior?

Codex should attach Chrome's debugger only when the user explicitly requests a task that requires the Chrome plugin. It should detach when that task ends. Merely running Codex Desktop, or performing a non-browser task, should not claim a tab or trigger Chrome's debugging banner.

Additional information

Clicking Cancel in Chrome stops the debugger attachment. Disabling the Codex Chrome extension prevents recurrence, but removes the feature entirely.

Related session/connectivity issues include #21852, #22264, #22849, #23805, and #21908, although none appears to describe attachment without a user-requested browser task.

Please let me know which logs or diagnostics would be useful if this happens again.