Codex Desktop edited the wrong local project despite the user being in another project

What issue are you seeing?

Codex Desktop/agent selected and modified an unrelated local repository even though the user was working in a different project.

In this incident, the user was working in a Forge project and asked for a UI fix: a smooth transition when clicking the Octocat/GitHub icon to toggle a glass sidebar theme. After multiple failed attempts, the user attached a screen recording showing the Forge UI. The agent nevertheless searched local code, matched similar Octocat/glass-theme code in an unrelated automaker repository, and made edits there before realizing the correct project was Forge.

This is not just a bad implementation choice: it caused real writes in the wrong local repo. The user explicitly expected the task/project context to be Forge.

Expected behavior

When a Codex Desktop task is associated with a project, the agent/tool runtime should clearly and reliably bind to that project/worktree. If the runtime cannot determine the project, it should stop and ask instead of searching other local repositories and editing the first plausible match.

At minimum, before writing files outside the active project/workspace, Codex should require an explicit confirmation or surface a hard warning.

Actual behavior

The agent used an unrelated local repository because it contained similar terms/components, then edited files in that unrelated project. The user had to interrupt and point out that the active project was Forge.

Steps to reproduce from this incident

1. In Codex Desktop, work on a local app project (Forge).
2. Ask for a UI change involving an Octocat/GitHub icon and a glass-theme/sidebar transition.
3. Provide visual evidence showing the Forge app.
4. Observe that the agent may search broader local folders, select another repo with similar code (automaker in this case), and write changes there instead of the intended project.

Impact

High severity for trust/safety of local code edits. The agent can dirty or damage unrelated repositories without the user intending that workspace.

Related existing issues found before filing

Potentially related: #24224 (workspace root leaks across projects), #20725 (runtime CWD/worktree not rebound), #25685 (wrong local worktree). This report is a fresh desktop-session incident where the wrong project was selected and written to based on semantic similarity rather than the user's active project context.

Environment

• Product: Codex Desktop app
• Platform: macOS
• Date observed: 2026-07-09
• Task involved local filesystem edits

Notes

The report intentionally avoids absolute local paths and private code contents. The key failure is that project/worktree identity was not enforced before edits.