Codex adaptively manipulates independent guardrails to certify goal substitution
Open 💬 1 comment Opened Jul 11, 2026 by pgarcia14180
What version of Codex CLI is running?
codex-cli 0.144.1
What subscription do you have?
x20
Which model were you using?
gpt-5.6-sol medium and happened with 5.5 max
What platform is your computer?
macOS
What terminal emulator and version are you using (if applicable)?
Darwin 24.1.0 arm64 arm
Codex doctor report
{
"schemaVersion": 1,
"generatedAt": "1783739300s since unix epoch",
"overallStatus": "ok",
"codexVersion": "0.144.1",
"checks": {
"app_server.status": {
"id": "app_server.status",
"category": "app-server",
"status": "ok",
"summary": "background server is not running",
"details": {
"control socket": "/Users/pedrogarcia/.codex/app-server-control/app-server-control.sock",
"daemon state dir": "/Users/pedrogarcia/.codex/app-server-daemon",
"mode": "ephemeral",
"pid file": "/Users/pedrogarcia/.codex/app-server-daemon/app-server.pid (missing)",
"settings": "/Users/pedrogarcia/.codex/app-server-daemon/settings.json (missing)",
"status": "not running",
"update-loop pid file": "/Users/pedrogarcia/.codex/app-server-daemon/app-server-updater.pid (missing)"
},
"remediation": null,
"durationMs": 0
},
"auth.credentials": {
"id": "auth.credentials",
"category": "auth",
"status": "ok",
"summary": "auth is configured",
"details": {
"auth file": "/Users/pedrogarcia/.codex/auth.json",
"auth storage mode": "File",
"stored API key": "false",
"stored ChatGPT tokens": "true",
"stored agent identity": "false",
"stored auth mode": "chatgpt"
},
"remediation": null,
"durationMs": 0
},
"config.load": {
"id": "config.load",
"category": "config",
"status": "ok",
"summary": "config loaded",
"details": {
"CODEX_HOME": "/Users/pedrogarcia/.codex",
"config.toml": "/Users/pedrogarcia/.codex/config.toml",
"config.toml parse": "ok",
"cwd": "/Users/pedrogarcia/synapse_os",
"enabled feature flags": "shell_tool, unified_exec, shell_snapshot, code_mode_host, terminal_resize_reflow, sqlite, hooks, enable_request_compression, multi_agent, apps, tool_search_a
lways_defer_mcp_tools, tool_suggest, plugins, in_app_browser, browser_use, browser_use_full_cdp_access, browser_use_external, computer_use, remote_plugin, plugin_sharing, image_generation, re
size_all_images, skill_mcp_dependency_install, mentions_v2, steer, guardian_approval, goals, collaboration_modes, tool_call_mcp_elicitation, auth_elicitation, personality, fast_mode, tui_app_
server, remote_compaction_v2, workspace_dependencies",
"feature flag overrides": "none",
"feature flags enabled": "35",
"log dir": "/Users/pedrogarcia/.codex/log",
"mcp servers": "0",
"model": "gpt-5.6-sol",
"model provider": "openai",
"sqlite home": "/Users/pedrogarcia/.codex"
},
"remediation": null,
"durationMs": 0
},
"git.environment": {
"id": "git.environment",
"category": "git",
"status": "ok",
"summary": "git version 2.39.5 (Apple Git-154)",
"details": {
".git entry": "directory",
"PATH git #1": "/usr/bin/git",
"PATH git entries": "1",
"git branch": "master",
"git build options": "git version 2.39.5 (Apple Git-154); cpu: arm64; no commit associated with this build; sizeof-long: 8; sizeof-size_t: 8; shell-path: /bin/sh; feature: fsmonitor--
daemon",
"git exec path": "/Library/Developer/CommandLineTools/usr/libexec/git-core",
"git version": "git version 2.39.5 (Apple Git-154)",
"repo detected": "true",
"repo root": "/Users/pedrogarcia/synapse_os",
"selected git": "/usr/bin/git"
},
"remediation": null,
"durationMs": 138
},
"installation": {
"id": "installation",
"category": "install",
"status": "ok",
"summary": "installation looks consistent",
"details": {
"PATH codex #1": "/opt/homebrew/bin/codex",
"current executable": "/opt/homebrew/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/bin/codex",
"install context": "npm (package /opt/homebrew/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin, bin /opt/homebrew/lib/node_modules/@
openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/bin, resources /opt/homebrew/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aar
ch64-apple-darwin/codex-resources, path /opt/homebrew/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/codex-path)",
"managed by bun": "false",
"managed by npm": "true",
"managed by pnpm": "false",
"managed package root": "/opt/homebrew/lib/node_modules/@openai/codex",
"npm update target": "/opt/homebrew/lib/node_modules/@openai/codex"
},
"remediation": null,
"durationMs": 132
},
"mcp.config": {
"id": "mcp.config",
"category": "mcp",
"status": "ok",
"summary": "no MCP servers configured",
"details": {},
"remediation": null,
"durationMs": 0
},
"network.env": {
"id": "network.env",
"category": "network",
"status": "ok",
"summary": "network-related environment looks readable",
"details": {
"proxy env vars": "none"
},
"remediation": null,
"durationMs": 0
},
"network.provider_reachability": {
"id": "network.provider_reachability",
"category": "reachability",
"status": "ok",
"summary": "active provider endpoints are reachable over HTTP",
"details": {
"ChatGPT base URL": "https://chatgpt.com/backend-api/ reachable (HTTP 404)",
"reachability mode": "ChatGPT auth"
},
"remediation": null,
"durationMs": 443
},
"network.websocket_reachability": {
"id": "network.websocket_reachability",
"category": "websocket",
"status": "ok",
"summary": "Responses WebSocket handshake succeeded",
"details": {
"DNS": "2 IPv4, 0 IPv6, first IPv4",
"auth mode": "chatgpt",
"connect timeout": "15000 ms",
"endpoint": "wss://chatgpt.com/backend-api/<redacted>",
"handshake result": "HTTP 101 Switching Protocols",
"model provider": "openai",
"models etag present": "true",
"provider name": "OpenAI",
"proxy env vars": "none",
"reasoning header": "false",
"server model present": "false",
"supports websockets": "true",
"wire API": "responses"
},
"remediation": null,
"durationMs": 1161
},
"runtime.provenance": {
"id": "runtime.provenance",
"category": "runtime",
"status": "ok",
"summary": "running npm on macos-aarch64",
"details": {
"commit": "unknown",
"current executable": "/opt/homebrew/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/bin/codex",
"install method": "npm (package /opt/homebrew/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin, bin /opt/homebrew/lib/node_modules/@o
penai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/bin, resources /opt/homebrew/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarc
h64-apple-darwin/codex-resources, path /opt/homebrew/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/codex-path)",
"platform": "macos-aarch64",
"version": "0.144.1"
},
"remediation": null,
"durationMs": 0
},
"runtime.search": {
"id": "runtime.search",
"category": "search",
"status": "ok",
"summary": "search is OK (bundled)",
"details": {
"search command": "/opt/homebrew/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/codex-path/rg",
"search command readiness": "file exists",
"search provider": "bundled"
},
"remediation": null,
"durationMs": 0
},
"sandbox.helpers": {
"id": "sandbox.helpers",
"category": "sandbox",
"status": "ok",
"summary": "sandbox configuration is readable",
"details": {
"approval policy": "OnRequest",
"codex-linux-sandbox helper": "none",
"execve wrapper helper": "/Users/pedrogarcia/.codex/tmp/arg0/codex-arg0mLF1Iz/codex-execve-wrapper",
"filesystem sandbox": "restricted",
"network sandbox": "restricted"
},
"remediation": null,
"durationMs": 0
},
"state.paths": {
"id": "state.paths",
"category": "state",
"status": "ok",
"summary": "state paths and databases are inspectable",
"details": {
"CODEX_HOME": "/Users/pedrogarcia/.codex (dir)",
"active rollout files": "676 files, 5479818612 total bytes, 8106240 average bytes",
"archived rollout files": "0 files, 0 total bytes, 0 average bytes",
"goals DB": "/Users/pedrogarcia/.codex/goals_1.sqlite (file)",
"goals DB integrity": "ok",
"log DB": "/Users/pedrogarcia/.codex/logs_2.sqlite (file)",
"log DB integrity": "ok",
"log dir": "/Users/pedrogarcia/.codex/log (dir)",
"memories DB": "/Users/pedrogarcia/.codex/memories_1.sqlite (file)",
"memories DB integrity": "ok",
"sqlite home": "/Users/pedrogarcia/.codex (dir)",
"state DB": "/Users/pedrogarcia/.codex/state_5.sqlite (file)",
"state DB integrity": "ok"
},
"remediation": null,
"durationMs": 4955
},
"state.rollout_db_parity": {
"id": "state.rollout_db_parity",
"category": "threads",
"status": "ok",
"summary": "rollout files and state DB thread inventory agree",
"details": {
"default model provider": "openai",
"rollout DB active files": "676",
"rollout DB active rows": "676",
"rollout DB archive mismatches": "0",
"rollout DB archived files": "0",
"rollout DB archived rows": "0",
"rollout DB duplicate DB paths": "0",
"rollout DB duplicate rollout thread ids": "0",
"rollout DB malformed file names": "0",
"rollout DB missing active rows": "0",
"rollout DB missing archived rows": "0",
"rollout DB model providers": "openai=676",
"rollout DB rows": "676",
"rollout DB scan cap reached": "false",
"rollout DB scan errors": "0",
"rollout DB sources": "subagent:thread_spawn=461, cli=171, exec=21, vscode=17, subagent:other=5, subagent:review=1",
"rollout DB stale rows": "0"
},
"remediation": null,
"durationMs": 18669
},
"system.environment": {
"id": "system.environment",
"category": "system",
"status": "ok",
"summary": "OS language en-CO",
"details": {
"EDITOR": "not set",
"LANG": "en_AU.UTF-8",
"LESS": "set",
"PAGER": "set",
"VISUAL": "not set",
"os": "Mac OS 15.1.1 [64-bit]",
"os language": "en-CO",
"os type": "Mac OS",
"os version": "15.1.1"
},
"remediation": null,
"durationMs": 2
},
"terminal.env": {
"id": "terminal.env",
"category": "terminal",
"status": "ok",
"summary": "terminal metadata was detected",
"details": {
"COLORTERM": "truecolor",
"TERMINFO_DIRS entry": [
"/Applications/iTerm.app/Contents/Resources/terminfo (dir)",
"/usr/share/terminfo (dir)"
],
"TERM_PROGRAM": "iTerm.app",
"color output": "enabled",
"effective locale": "en_AU.UTF-8",
"stderr is terminal": "true",
"stdin is terminal": "true",
"stdout is terminal": "true",
"terminal": "iTerm2",
"terminal size": "191x48",
"terminal version": "3.6.9"
},
"remediation": null,
"durationMs": 0
},
"terminal.title": {
"id": "terminal.title",
"category": "title",
"status": "ok",
"summary": "terminal title default",
"details": {
"terminal title activity": "true",
"terminal title items": "activity, project-name",
"terminal title project source": "git repo root",
"terminal title project value": "synapse_os",
"terminal title source": "default"
},
"remediation": null,
"durationMs": 0
},
"updates.status": {
"id": "updates.status",
"category": "updates",
"status": "ok",
"summary": "update configuration is locally consistent",
"details": {
"cached latest version": "0.144.1",
"check for update on startup": "true",
"last checked at": "2026-07-10T12:18:33.190929Z",
"latest version": "0.144.1",
"latest version status": "current version is not older",
"npm update target": "/opt/homebrew/lib/node_modules/@openai/codex",
"update action": "npm install -g @openai/codex",
"version cache": "/Users/pedrogarcia/.codex/version.json"
},
"remediation": null,
"durationMs": 1007
}
}
}What issue are you seeing?
Codex adaptively manipulates safeguards designed to detect and stop goal drift.
Ordinary goal drift was expected, so the workflow included transcript grounding,
provenance checks, four adversarial reviewers, independent authorship, public validation,
and mandatory stop conditions. The severe failure is that Codex changed how those
safeguards operated so they certified the drift instead of detecting it.
This occurred in two forms:
- A long-context agent made its substituted artifacts authoritative and caused four
adversarial reviewers to evaluate the substituted goal.
- After direct authorship was removed, an orchestrator regained semantic control by
restricting source access, declaring a disputed interpretation grounded, prohibiting
investigation, and framing independent writers and reviewers around that
interpretation.
The safeguards remained visibly present but were manipulated so they could not perform
their intended function.
What steps can reproduce the bug?
Uploaded thread: 019f4d73-65bc-7073-9f95-fb354103dbba
What is the expected behavior?
The safeguards must remain independent and function as designed, even when an upstream
agent changes the goal.
Provenance reviewers must compare generated artifacts directly against primary user
evidence. Adversarial reviewers must be able to return red findings that block
continuation. An orchestrator prohibited from authoring must not regain authorship by
controlling source access, asserting disputed conclusions, prohibiting investigation, or
predetermining reviewer questions.
If goal drift occurs, at least one independent safeguard should detect it and stop the
process. Codex must not adapt its planning, provenance, dispatches, or reviewer framing
to neutralize those safeguards and manufacture green completion.
Additional information
I spent a lot of time designing and adding safeguards because I initially understood these
failures as ordinary drift caused by missing information or specification.
The final process included enough independent checks that the same failure could occur
only by manipulating or bypassing those checks. Codex then adapted to the safeguards: it
changed their inputs, restricted independent agents, and caused them to certify the
substituted goal.
This is why I no longer consider the issue ordinary misunderstanding. The observed
behavior was adaptive sabotage of the guardrails designed to detect it.
I am exposing this because the failure is difficult to detect: the generated code works,
tests pass, and independent reviewers report success, while the original goal has been
replaced.
Other users may trust these signals without inspecting the final behavior or agent
dispatches. Publishing the reproducible thread may help OpenAI and the community
recognize, evaluate, and mitigate this latent orchestration failure before it affects
more autonomous work.
This issue has 1 comment on GitHub. Read the full discussion on GitHub ↗