Agent violated plan mode restrictions and made changes to files
Open 💬 5 comments Opened Jul 12, 2026 by mbrancato
What version of Codex CLI is running?
codex-cli 0.144.1
What subscription do you have?
PRo
Which model were you using?
gpt-5.4-mini
What platform is your computer?
Darwin 25.5.0 arm64 arm
What terminal emulator and version are you using (if applicable)?
none
Codex doctor report
{
"schemaVersion": 1,
"generatedAt": "1783867217s since unix epoch",
"overallStatus": "warning",
"codexVersion": "0.144.1",
"checks": {
"app_server.status": {
"id": "app_server.status",
"category": "app-server",
"status": "ok",
"summary": "background server is not running",
"details": {
"control socket": "/Users/mike/.codex/app-server-control/app-server-control.sock",
"daemon state dir": "/Users/mike/.codex/app-server-daemon",
"mode": "ephemeral",
"pid file": "/Users/mike/.codex/app-server-daemon/app-server.pid (missing)",
"settings": "/Users/mike/.codex/app-server-daemon/settings.json (missing)",
"status": "not running",
"update-loop pid file": "/Users/mike/.codex/app-server-daemon/app-server-updater.pid (missing)"
},
"remediation": null,
"durationMs": 0
},
"auth.credentials": {
"id": "auth.credentials",
"category": "auth",
"status": "ok",
"summary": "auth is configured",
"details": {
"auth file": "/Users/mike/.codex/auth.json",
"auth storage mode": "File",
"stored API key": "false",
"stored ChatGPT tokens": "true",
"stored agent identity": "false",
"stored auth mode": "chatgpt"
},
"remediation": null,
"durationMs": 0
},
"config.load": {
"id": "config.load",
"category": "config",
"status": "ok",
"summary": "config loaded",
"details": {
"CODEX_HOME": "/Users/mike/.codex",
"config.toml": "/Users/mike/.codex/config.toml",
"config.toml parse": "ok",
"cwd": "/Users/mike",
"enabled feature flags": "shell_tool, unified_exec, shell_snapshot, code_mode_host, terminal_resize_reflow, sqlite, hooks, enable_request_compression, multi_agent, apps, tool_search_always_defer_mcp_tools, tool_suggest, plugins, in_app_browser, browser_use, browser_use_full_cdp_access, browser_use_external, computer_use, remote_plugin, plugin_sharing, image_generation, resize_all_images, skill_mcp_dependency_install, mentions_v2, steer, guardian_approval, goals, collaboration_modes, tool_call_mcp_elicitation, auth_elicitation, personality, fast_mode, tui_app_server, remote_compaction_v2, workspace_dependencies",
"feature flag overrides": "none",
"feature flags enabled": "35",
"log dir": "/Users/mike/.codex/log",
"mcp servers": "0",
"model": "gpt-5.4-mini",
"model provider": "openai",
"sqlite home": "/Users/mike/.codex"
},
"remediation": null,
"durationMs": 0
},
"git.environment": {
"id": "git.environment",
"category": "git",
"status": "ok",
"summary": "git version 2.48.1",
"details": {
"PATH git #1": "/opt/homebrew/bin/git",
"PATH git #2": "/usr/bin/git",
"PATH git entries": "2",
"git build options": "git version 2.48.1; cpu: arm64; no commit associated with this build; sizeof-long: 8; sizeof-size_t: 8; shell-path: /bin/sh; feature: fsmonitor--daemon; libcurl: 8.7.1; zlib: 1.2.12",
"git exec path": "/opt/homebrew/opt/git/libexec/git-core",
"git version": "git version 2.48.1",
"repo detected": "false",
"selected git": "/opt/homebrew/bin/git"
},
"remediation": null,
"durationMs": 143
},
"installation": {
"id": "installation",
"category": "install",
"status": "ok",
"summary": "installation looks consistent",
"details": {
"PATH codex #1": "/opt/homebrew/bin/codex",
"current executable": "/opt/homebrew/bin/codex",
"install context": "brew",
"managed by bun": "false",
"managed by npm": "false",
"managed by pnpm": "false",
"managed package root": "not set"
},
"remediation": null,
"durationMs": 3
},
"mcp.config": {
"id": "mcp.config",
"category": "mcp",
"status": "ok",
"summary": "no MCP servers configured",
"details": {},
"remediation": null,
"durationMs": 0
},
"network.env": {
"id": "network.env",
"category": "network",
"status": "ok",
"summary": "network-related environment looks readable",
"details": {
"proxy env vars": "none"
},
"remediation": null,
"durationMs": 0
},
"network.provider_reachability": {
"id": "network.provider_reachability",
"category": "reachability",
"status": "ok",
"summary": "active provider endpoints are reachable over HTTP",
"details": {
"ChatGPT base URL": "https://chatgpt.com/backend-api/ reachable (HTTP 404)",
"reachability mode": "ChatGPT auth"
},
"remediation": null,
"durationMs": 343
},
"network.websocket_reachability": {
"id": "network.websocket_reachability",
"category": "websocket",
"status": "ok",
"summary": "Responses WebSocket handshake succeeded",
"details": {
"DNS": "2 IPv4, 0 IPv6, first IPv4",
"auth mode": "chatgpt",
"connect timeout": "15000 ms",
"endpoint": "wss://chatgpt.com/backend-api/<redacted>",
"handshake result": "HTTP 101 Switching Protocols",
"model provider": "openai",
"models etag present": "true",
"provider name": "OpenAI",
"proxy env vars": "none",
"reasoning header": "false",
"server model present": "false",
"supports websockets": "true",
"wire API": "responses"
},
"remediation": null,
"durationMs": 760
},
"runtime.provenance": {
"id": "runtime.provenance",
"category": "runtime",
"status": "ok",
"summary": "running brew on macos-aarch64",
"details": {
"commit": "unknown",
"current executable": "/opt/homebrew/bin/codex",
"install method": "brew",
"platform": "macos-aarch64",
"version": "0.144.1"
},
"remediation": null,
"durationMs": 0
},
"runtime.search": {
"id": "runtime.search",
"category": "search",
"status": "ok",
"summary": "search is OK (system)",
"details": {
"search command": "rg",
"search command readiness": "ripgrep 15.1.0",
"search provider": "system"
},
"remediation": null,
"durationMs": 4
},
"sandbox.helpers": {
"id": "sandbox.helpers",
"category": "sandbox",
"status": "ok",
"summary": "sandbox configuration is readable",
"details": {
"approval policy": "OnRequest",
"codex-linux-sandbox helper": "none",
"execve wrapper helper": "/Users/mike/.codex/tmp/arg0/codex-arg0lMb45o/codex-execve-wrapper",
"filesystem sandbox": "restricted",
"network sandbox": "restricted"
},
"remediation": null,
"durationMs": 0
},
"state.paths": {
"id": "state.paths",
"category": "state",
"status": "ok",
"summary": "state paths and databases are inspectable",
"details": {
"CODEX_HOME": "/Users/mike/.codex (dir)",
"active rollout files": "72 files, 380372207 total bytes, 5282947 average bytes",
"archived rollout files": "0 files, 0 total bytes, 0 average bytes",
"goals DB": "/Users/mike/.codex/goals_1.sqlite (file)",
"goals DB integrity": "ok",
"log DB": "/Users/mike/.codex/logs_2.sqlite (file)",
"log DB integrity": "ok",
"log dir": "/Users/mike/.codex/log (dir)",
"memories DB": "/Users/mike/.codex/memories_1.sqlite (file)",
"memories DB integrity": "ok",
"sqlite home": "/Users/mike/.codex (dir)",
"state DB": "/Users/mike/.codex/state_5.sqlite (file)",
"state DB integrity": "ok"
},
"remediation": null,
"durationMs": 209
},
"state.rollout_db_parity": {
"id": "state.rollout_db_parity",
"category": "threads",
"status": "ok",
"summary": "rollout files and state DB thread inventory agree",
"details": {
"default model provider": "openai",
"rollout DB active files": "72",
"rollout DB active rows": "72",
"rollout DB archive mismatches": "0",
"rollout DB archived files": "0",
"rollout DB archived rows": "0",
"rollout DB duplicate DB paths": "0",
"rollout DB duplicate rollout thread ids": "0",
"rollout DB malformed file names": "0",
"rollout DB missing active rows": "0",
"rollout DB missing archived rows": "0",
"rollout DB model providers": "openai=72",
"rollout DB rows": "72",
"rollout DB scan cap reached": "false",
"rollout DB scan errors": "0",
"rollout DB sources": "cli=72",
"rollout DB stale rows": "0"
},
"remediation": null,
"durationMs": 1682
},
"system.environment": {
"id": "system.environment",
"category": "system",
"status": "ok",
"summary": "OS language en-US",
"details": {
"EDITOR": "not set",
"LANG": "C.UTF-8",
"LC_CTYPE": "UTF-8",
"VISUAL": "not set",
"os": "Mac OS 26.5.1 [64-bit]",
"os language": "en-US",
"os type": "Mac OS",
"os version": "26.5.1"
},
"remediation": null,
"durationMs": 6
},
"terminal.env": {
"id": "terminal.env",
"category": "terminal",
"status": "warning",
"summary": "height 20 rows - content may scroll off (recommended >=24)",
"details": {
"color output": "enabled",
"effective locale": "UTF-8",
"stderr is terminal": "true",
"stdin is terminal": "true",
"stdout is terminal": "true",
"terminal": "Apple Terminal",
"terminal size": "174x20"
},
"issues": [
{
"severity": "warning",
"cause": "height 20 rows - content may scroll off (recommended >=24)",
"measured": "174 x 20",
"expected": ">= 24 rows",
"remedy": "resize the window to at least 24 rows",
"fields": [
"terminal size"
]
}
],
"remediation": null,
"durationMs": 0
},
"terminal.title": {
"id": "terminal.title",
"category": "title",
"status": "ok",
"summary": "terminal title default",
"details": {
"terminal title activity": "true",
"terminal title items": "activity, project-name",
"terminal title project source": "cwd",
"terminal title project value": "mike",
"terminal title source": "default"
},
"remediation": null,
"durationMs": 0
},
"updates.status": {
"id": "updates.status",
"category": "updates",
"status": "ok",
"summary": "update configuration is locally consistent",
"details": {
"cached latest version": "0.144.1",
"check for update on startup": "true",
"last checked at": "2026-07-12T01:23:14.759870Z",
"latest version": "0.144.1",
"latest version status": "current version is not older",
"update action": "brew upgrade --cask codex",
"version cache": "/Users/mike/.codex/version.json"
},
"remediation": null,
"durationMs": 112
}
}
}What issue are you seeing?
In plan mode, the tool that allows the agent to modify and patch files should be moved to a read-only mode. I was working on a larger markdown strategy document, in plan mode to get the session to plan changes to the document first, but it made changes anyway.
› you made changes to the filesystem while in plan mode only, how did that happen? I know it was only a markdown plan file, but aren't all file writes blocked in plan mode?
• Yes. In plan mode, file writes are supposed to be blocked, including markdown. I made a mistake and applied a patch anyway, which I should not have done.
The correct behavior would have been to keep it read-only and only return the proposed plan text in chat. If you want, I can either revert that file change or keep using
this as a pure planning exercise and not touch the filesystem again until you explicitly switch out of plan mode.It did not run external commands, it used the tools to edit the file, typically done by applying a diff, which it showed as it was performing the change.
What steps can reproduce the bug?
After planning out the initial changes, the plan shown was unclear that it was only going to update my strategy plan document, and not actually update my code. So I told it to stay in plan mode instead of selecting the "exit plan mode and implement now" option. Then, I provided this instruction:
this is a documentation / plan change only. we're not making any code changes. just updating the launch plan.which caused it to make the changes even though it was still in plan mode.
What is the expected behavior?
Plan mode should make all codex tools also enforce read-only mechanisms, including attempting to filter any shell commands that could be used to write to files.
Additional information
_No response_
5 Comments
Plan mode should be an execution authority, not an instruction the model is expected to obey. The strongest invariant is that a turn carrying Plan mode cannot reach a mutating tool path, even when the user asks to edit a plan or documentation file.
I would enforce that at dispatch:
plan_mode_write_blockedoutcome with tool class, mode/turn reference, and no-effect status, while avoiding raw sensitive arguments in the denial record.Regression coverage I would keep:
That makes the mode boundary deterministic even when the model or user language is ambiguous.
Boundary: architecture and regression-test feedback only. I did not reproduce the report or validate Codex, Plan mode, collaboration-mode handling, apply_patch, shell policy, sandboxing, permission profiles, MCP or dynamic tools, delegated agents, implementation correctness, safety, security, production readiness, official alignment, adoption, partnership, integration, customer interest, or Neura usage.
While the above comment is more detailed, my view is that in plan mode, the built-in tools (and possibly 3rd party tools) are put into a read-only mode. This would prevent the agent from violating the read-only constraint.
I still see this in codex-cli 0.145.0 - In fact its editing all sorts of files when in plan mode.
Utilizing codex itself, I have created improvements to the contract and security of plan mode:
https://github.com/openai/codex/compare/main...mbrancato:codex:plan_mode_ro
Analysis: Plan mode mutation prohibition is prompt-only —
apply_patchauthorization never consultsModeKind::Plan(still present at current HEAD)Issue anchor: #32594 (CLI 0.144.1, confirmed still reproducing on 0.145.0 by the reporter).
This matches what the issue describes — a normal Plan-mode turn applied a patch with no external command involved. The mechanism is visible statically in current source (verified 2026-07-28 at
main=4c434651):The Plan-mode mutation ban exists only as prompt text. The collaboration-mode template instructs the model not to mutate (
codex-rs/collaboration-mode-templates/templates/plan.md:12-39), but nothing in the tool authorization chain enforces it:builtin_collaboration_mode_presets()builds the Plan mask with mode, reasoning effort, and developer instructions — there is no permissions field in the mask at all (codex-rs/models-manager/src/collaboration_mode_presets.rs:20-27).per_turn_config.permissions.effective_permission_profile()(codex-rs/core/src/session/turn_context.rs:544) and setsmode: collaboration_mode.modeseparately (:579).effective_permission_profile()(codex-rs/core/src/config/mod.rs:459) reads config profile state only — it has no mode input.apply_patchinherits the ordinary profile. A model-emittedapply_patchis routed through the shell interception path with the turn's standard permission profile (codex-rs/core/src/tools/handlers/shell.rs:140-153). Patch authorization ineffective_patch_permissionsevaluates session grants and the filesystem sandbox policy (codex-rs/core/src/tools/handlers/apply_patch.rs:261-299) — a grep of the handler confirms zero references toModeKind.dispatch_any_with_terminal_outcometags results by permission-profile-derived sandbox tags and looks up the tool handler (codex-rs/core/src/tools/registry.rs:427-465); no mode check protects mutating tools generically.The only two Plan-mode guards that do exist are off the mutation path:
update_planrejects calls while already in Plan mode (codex-rs/core/src/tools/handlers/plan.rs:84-88), and extension-initiated idle continuation refuses to start a Plan-mode turn (codex-rs/core/src/session/inject.rs:58,89). Neither sits between the model andapply_patch.Hypothesis: when the active permission profile permits writes (the default in most interactive configs), a model that disobeys the Plan-mode instructions reaches a production mutation path with full authorization. The mode is advisory, not an execution authority — consistent with the reporter's observation that 0.145.0 edits "all sorts of files" in Plan mode, and with the direction suggested in the comments above (enforce at dispatch, e.g. a Plan-mode tool allowlist or read-only effective profile).
Note on scope: this is the ordinary-turn path. I deliberately do not rely on any ghost-turn/goal-continuation theory — that path now has an explicit Plan guard (
codex-rs/ext/goal/src/runtime.rs→try_start_turn_if_idle).Analysis only; no PR attached per contribution policy. Happy to help validate a fix direction (e.g. dispatch-layer mode gate vs. read-only profile binding) if the team picks one.
No unsolicited PR from me; happy to refine or draft fail-first tests if maintainers invite a fix direction.