›_ Codex Issues
Codex Issues / #33012

[macOS] Ambient Suggestions silently controls Chrome and leaves debugger attached after completion

Open 💬 0 comments Opened Jul 14, 2026 by williamnie

What version of the Codex App are you using (From “About Codex” dialog)?

Codex/ChatGPT App 26.707.72221 (build 5307); bundled Codex CLI 0.144.2; bundled Chrome plugin 26.707.72221; Google Chrome 150.0.7871.115

What subscription do you have?

Unknown / not shown in the current context.

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

Codex Desktop's Ambient Suggestions background task silently used the official Chrome Browser Use integration even though no visible user thread requested browser access.

It opened multiple visible GitHub tabs, inspected the user's open tabs, claimed an existing localhost tab, and clicked within that page. Chrome displayed:

“ChatGPT started debugging this browser.”

The background model turn then finished and produced its suggestion, but the Chrome debugger attachment remained active. The browser banner and highlighted tabs were still visible several minutes later.

This was not merely the Chrome native host starting. Local diagnostics identified the background Ambient Suggestions thread and its exact browser tool calls.

Background thread/session id:

019f5fc1-e3c4-7433-9f84-98df0d0aef52

Sanitized timeline (Asia/Shanghai, 2026-07-14):

  • 16:34:10 — hidden background thread began inspecting the workspace.
  • 16:34:26 — called the browser tool with chrome.tabs.new() and navigated to a public repository's Issues and Pull Requests pages.
  • 16:35:17 — opened a GitHub Notifications tab filtered to that repository.
  • 16:35:24 and 16:35:29 — opened/navigated a GitHub Actions tab.
  • 16:35:42 — called chrome.user.openTabs().
  • 16:35:49 — called chrome.user.claimTab(...) for an existing http://127.0.0.1:3008/ tab.
  • 16:36:10 — clicked a Projects button inside the claimed localhost tab.
  • 16:37:06 — the hidden model turn returned its final Ambient Suggestions JSON.
  • 16:37:26 — ~/.codex/ambient-suggestions/<redacted>/ambient-suggestions.json was updated with the generated suggestion.
  • After 16:46 — the browser controller was still connected to the Chrome extension through /tmp/codex-browser-use/<redacted>.sock.

The live process/socket chain at that point was:

ChatGPT.app
└─ codex app-server
   └─ node_repl (browser controller)
      └─ ChatGPT for Chrome native host
         └─ Google Chrome

The controller and extension host still held opposite ends of the same Unix socket after the Ambient Suggestions turn had completed. Clicking Cancel in Chrome detaches it, but the background task should clean up its own browser session.

This creates two problems:

  1. A hidden background suggestion task changes visible user browser state without explicit user intent.
  2. The debugger/session is not released when the task completes.

What steps can reproduce the bug?

  1. Enable Ambient Suggestions in Codex Desktop.
  2. Install and enable the official Codex/ChatGPT Chrome extension.
  3. Keep a signed-in Chrome profile open, including a localhost application tab.
  4. Open a Codex workspace backed by a GitHub repository.
  5. Do not ask any visible Codex thread to use Chrome.
  6. Start/restart Codex Desktop or wait for Ambient Suggestions generation.
  7. Observe Chrome opening GitHub Issues, Pull Requests, Notifications, and Actions tabs and showing the debugger banner.
  8. Wait until the Ambient Suggestion has been generated.
  9. Observe that the Chrome debugger attachment and tab highlighting remain active.

I have one incident with a complete local trace and exact tool calls. I have not repeatedly restarted the app to test recurrence because doing so would continue modifying the user's visible browser state.

What is the expected behavior?

  • Ambient Suggestions and other hidden/background tasks must not use interactive Chrome or alter visible browser state without explicit user intent.
  • Background context collection should use a strict read-only/non-interactive allowlist.
  • It should not create tabs, claim user tabs, click elements, type, or otherwise operate a logged-in browser session.
  • If a browser attachment is ever created, it must be released on success, cancellation, error, and app shutdown.
  • Any background browser tool call should carry clear provenance and be attributable in the UI.

Additional information

Related issues:

  • #30845 reports unsolicited Chrome debugger attachment on Windows, but did not identify a deterministic initiating task.
  • #25593 reports Ambient Suggestions invoking mutating third-party MCP desktop tools on macOS.

This report connects those two symptoms with a captured first-party path: an Ambient Suggestions background thread directly invoked the bundled Chrome Browser Use tools, visibly changed tabs, and then left the debugger attached after completion.

No screenshots are attached because the visible Chrome window contained unrelated user tabs and bookmarks; the text timeline above is derived from local process, socket, Codex log, and Ambient Suggestions artifact evidence.

View original on GitHub ↗