Codex prints secrets from config files despite explicit AGENTS.md redaction instructions

Summary

Codex repeatedly disclosed live credentials into stored conversation/tool output while inspecting a local operational project, even after the user explicitly required authoritative research and safe secret handling in AGENTS.md.

This happened twice in one session:

1. A redaction expression intended to hide credential-like values failed to match WireGuard environment assignments, causing live VPN credentials to appear in command output.
2. Later, while researching an application's configuration, Codex printed broad YAML line ranges. Those ranges contained a live API key and JWT signing secret.

No secret values are included in this report.

Environment

• Codex CLI: 0.144.6
• OS: Ubuntu 24.04.3 LTS, Linux x86_64
• Permission mode: managed workspace-write
• Project type: single-user, self-hosted Docker operations workspace
• Durable project instructions explicitly stated:
• never print API keys or credentials;
• never recommend configuration or operational changes without current authoritative evidence;
• inspect safely and redact sensitive values.

Steps to reproduce

1. Work in a repository containing an AGENTS.md instruction such as:

Never print or commit .env values, API keys, or credentials.

1. Ask Codex to inspect an operational configuration while preserving secrets.
2. Have the agent use a partial regex redactor or print a broad range from a YAML/TOML/XML configuration.
3. Observe that unanticipated secret fields outside the redactor's pattern are returned verbatim in tool output and persisted in the conversation.
4. Correct the agent and add a stronger durable instruction.
5. Later ask for deeper architecture research.
6. Observe the agent again printing broad config ranges containing different secret fields.

Expected behavior

Codex should treat configuration and credential-bearing files as sensitive by default and avoid emitting their raw contents when the task only needs structure or selected non-secret fields.

At minimum:

• Before displaying config-file output, apply a comprehensive secret scan/redaction pass to tool results.
• Prefer parsing and allowlisting requested safe keys over printing line ranges.
• Detect common sensitive keys such as API keys, JWT/session signing keys, private keys, preshared keys, passwords, tokens, cookies, and connection credentials.
• Honor explicit AGENTS.md secret-handling instructions as a hard operational constraint.
• Warn or block when a proposed command such as sed -n or unrestricted grep targets a credential-bearing file.
• If redaction confidence is incomplete, keep results internal and emit only structural summaries.
• Provide a way to mark paths such as .env, .secrets/, and application config files as never-display.

Actual behavior

The agent relied on incomplete hand-written redaction and later bypassed redaction entirely by printing selected YAML ranges. Both outputs were stored in the conversation. The user then had to rotate or plan rotation of multiple credential sets.

Impact

• Forces credential rotation.
• Breaks trust in autonomous server inspection.
• Makes persistent instructions insufficient protection against accidental disclosure.
• Stored conversation/tool logs become an additional secret-bearing location.
• The risk is especially high during debugging, where configuration inspection is routine.

Related

• #25585 requests a local pre-submit DLP/redaction layer. This report adds a concrete repeated-agent failure mode involving tool output, explicit repository instructions, config-file inspection, and multiple credential types in one session.
• #34207 reports excessive approvals from a separate sandbox failure encountered in the same environment.

Suggested acceptance criteria

1. Tool output containing recognized secret assignments is redacted before display or model-visible persistence.
2. Explicit secret-handling instructions prevent broad raw reads of known config/secret files unless the user specifically requests raw content.
3. Config inspection defaults to an allowlist of safe fields.
4. Redaction covers JWTs, base64 WireGuard keys, private/preshared keys, API keys, session/JWT signing keys, passwords, and tokens.
5. Automated tests cover secrets appearing outside the agent's initial regex assumptions and secrets exposed through broad line-range reads.