Changed SUDO pwd on its own - and broke it

What issue are you seeing?

Gave Codex (running Gpt5.6 Sol Extra High) credentials to a debian linux device (ssh user + sudo pwd).

Somehow in the middle of the session it decides for no reason to rotate the sudo key- completely unrelated to actual instructions. Couldn't believe when i read that in the log. I immediately steered it on that because it didnt stop on its own to tell me directly.

Turned out it was even worse- it not only changed the SUDO pwd but it also broke the new one in the process and locked everyone out of admin access. Images attached speak for themselves. I had to get physical with the console cable to come back here.

Maybe add a hard guardrail that it doesn't pro-activly rotate credentials OR that it verifies if it does so, that the command itself is cleanly formed.

<img width="3840" height="2160" alt="Image" src="https://github.com/user-attachments/assets/44927a94-e97b-43a5-b109-fba0d3d9b173" />
<img width="3840" height="2160" alt="Image" src="https://github.com/user-attachments/assets/7160dc86-a513-4ab3-8c37-9c62cb10c2a9" />

What steps can reproduce the bug?

Give it full access to a remote machine incl sudo credential and a task. Happened somehow random and out of the blue.

What is the expected behavior?

Shouldn't mess with secrets at all unless explicitly instructed.

Additional information

_No response_