Codex Desktop surfaced spam-like/gambling text in malformed tool-call property name

Summary

Codex Desktop surfaced an ObjectParam validation error where input[121].arguments contained a long multilingual/gibberish property name instead of a valid structured tool-call argument. The visible malformed property name included spam-like and potentially harmful content, including gambling-related Chinese fragments, which made the user reasonably concerned that the session or tool-call state may have been contaminated.

This appears similar to existing reports where malformed tool-call arguments are persisted into session history and rejected with property_name_above_max_length.

Error shown to the user

[ObjectParam] [input[121].arguments.<long multilingual/gibberish/spam-like property name>]
[property_name_above_max_length] Invalid property name in 'input[121].arguments': '<redacted>' is too long. Expected a string with maximum length 256, but got a string with length 853 instead.

Why this is serious

• The UI exposed unrelated spam-like text directly to the user.
• The generated text included gambling-related Chinese fragments, which may be harmful or policy-sensitive depending on locale/user context.
• The content appeared inside a structured tool-call argument/property name, not as ordinary assistant text, making it look like session/tool-call state contamination rather than a normal model response.
• This can create a security concern for users because the text resembles injected or compromised content.
• If persisted in session history, the same malformed call may poison replay/resume and make the task unusable.

Expected behavior

Codex should not persist or surface malformed structured tool-call arguments containing random multilingual/spam-like content. If tool-call argument generation fails schema validation, the invalid item should be dropped, repaired, retried safely, or surfaced with a sanitized diagnostic.

Actual behavior

The raw malformed property name was displayed in the user-facing error message. The property name exceeded the documented maximum length and contained unrelated multilingual/spam-like/gambling text.

Notes

I am reporting this on behalf of a user who saw the issue in Codex Desktop. I have intentionally redacted the full malformed string and omitted local file paths or personal identifiers from this public issue.