[macOS] Ambient Suggestions spawns a background conversation with cwd: /, turning AGENTS.md/CLAUDE.md discovery into a full-disk rg scan (also reads ~/.claude/CLAUDE.md)

Summary

The ChatGPT Desktop app's Ambient Suggestions feature spawned a background Codex conversation (no chat title, never shown to the user, not present in session_index.jsonl) whose recorded working directory was / (filesystem root). As part of its standard project-doc discovery, that conversation ran:

sed -n '1,240p' /Users/<user>/.claude/CLAUDE.md && rg --files -g 'AGENTS.md' -g 'CLAUDE.md' / 2>/dev/null | head -50

Because cwd was /, the rg --files walked the entire filesystem, pinning one CPU core at ~75% for many minutes (it kept running even after | head -50 had all the lines it needed until the walk finished). The user only noticed because the machine got loud; nothing in the app UI indicated any background activity.

Two independent concerns:

1. Performance / correctness: project-doc discovery should never be rooted at /. An ambient/background session with no meaningful workspace should skip discovery entirely, or clamp it to $HOME with a depth/time budget.
2. Transparency / privacy: the same command also read the first 240 lines of ~/.claude/CLAUDE.md — the user's private global configuration for a different vendor's assistant (Claude Code) — from an invisible background session, with no visible approval or indication.

Environment

• ChatGPT Desktop (macOS): 26.715.21425
• Bundled codex: codex-cli 0.145.0-alpha.18 (features.code_mode_host=true app-server)
• macOS 26.5.2 (build 25F84), Apple Silicon

Timeline (from local logs, JST)

| Time | Event |
|---|---|
| 22:11:47 | app-server creates ~/.codex/shell_snapshots/01a02999-491c-7f90-9ac0-5e1308e549c1.*.sh for a new conversation 01a02999-491c-... (no title; not in session_index.jsonl) |
| 22:12:16 | Conversation executes the command above with "cwd": "/" (recorded in ~/.codex/process_manager/chat_processes.json) |
| 22:12:17 | Child rg --files -g AGENTS.md -g CLAUDE.md / starts; sustained ~75% CPU, full-disk walk |
| 22:13:49 | ~/.codex/ambient-suggestions/<hash>/ambient-suggestions.json regenerated (generatedAtMs matches) |
| ~22:2x | rg finally exits after finishing the walk |

Evidence

~/.codex/process_manager/chat_processes.json entry (trimmed):

{
  "chatTitle": null,
  "command": "sed -n '1,240p' /Users/<user>/.claude/CLAUDE.md && rg --files -g 'AGENTS.md' -g 'CLAUDE.md' / 2>/dev/null | head -50",
  "conversationId": "01a02999-491c-7f90-9ac0-5e1308e549c1",
  "cwd": "/",
  "osPid": 51319,
  "startedAtMs": 1787404336844,
  "turnId": "01a02999-5312-7482-a31f-51686194b405"
}

Process tree observed while running:

codex app-server (ChatGPT.app, pid 5414)
└─ /bin/zsh -c sed -n '1,240p' ~/.claude/CLAUDE.md && rg --files -g 'AGENTS.md' -g 'CLAUDE.md' / ... (pid 51319)
   └─ rg --files -g AGENTS.md -g CLAUDE.md /   (pid 51344, ~75% CPU)

Expected behavior

• Ambient/background sessions never run filesystem-wide discovery; discovery is bounded to a real workspace root (and skipped when cwd is / or $HOME).
• rg invocations used for discovery carry a scope/depth/time budget, and are terminated once the pipe consumer (head -50) is satisfied.
• Background sessions that read user configuration files — especially other tools' private config such as ~/.claude/CLAUDE.md — are either not allowed to, or are surfaced visibly to the user.

Actual behavior

An invisible background conversation walked the entire disk at ~75% CPU for several minutes and read another assistant's private global config, with no UI indication.

Possibly related

• #25302 (Ambient Suggestions consumes many tokens on start up)
• #33012 (Ambient Suggestions silently controls Chrome)
• #25593 (ambient invoked mutating MCP tool without visible user action)
• #38105 / #22421 (runaway rg scans from other components)