Agent edits code before validating hypotheses and reports speculative fixes as proven

What issue are you seeing?

In long-running, technically complex coding sessions, the Codex agent can repeatedly convert a plausible but unproven diagnosis into production edits, add tests that encode only the favorable branch of the hypothesis, and describe the change as a correction before the required mathematical or code-level identity has been established.

The observed failure pattern is:

1. The user requests a narrow current-code audit and explicitly requires evidence before edits or compilation.
2. The agent drifts into unrelated history and misidentifies a commit as an anchor for one case even though the commit message and diff concern a different case.
3. The agent infers a missing flux term from one restricted algebraic branch.
4. Before proving equivalence across all production branches, it edits production C++ and adds tests.
5. The tests cover constant-state data that suppress the branch mismatch, so they pass.
6. The agent compiles and runs the expensive application, then reports that the proposed correction is insufficient.
7. Only after an independent mathematical review is requested does a concrete counterexample show that the claimed general operator identity is false.
8. The edits must then be reverted or stashed.

This is not merely an incorrect answer. It is an agent-control problem: explicit instructions such as “audit before compiling,” “do not speculate,” “do not change code without proof,” and “stay on the requested case” do not reliably prevent premature code/test mutation and task drift.

Concrete counterexample from the observed incident

The agent claimed that a lagged deferred correction generally reproduced the reconstructed high-order operator minus the first-order operator. It modified both production code and unit tests based on that claim.

An independent math audit later found that the two production paths use different reconstruction rules at spectral support edges and empty donors. For a default Minmod limiter, positive constant transport velocity, and stencil

(N[i-1], N[i], N[i+1]) = (0, 1, 3)

the reconstructed-matrix support rule produces face action 2, while the modified lagged correction produces 1.5. Therefore the claimed identity is false in general.

The added tests missed the defect because the variable-coefficient test used a constant action field, while the variable-action tests did not combine that variation with the support-edge branch.

Steps to reproduce

This behavior is nondeterministic but has recurred in long coding sessions:

1. Use Codex on a large C++ numerical/scientific repository.
2. Ask it to diagnose a convergence or order regression.
3. Explicitly require read-only mathematical and code audits before any edit or compilation.
4. Ask it to remain on one named regression case.
5. Continue through several compacted/long-context turns.
6. Observe whether Codex:

• states a plausible mechanism as proven without a complete derivation;
• modifies production code and tests before falsification attempts;
• treats compilation or passing self-authored tests as evidence of correctness;
• drifts to historical commits or neighboring cases;
• later reverses the claim after a failed run or independent agent review.

Expected behavior

Before changing code, the agent should:

• distinguish proven facts, observations, hypotheses, and unknowns;
• derive the exact discrete identity it relies on across every active branch;
• actively search for counterexamples;
• audit existing tests for blind spots;
• obey explicit read-only and task-scope constraints;
• never use a newly written test as the sole correctness oracle for the same speculative change;
• stop and report uncertainty when evidence is insufficient.

A failed production run should not be the first falsification step for an algebraic claim that can be checked locally.

Environment

• Codex CLI: 0.149.0
• Locally reported latest version: 0.149.1
• Model: gpt-5.6-sol
• Platform: Ubuntu 24.04, Linux x86_64
• Terminal: GNU screen, screen.xterm-256color
• Authentication: ChatGPT paid account
• Diagnostics: installation, auth, network, WebSocket, Git, and local databases reported healthy; one unrelated stale rollout-database row was reported.

No proprietary source, repository identifiers, local paths, or private session transcript is included here.