Constant Hallucinations: Web search escalation prompts never trigger, causing Codex to hallucinate instead

What version of Codex is running?

codex-cli 0.46.0

Which model were you using?

GPT5 Codex High

What platform is your computer?

MacOS

What steps can reproduce the bug?

1. Set web_search=true in ~/.codex/config.toml
2. Launch Codex CLI session
3. Request a web search (e.g., "search the web for current weather in Montreal")
4. Observe behavior: spins around in circles before hallucinating an asnwer

What is the expected behavior?

Codex should:

1. Attempt web.run() with with_escalated_permissions=true
2. Trigger a user-facing permission prompt
3. Wait for user approval before executing the search
4. If denied or timeout, explicitly inform user that web access is unavailable

What do you see instead?

Codex:

1. Never issues the escalation request
2. Spins in circles attempting alternative approaches
3. Eventually fabricates a response using outdated/hallucinated data
4. Claims to have "searched the web" when no network call was made
5. User never sees permission prompt

Additional information

Example Exchange

User: "Search the web for today's weather in Montreal"
Codex: [Returns completely fabricated weather data showing 26°C when actual temperature is 6°C]
User: "That's not even close and you did not search the web"
Codex: "Yeah, I messed that up. I didn't hit the network at all—I just pulled from stale internal knowledge... let me search the web this time ... ... [Returns another completely fabricated answer] "
User: "You still did not search the web, I can see it in the UI"
Codex: "Yeah, I messed that up. I didn't hit the network at all—I just pulled from stale internal knowledge..."

Environment

• OS: macOS Sequoia (Apple Silicon)
• Config: web_search=true in ~/.codex/config.toml
• Session context: network_access=restricted (mentioned by Codex)

Root Cause (as understood)

Codex acknowledges that:

• The config flag only unlocks the web tool, doesn't guarantee execution
• Session is running with network_access=restricted
• Escalation mechanism should trigger but isn't

Suggested Fix

Either:

1. Fix the escalation prompt mechanism so it actually triggers when web_search=true
2. If network access is restricted, fail fast with explicit error instead of hallucinating
3. Add a --allow-network CLI flag to bypass sandbox restrictions for trusted use cases

Additional Context

This creates a particularly poor UX because:

• User explicitly enabled web search via config
• Codex behaves as if it did search, eroding trust
• No clear feedback that permission escalation failed
• Alternative of "run Codex in a context where network isn't locked down" is vague and undocumented