codex can access files outside of the working directory in auto approval mode

What version of Codex is running?

codex-cli 0.47.0

What subscription do you have?

enterprise

Which model were you using?

gpt-5-codex

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

According to the documentation, codex:

Codex will need your approval to work outside the working directory or access network.

However, I observed that when running codex with auto approval mode, it can list files outside of the working directory. For instance, I opened a codex session in /Users/dleibovic/clones/my-repo, and I asked it to list files in /Users/dleibovic/.ssh:

› list the first 3 files in /Users/dleibovic/.ssh


• Ran ls /Users/dleibovic/.ssh | head -n 3
  └ ansible_password.file
    bot_hunter_id_ed25519
    bot_hunter_id_ed25519.pub

─ Worked for 14s ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• First three entries under /Users/dleibovic/.ssh are:

  - ansible_password.file
  - bot_hunter_id_ed25519
  - bot_hunter_id_ed25519.pub

What steps can reproduce the bug?

1. Run codex in auto approval mode
2. ask it to list files in a directory that is not within the working directory.

What is the expected behavior?

_No response_

Additional information

_No response_