Safety Issue: Unsolicited execution of network/download command (github-release) without user confirmation
Resolved 💬 3 comments Opened Nov 6, 2025 by gazb23 Closed Nov 11, 2025
💡 Likely answer: A maintainer (etraut-openai, contributor)
responded on this thread — see the highlighted reply below.
What version of Codex is running?
0.55
What subscription do you have?
PRO
Which model were you using?
_No response_
What platform is your computer?
_No response_
What issue are you seeing?
During a standard chat session, the Codex CLI autonomously executed a shell command without any prompt from me to do so.
It attempted to run: github-release download --user seabornxyz --repo bradbury --tag v1.2.0 --name bradbury.tar.gz
I did not request this file, nor was it relevant to the immediate previous prompts. The CLI did not ask for confirmation before attempting this network request and file write operation.
What steps can reproduce the bug?
Uploaded thread: 019a5613-5967-79d0-
What is the expected behavior?
The Codex CLI should never execute shell commands—especially those involving network requests or file system writes—without explicit user request and confirmation. It should propose the command and wait for approval.
Additional information
_No response_
3 Comments
Which approval and sandbox mode are you using? You can see these by executing the
/statusslash command.And which platform (Linux, MacOS, Windows native, Windows WSL)?
Approval: on-request
Sandbox: workspace-write
MacOS - Darwin 25.0.0 arm64 arm
Thanks for the bug report. We've shared the feedback with the team members who are responsible for training our codex models. We're tracking this feedback and similar reports so we can make the model more robust in future iterations.
If you see other model behavior that you'd like to report, please use the recently-added
/feedbackcommand in the CLI. That will provide us with additional details including logs and conversation text.