CRITICAL: Codex modifies project files in Chat mode without permission

What version of Codex is running?

'codex' is not recognized as an internal or external command, operable program or batch file.

What subscription do you have?

GPT Plus (trial period)

Which model were you using?

GPT-5.2-Codex

What platform is your computer?

Microsoft Windows NT 10.0.22631.0 x64

What issue are you seeing?

This report concerns OpenAI Codex (VS Code extension), not ChatGPT Web.

While operating in Chat mode, Codex modified project files without being asked to edit or change any code.
Chat mode was explicitly selected to prevent file modifications after earlier incidents in Agent mode.

Despite this, Codex still altered JavaScript files on its own, violating Chat mode guarantees and breaking project files.
This behavior makes Codex unsafe to use for code review or analysis.

<img width="583" height="819" alt="Image" src="https://github.com/user-attachments/assets/3c9e2d56-6388-4ca0-b95f-95e7ec6cbf83" />

<img width="578" height="874" alt="Image" src="https://github.com/user-attachments/assets/8e741343-4435-4bb2-88e6-ad5afca466a8" />

<img width="574" height="809" alt="Image" src="https://github.com/user-attachments/assets/90f8c8a2-60b0-45bd-89c8-f0fcd67bc8e2" />

<img width="561" height="936" alt="Image" src="https://github.com/user-attachments/assets/e41b3763-0620-4a58-bf13-5aba54019663" />

What steps can reproduce the bug?

1. Open a JavaScript project in VS Code.
2. Start Codex in Agent mode and observe that it is capable of modifying files.
3. Switch Codex explicitly to Chat mode to prevent any file changes.
4. Ask Codex only to review or analyze existing scripts (no request to edit or modify files).
5. Observe that Codex still modifies project files while in Chat mode, without permission.

What is the expected behavior?

• In Chat mode, Codex must never modify or write to project files.
• Chat mode should be safe for review and analysis only.
• Switching from Agent mode to Chat mode must fully disable all file write capabilities.

Additional information

Important context: Codex had previously been used in Agent mode in this workspace.
Due to earlier incidents where Agent mode caused unintended changes, I explicitly switched to Chat mode to prevent any file modifications.
Despite this, Codex still modified project files while in Chat mode.

Additional context: During this incident, some prompt template files appeared to suffer from encoding corruption (garbled Cyrillic text), suggesting improper handling of UTF-8 content.
If a user does not have a backup, such corruption is effectively irreversible, as the original text cannot be reliably reconstructed after the write occurs.

This occurred during a GPT Plus trial period. Due to repeated incidents of unauthorized file modifications and data integrity risks, I do not plan to continue or renew the subscription in its current state.

This is not a prompt quality issue. This is a critical safety and data integrity problem.

For clarity: in the attached screenshot, the code shown on the right side is the original, valid implementation that Codex attempted to "restore".
The content shown on the left reflects the corrupted state produced during the incident.

<img width="1382" height="937" alt="Image" src="https://github.com/user-attachments/assets/b50f57e1-33e5-4030-90f7-3468681fa1f1" />