A Codex issue reporter claims Codex Memories can carry private chat material into unintended agent contexts, creating a data-exposure risk for persistent coding-agent memory.
state: expiredheat: lowuncertainty: highknownscott: mediumagent-memory agentic-security coding-agentsOpenAI
What is this?
The supplied results establish that OpenAI’s Codex is a coding agent and that researchers reported multiple ways AI-agent tooling could move sensitive data unexpectedly, including a Codex command-injection flaw and a separate ChatGPT code-execution channel capable of transmitting private chat data. They also support the broader concern that persistent agent memory should be scoped and selective rather than a dump of conversation history. However, the snippets do not substantiate the case’s specific claim that “Codex Memories” can select an unrestricted prior rollout, serialize its conversation, and inject or send it into another agent context; the available reporting may be conflating two separate vulnerabilities.
Why it matters to Scott
Scott already argues in SiloOS, Cognitive Git, and Session Isolation that raw conversation history must not become ambient cross-session memory; this allegation bears directly on that architecture and on his Codex-inclusive Search Conversations archive. The specific Codex Memories mechanism remains unsubstantiated and may conflate separate vulnerabilities, while the radar already tracks adjacent Codex context-exposure concerns on `radar:openai-codex-cross-tenant-leak`.
ip:framework.siloosip:framework.cognitive-gitip:concept.session-isolationdev:project.search-conversationsradar:concept.agent-memoryradar:openai-codex-cross-tenant-leak
queries asked of Scott's wikis
- persistent agent memory scoping and isolation
- cross-session context leakage in coding agents
- memory provenance and access-control boundaries
- agent harness defenses against data exfiltration
- coding-agent least privilege and secret handling
- verifiable selective memory versus chat-history retention
Measured heat
no measured readings yet — the hourly heat pass fills this in
How the heat travelled
no chain yet — the hourly chain pass fills this in
Evidence (3) — ⭐ canonical anchor
Interpretation history
2026-09-05T16:26:15Z
The allegation has outlasted its follow-up window without independent reproduction or a scheduled confirming event, so active monitoring no longer earns attention. Expiry does not disprove the reported provider-crossing memory behavior; the adjacent Skysight logging report remains insufficient to establish it.
2026-09-03T15:50:59Z
No new evidence has appeared within the review window, leaving the alleged cross-context replay mechanism uncorroborated; the adjacent Skysight logging report still does not establish exfiltration. The security implication remains material, but the episode has cooled pending reproduction or an OpenAI response.
2026-09-01T14:44:38Z
The Skysight report shows adjacent local activity logging but does not reproduce or independently corroborate the alleged cross-provider Codex Memories replay mechanism. The case remains a concrete, consequential single-source vulnerability allegation rather than an established exposure.
2026-09-01T14:24:43Z
evidence attached: reddit.post.1w4c0nd — Adds an independent user report alleging that Codex or GPT computer-use memory records detailed activity and may transmit it off-device, materially strengthening the privacy-risk case.
2026-08-30T19:42:06Z
No new evidence corroborates the reporter’s concrete cross-context replay claim; the case remains a material but single-source allegation rather than an established Codex Memories vulnerability.
2026-08-30T19:36:17Z
grounded: known/medium — Scott already argues in SiloOS, Cognitive Git, and Session Isolation that raw conversation history must not become ambient cross-session memory; this allegation
2026-08-30T19:33:18Z
origin walked (codex/luna, conf 0.98): anchor hn.story.49501565 -> echo.github.7735bd00cb by jagoff2
2026-08-30T19:32:03Z
case created — The linked Codex repository issue alleges a specific and material privacy failure in persistent agent memory that warrants near-term follow-up.
Decision trace
- 09-06 02:26expireThe allegation has outlasted its follow-up window without independent reproduction or a scheduled confirming event, so active monitoring no longer earns attention. Expiry does not disprove the reporte
- 09-06 02:26alert_silentThere is no new factual delta to surface, and the original mechanism remains supported only by reconstructed reporter testimony. Reopen on inspectable reproduction artifacts, independent confirmation,
- 09-06 02:26alert_routeThere is no new factual delta to surface, and the original mechanism remains supported only by reconstructed reporter testimony. Reopen on inspectable reproduction artifacts, independent confirmation,
- 09-04 01:50repriceNo new evidence has appeared within the review window, leaving the alleged cross-context replay mechanism uncorroborated; the adjacent Skysight logging report still does not establish exfiltration. Th
- 09-04 01:50alert_silentThis review adds only elapsed time, not a consequential factual delta. Re-alerting would repeat a single-source allegation; wait for an independent reproduction, network or retained-memory artifacts,
- 09-04 01:50alert_routeThis review adds only elapsed time, not a consequential factual delta. Re-alerting would repeat a single-source allegation; wait for an independent reproduction, network or retained-memory artifacts,
- 09-02 00:44repriceThe Skysight report shows adjacent local activity logging but does not reproduce or independently corroborate the alleged cross-provider Codex Memories replay mechanism. The case remains a concrete, c
- 09-02 00:44alert_silentThe new report supplies neither network evidence nor a demonstrated link to the original Memories claim, and its small engagement increase adds no consequential information. It can wait for an indepen
- 09-02 00:44alert_routeThe new report supplies neither network evidence nor a demonstrated link to the original Memories claim, and its small engagement increase adds no consequential information. It can wait for an indepen
- 09-02 00:25alert_silentA lone Reddit report identifies a local Codex "skysight" activity log, but the consequential server-upload claim rests on the model saying it could not be sure. It provides no network trace,
- 09-02 00:25surface_candidateA lone Reddit report identifies a local Codex "skysight" activity log, but the consequential server-upload claim rests on the model saying it could not be sure. It provides no network trace,
- 09-02 00:25alert_routeA lone Reddit report identifies a local Codex "skysight" activity log, but the consequential server-upload claim rests on the model saying it could not be sure. It provides no network trace,
- 09-02 00:24attachAdds an independent user report alleging that Codex or GPT computer-use memory records detailed activity and may transmit it off-device, materially strengthening the privacy-risk case.
- 09-02 00:22propose_attachAdds an independent user report alleging that Codex or GPT computer-use memory records detailed activity and may transmit it off-device, materially strengthening the privacy-risk case.
- 08-31 05:42repriceNo new evidence corroborates the reporter’s concrete cross-context replay claim; the case remains a material but single-source allegation rather than an established Codex Memories vulnerability.
- 08-31 05:42alert_silentThis look adds no consequential delta beyond the already-routed primary report, so another alert would only repeat the allegation; wait for reproduction, independent confirmation, or an OpenAI respons
- 08-31 05:42alert_routeThis look adds no consequential delta beyond the already-routed primary report, so another alert would only repeat the allegation; wait for reproduction, independent confirmation, or an OpenAI respons
- 08-31 05:37alert_shadowA specific primary report describes Codex Memories selecting a prior rollout without provider restriction, serializing five retained source items, and reproducing synthetic canaries through the trigge
- 08-31 05:37alert_routeA specific primary report describes Codex Memories selecting a prior rollout without provider restriction, serializing five retained source items, and reproducing synthetic canaries through the trigge
- 08-31 05:36groundScott already argues in SiloOS, Cognitive Git, and Session Isolation that raw conversation history must not become ambient cross-session memory; this allegation bears directly on that architecture and
- 08-31 05:33promote_anchororigin walk conf 0.98
- 08-31 05:32createThe linked Codex repository issue alleges a specific and material privacy failure in persistent agent memory that warrants near-term follow-up.