[Privacy] Codex initiates screen capture while no task is running, offline, and usage quota is exhausted

[passionfruitfruit]

Codex version

26.721.41059

Platform

• macOS 15.6.1 (24G90)
• Mac mini M4 / Apple Silicon
• ChatGPT Plus
• Network environment: mainland China; the VPN was disconnected and Codex had no usable connection to OpenAI

Feedback ID

no-active-thread-019fa86a-af63-7e20-bc8c-359946efce7d

Summary

Codex Desktop has unexpectedly initiated macOS screen capture on at least four observed occasions without any user action.

Three occurrences happened on July 28, 2026, and one happened earlier. To the best of my recollection, every observed occurrence happened under the same conditions:

• Codex was open, but no task was running.
• My Codex usage quota was exhausted.
• Codex could not connect to OpenAI because the VPN was disconnected.
• I did not invoke Computer Use, AppShot, browser capture, a keyboard shortcut, or any other screen-aware feature.
• macOS explicitly displayed: “Codex is capturing your screen.”
• The capture indicator disappeared by itself after several seconds.
• The Codex UI and Codex Pet showed no corresponding activity.

The screenshots from the latest occurrence show the indicator continuously from approximately 11:11:13 through 11:11:17 China Standard Time (UTC+8), establishing a duration of at least four seconds.

I previously used screen-aware Codex features and granted macOS Screen Recording permission. However, grep -n 'chronicle' "$HOME/.codex/config.toml" returns no output, so there is no explicit chronicle entry in my config file. I understand that this alone does not prove Chronicle is disabled or inactive.

Having permission should not cause unexplained capture when no task or user-requested operation is active.

I have no evidence that the captured frames were uploaded, especially because Codex had no usable network connection. The directly observed issue is that local screen capture was initiated without a visible trigger or explanation.

Steps to reproduce

The behavior is intermittent and I cannot intentionally trigger it:

1. Leave Codex Desktop open.
2. Do not start or queue any task.
3. Reach the Codex usage limit.
4. Disconnect the VPN so Codex cannot reach the service.
5. Continue using other applications normally.
6. At an unpredictable time, macOS may report that Codex is capturing the screen for several seconds.

Actual behavior

Codex activates macOS screen capture for several seconds even though:

• no task is running;
• no user action requested screen access;
• the usage quota is exhausted;
• Codex has no usable network connection;
• neither the main Codex UI nor Codex Pet indicates any activity.

No screenshot appeared in a conversation, and the app provided no explanation of whether the frames were stored, processed, discarded, or associated with Chronicle.

Expected behavior

Codex should capture the screen only when an active, user-authorized feature requires it.

If a background feature such as Chronicle initiates capture, Codex should:

• clearly show which feature is capturing and why;
• provide an immediately effective pause/disable control;
• avoid capturing unrelated personal activity while no task is running;
• disclose whether frames are stored locally or transmitted;
• visibly attribute any usage consumed by that background feature.

Impact

This creates a serious privacy and trust concern because the computer was being used for unrelated personal activity, including private conversations and watching Bilibili.

The lack of any corresponding activity inside Codex makes it impossible to determine why the screen was captured, what content was retained, or whether similar captures happened without being noticed.

It also raises a usage-accounting concern. My quota was already exhausted when the latest event was observed, and I cannot determine whether earlier background Chronicle or Computer Use activity contributed to that exhaustion.

Please correlate my account usage and diagnostics with the Feedback ID and reported timestamps. If background screen capture or Chronicle processing consumed quota without a visible user-initiated task, please consider restoring the affected usage or advise which support channel can review it.

Evidence

Three screenshots from the latest occurrence were captured at:

• July 28, 2026, 11:11:13 CST (UTC+8)
• July 28, 2026, 11:11:15 CST (UTC+8)
• July 28, 2026, 11:11:17 CST (UTC+8)

All three show the macOS message that Codex is capturing the screen while the Codex window simultaneously shows that the usage limit has been reached and no task is executing.

The screenshots will be attached in a follow-up comment because the issue-submission integration cannot upload local image files.

Possibly related

• Codex Desktop (macOS): Chronicle runs continuous background screen-recording summaries every 10 min, draining plan limits; disabling doesn't immediately stop capture #30639 — Chronicle continuously captures screens and may consume plan limits in the background
• Codex Desktop Chronicle screen-capture helper repeatedly triggers macOS systemstatusd high CPU #24367 — Chronicle repeatedly starts short-lived screen-capture helper processes on macOS

This report adds evidence from the newer Codex build 26.721.41059, with no active task, no usable network connection, and an exhausted usage quota.

Requested investigation

1. Identify which Codex component initiated the captures at the reported times.
2. Confirm whether any frames were saved, analyzed, queued, or later uploaded.
3. Confirm whether Chronicle can capture while offline, quota-exhausted, and without an active task.
4. Add a visible capture reason and an immediate pause/disable control.
5. Attribute any Chronicle/background usage separately.
6. Review whether unrequested background processing consumed account quota and whether that usage can be restored.

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• Codex Computer Use leaves ScreenCaptureKit stream running at ~56 FPS, causing high WindowServer GPU on macOS #35659

Powered by Codex Action

[passionfruitfruit]

Thanks for the automated check. #35659 may involve the same underlying ScreenCaptureKit / SkyComputerUseService component, but the observed behavior and trigger are materially different, so I do not believe this report is a duplicate.

• Codex Computer Use leaves ScreenCaptureKit stream running at ~56 FPS, causing high WindowServer GPU on macOS #35659 reports a stale ~55–56 FPS capture stream that remains after an explicitly initiated Computer Use interaction, together with sustained WindowServer CPU/GPU usage.
• This report concerns intermittent, user-visible capture starting without any active task or Computer Use interaction, while Codex is offline and the usage quota is exhausted.
• In this report the macOS capture indicator appears for several seconds and disappears by itself; I am not reporting sustained GPU load or a continuously leaked stream.
• The affected build is the same, but this report includes a separate Feedback ID and timestamped evidence for the no-active-task/offline/quota-exhausted state.

They could share a lifecycle bug, but #35659 does not cover the unexpected initiation conditions, lack of an active consumer, privacy impact, or usage-attribution concern documented here. Please keep this issue open unless maintainers confirm that both symptoms have the same root cause.

[passionfruitfruit]

Screenshots referenced in the Evidence section, captured continuously at 11:11:13, 11:11:15, and 11:11:17 CST (UTC+8).