Security report withdrawn pending private disclosure

[dev-099db67d]

This report has been withdrawn from public discussion. Details were removed pending private security review. Please do not quote, mirror, or redistribute earlier revisions. Original details must not be redistributed.

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• Subagents inherit Codex App task controls and can create independent user-owned threads #38687

Powered by Codex Action

[dongkeren]

These appear related, but I don't think #38687 fully covers this report.

#38687 is a source-side capability issue: a non-root subagent inherits root task-management tools and can invoke operations such as create_thread.

This issue is a target-side admission issue: an agent-originated delegation reaches another durable thread and is admitted as executable input without an enforceable distinction between direct-user authority and agent-originated input. The target still needs an actor-aware policy decision before an agent-originated input can start, queue, steer, or interrupt a turn.

Fixing #38687 would still leave this reproducible when the sender is an independent root task that legitimately has send_message_to_thread, or when another stale/direct caller reaches the target ingress. Conversely, enforcing typed target-side admission would not prevent non-root subagents from inheriting root-only task controls.

Current main exposes an analogous path in the public TUI task-tool implementation: send_message_to_thread serializes the delegation as <codex_delegation> text and passes it to turn/start as UserInput::Text; turn_summary later reconstructs codexDelegation by parsing that text:

• delegated_prompt
• UserInput::Text ingress
• text-based provenance reconstruction

This public TUI path appears to preserve display-level attribution, but not a protocol-native actor identity on which target authorization can reliably depend. I cannot confirm whether the Desktop codex_app broker uses the same internal path.