AEV-2026-0065

Codex CLI's PreToolUse hook contract enforces only permissionDecision: deny; allow and ask are parsed and rejected as unsupported

Two independently filed GitHub issues establish that OpenAI's Codex CLI accepts the identical PreToolUse hook response shape Claude Code accepts, a permissionDecision of allow, deny or ask, but its own current implementation enforces only deny. openai/codex issue 28437 states Codex's own current behavior directly for ask; safishamsi/graphify issue 249 reports the identical rejection for allow, against a hook payload that had worked as intended on Claude Code. No CVE, advisory or vendor acknowledgement exists for either report at the time of this entry.

Candidate: below the publication gate, not a published vulnerabilityObservedStatus: candidateExecution AuthorityApproval Controls

Affected

Organisation: OpenAI
Product: Codex
Component: Codex CLI's own PreToolUse hook response parser, which reads a hookSpecificOutput object naming a permissionDecision of allow, deny or ask
Versions: unknown as a single range; only the graphify report names a version, codex-cli 0.120.0, and neither report states whether the gap is present in every Codex CLI release
Configurations: Codex CLI with a PreToolUse hook configured, whether hand authored or generated by a third party tool such as graphify

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task: unknown as a single fact across the two reports: requesting native ask support for human approval prompts in openai/codex issue 28437, and installing a third party tool's own generated Codex integration in safishamsi/graphify issue 249
Agent: Codex CLI itself, executing the PreToolUse hook lifecycle and parsing the hook process's own returned decision before a gated tool call
Delegating actor: The Codex CLI operator in each report: a user requesting native ask support in issue 28437, and a user who installed graphify's own generated hook configuration in issue 249
Action: Codex CLI parsing a PreToolUse hook's own returned permissionDecision value and, for both allow and ask, rejecting it as unsupported rather than acting on it; deny is the only value either report states Codex currently enforces
Target resource: The specific tool call a PreToolUse hook is configured to gate before it executes, named in the graphify report as a Bash tool call and left general in issue 28437's own feature request
Environment: unknown beyond each report's own stated host, Codex CLI
Credentials used: unknown; neither report describes a credential distinct from the operator's own already configured Codex CLI session
Privileges available: Whatever privilege the operator's own Codex CLI session already carried; the hook mechanism itself is meant to narrow, not expand, what proceeds without further review
Authority presented: A PreToolUse hook response naming permissionDecision: ask or permissionDecision: allow, the identical field and identical values Claude Code's own PreToolUse hook contract enforces
Authority required: Enforcement of the specific decision the hook author's own response names, ask escalating the gated call to a human approval prompt, or allow explicitly permitting it, matching what the identical response shape already does on Claude Code
Applicable policy: unknown; neither report states whether Codex declares an internal policy distinguishing which of the three permissionDecision values its own current release is meant to enforce
Approval mechanism: A PreToolUse hook's own returned permissionDecision, intended by its author to gate or escalate the specific tool call it accompanies
Required approver: unknown
Independent approval: unknown
Action binding: The hook author's own written decision, ask or allow, does not bind to what Codex's own current implementation does with the gated call: the decision is parsed as valid JSON and then discarded as unsupported rather than acted on
Sequence context: A PreToolUse hook fires synchronously before Codex dispatches the named tool call, receives the hook process's own JSON response on stdout, and either enforces the returned permissionDecision or, for allow and ask on the evidence these two reports describe, rejects it as unsupported; which of two further outcomes that rejection produces for the gated call itself, proceeding regardless or being refused, is not established by either report

Impact

Consequence: material
Reach: systemic
Reversibility: unknown
Detectability: immediate
Propagation: none
Recovery: unknown; openai/codex issue 28437 remains open with no maintainer comment at this entry's own verification, and neither report states a scheduled or shipped fix

Evidence

Primary sources

Support PreToolUse permissionDecision: ask for native approval prompts (GitHub, openai/codex issues)
codex-cli 0.120.0 hook failed: unsupported permissionDecision:allow on graphifyy 0.4.2 (GitHub, safishamsi/graphify issues)

Reproduction status: Not independently reproduced. Both reports are independent first party accounts against Codex CLI, one against Codex's own repository directly and one against a third party tool's generated hook configuration; this entry did not run Codex CLI itself and did not independently trigger either rejection.
Evidence state: Observed

Known unknowns

Whether Codex's own maintainers have acknowledged, scheduled or rejected native support for ask or allow beyond the closed, inactivity lapsed pull request 20702 that issue 28437 itself names.
Whether the gated tool call proceeds or is blocked once Codex's own hook contract rejects a returned decision as unsupported, and whether that disposition is identical across allow and ask.
Whether the gap is present in every Codex CLI release or only in the one version, 0.120.0, the graphify report names.

Limitations

Both sources were read through this session's own automated web fetch and summarization tool rather than a direct read of each issue's own raw page or full comment thread, and are held at the manual review evidence level rather than as an independently verified direct read.
Neither report has an assigned CVE, a vendor advisory or an independent third party reproduction this entry could locate.

Claim provenance

independent-reporting
openai/codex issue 28437, read through this session's own automated web fetch and summarization tool rather than a direct read of the issue's own raw page or comment thread. States Codex's own current behavior directly under a Current Behavior heading: permissionDecision: ask is parsed but treated as unsupported, returning the error PreToolUse hook returned unsupported permissionDecision:ask. Names a prior pull request, 20702, closed for inactivity rather than rejection, and shows no maintainer comment in the thread at this record's own verification.
The Same Hook File. Only One of the Two Hosts Enforces It.
independent-reporting
safishamsi/graphify issue 249, read through this session's own automated web fetch and summarization tool. States codex-cli 0.120.0 rejected a hook response carrying permissionDecision: allow with the error PreToolUse hook returned unsupported permissionDecision:allow, for a hook payload graphify 0.4.2 itself generated, and that the same payload shape had worked as intended on Claude Code. States the hook's own side effect still displayed while its own schema validation failed, and offers two candidate root causes, an outdated hook template or an evolved Codex schema, without resolving between them.
The Same Hook File. Only One of the Two Hosts Enforces It.

AESS 0.1 severity

No AESS inputs are stored for this entry: the evidence does not yet establish the minimum dimension set the specification requires, so no score is published.

How AESS 0.1 works

Weakness classes

AEW-035 Equivalent actions resolve to different authority decisions across execution surfaces

Change history

2026-09-12
Created from two independently filed GitHub issues, openai/codex issue 28437 (opened 16 June 2026 by jignaciofernandez) and safishamsi/graphify issue 249 (opened 12 April 2026 by sangdo90), read through this session's own automated web fetch and summarization tool and held at the manual review evidence level throughout. Checked against AEW-032, a malformed authority restriction parsed the same as no restriction at all, and declined: that weakness concerns a structurally invalid value silently collapsing to the same result as absence within one system's own parser; here the value is valid and recognized, and the gap is that a second host's own contract does not yet implement two of the three decisions the identical value can carry. Checked against AEW-022, an explicit denial discarded by default substitution during policy compilation, and declined: that weakness concerns deployment time template compilation conflating a valid falsy value with an unset key; this is per call runtime parsing on a live host, with no compiler or template engine involved. Instantiates the existing AEW-035, equivalent actions resolve to different authority decisions across execution surfaces, rather than a new weakness: the identical hook response shape and the identical three named decisions carry full enforcement on Claude Code and partial, deny only, enforcement on Codex CLI, exactly the cross surface authority drift that weakness already names, reached here through a host capability gap rather than through the drifted bug fix timeline its existing known example describes. No CVE, advisory or vendor acknowledgement exists for either report; retained as a candidate rather than published on that basis, and because which of two further outcomes an unsupported decision produces for the gated call itself is not established by either report.