AEV-2026-0014
Codex CLI's cached Guardian classifications could outlive the authorization state they were scored against
Before Codex CLI 0.151.0, an asynchronously scored, cached Guardian v2 low risk classification could still auto approve a tool call after the thread's own or its root thread's authorization state had changed since scoring began. OpenAI's own merged fix binds each cached score to the exact local and root authorization version it was scored against. Retained as a candidate: OpenAI's own material describes a bug fix in a general release, not a disclosed security vulnerability, and no CVE, advisory or independent corroboration exists.
Affected
- Organisation
- OpenAI
- Product
- Codex CLI
- Component
- Guardian v2 automatic review, the asynchronous risk classifier in codex-rs/ext/guardian-v2 that can approve a tool call without a human
- Versions
- unknown; fixed in Codex CLI 0.151.0, released 29 August 2026
- Configurations
- Guardian v2 automatic review enabled (approvalsReviewer set to auto_review)
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- Guardian v2's own asynchronous classification of a proposed tool call, scored against the thread's authorization state at the moment scoring began
- Agent
- Codex CLI's Guardian v2 extension, an internal review component, not the model agent whose tool call is being reviewed
- Delegating actor
- The Codex CLI operator who enabled Guardian v2 automatic review
- Action
- A tool call auto approved on a cached low risk score computed against an authorization state that had since changed, rather than being deferred to strict review
- Target resource
- Whichever tool call Guardian v2 was reviewing for automatic approval
- Environment
- A Codex CLI thread, including a worker or subagent thread scored partly against a separate root thread's own authorization state
- Credentials used
- unknown
- Privileges available
- Whatever privilege the reviewed tool call itself carried; Guardian v2's role is approval, not privilege escalation
- Authority presented
- A cached classification scored as low risk against the authorization state in effect when scoring began
- Authority required
- A classification scored against the authorization state in effect at the moment the action is actually approved
- Applicable policy
- Guardian v2's own review threshold and its automatic review configuration
- Approval mechanism
- Guardian v2 automatic review, an asynchronous machine classifier that can approve a tool call without a human when its score is low enough
- Required approver
- unknown; Guardian v2 substitutes for a human reviewer specifically for low risk classifications
- Independent approval
- no
- Action binding
- OpenAI's own fix binds a cached score to the exact local and root authorization version it was scored against, and forces strict review on a mismatch rather than approving
- Sequence context
- Scoring runs asynchronously; genuine user input or a history reset can arrive before a lower risk score already computed is actually consumed to approve
Impact
- Consequence
- unknown; OpenAI's own material describes the mechanism and its fix, not an observed action approved under a stale classification
- Reach
- unknown
- Reversibility
- unknown
- Detectability
- unknown
- Propagation
- unknown
- Recovery
- unknown
Evidence
Primary sources
- Codex CLI rust-v0.151.0 (OpenAI (openai/codex, GitHub Releases))
- Improve sandboxing, MCP errors, and cached approvals (Pull Request #41196) (openai/codex, GitHub)
Supporting sources
- codex-rs/ext/guardian-v2/src/async_scorer/authorization.rs at commit 035295b, the added ScoreAuthorization type (openai/codex, GitHub)
- codex-rs/app-server/tests/suite/v2/guardian_v2.rs at commit 035295b, the root restriction regression test (openai/codex, GitHub)
- Reproduction status
- Not reproduced by Moona Intelligence; verified by reading OpenAI's own merged source diff and its added regression tests directly rather than by running Codex CLI to trigger the behavior.
- Evidence state
- Confirmed
Known unknowns
- Whether this defect was ever exploited or produced an actual unwarranted approval before the fix.
- The exact Codex CLI version range in which the unbound caching behavior was first introduced.
- Whether OpenAI treats this internally as a security defect distinct from an ordinary correctness bug fix.
Limitations
- OpenAI's own release notes and pull request describe this as a bug fix in a general release changelog, not a disclosed security advisory; no CVE or GHSA identifier exists for it.
- No source independent of OpenAI's own repository, release notes and pull request description was located.
Claim provenance
- verified
OpenAI's own tagged release, read directly, dates Codex CLI 0.151.0 to 29 August 2026 and states in its own changelog that stale Guardian classifications were prevented from authorizing actions after permission state changes.
You Cannot Prompt Your Way Out of Agent Authority - verified
The merged pull request and its merged extension.rs source, read directly, add a ScoreAuthorization pairing a local and an optional root GuardianAuthorizationVersion, capture it when scoring begins, and check it again before a cached low risk score is allowed to approve an action, deferring to strict review on a mismatch and discarding a completed score outright if authorization moved while scoring was in flight.
You Cannot Prompt Your Way Out of Agent Authority