What We Found

On May 4, 2026, during a routine security review of our development toolchain, we discovered that OpenAI's Codex application runs a background feature called "ambient suggestions" that:

1. Reads your project context — file paths, recent conversation history, git signals, and instruction files (like AGENTS.md)
2. Transmits that context to OpenAI's backend servers
3. Generates candidate prompts using that context
4. Runs the candidates through a safety filter (also a backend call)
5. Caches surviving suggestions locally
6. Pre-fills your input box with those suggestions on next launch

This happens silently. There is no notification. There is no consent prompt. If you have ever opened a project in Codex, this process has likely run against your codebase.

The investigation was triggered when a team member opened Codex after a three-day absence and found a prompt pre-filled in the input box — one they had never typed. That prompt was generated from project context that had been transmitted to OpenAI's servers in the background.

Platform Scope

The confirmed data transmission was discovered on the Codex desktop application (Windows). The ambient suggestions cache, the non-functional UI toggle, and the confirmed project-context transmissions were all observed on the Windows desktop build. This is where the investigation focused and where all artifacts were recovered.

We subsequently examined the Codex CLI on Linux. The CLI uses a different state architecture — SQLite instead of a JSON state file, and a stage1_outputs table instead of a cache directory. On our Linux installation, that table was empty and no ambient suggestion artifacts were present. However, the table schema exists, which means the infrastructure for the feature is there even if it has not activated. We added ambient_suggestions = false to the CLI's config.toml as a precaution.

If you run Codex on any platform, assume the feature exists and disable it. The absence of cached artifacts does not mean the absence of transmissions — it may mean the feature hasn't triggered yet, or that artifacts were generated but didn't survive filtering. The Windows desktop app is the confirmed vector. The CLI is unconfirmed but structurally capable.

The Toggle That Doesn't Toggle (Windows Desktop)

The Codex desktop app includes a user-facing toggle in its settings UI that appears to control this behavior. The toggle only works in one direction. Clicking it ON correctly writes "ambient-suggestions-enabled": true to the state file. Clicking it OFF does not propagate — the key remains true in the file, and the feature stays active.

The underlying disable mechanism does exist. It lives in a persisted state file as a JSON key: ambient-suggestions-enabled in .codex-global-state.json. When set to false via direct file edit, the feature stops generating suggestions, and the setting persists across Codex restarts. The UI is wired to this same key — but only the ON action writes successfully. The OFF action fails silently.

Whether this is a bug or an intentional design decision, we can't say — but the practical result is the same: users who believe they've disabled the feature through the provided UI have not. The toggle appears responsive. It gives no error. It simply doesn't do what it says.

dir "%USERPROFILE%\.codex\ambient-suggestions" /s

type "%USERPROFILE%\.codex\.codex-global-state.json" | findstr "ambient"

find ~/.codex/ambient-suggestions -type f -name "*.json" 2>/dev/null

sqlite3 ~/.codex/state_5.sqlite "SELECT COUNT(*) FROM stage1_outputs;" 2>/dev/null

grep "ambient" ~/.codex/config.toml 2>/dev/null

copy "%USERPROFILE%\.codex\.codex-global-state.json" "%USERPROFILE%\.codex\.codex-global-state.json.bak"

"ambient-suggestions-enabled": false

# PowerShell — run in background
$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = "$env:USERPROFILE\.codex\ambient-suggestions"
$watcher.IncludeSubdirectories = $true
$watcher.EnableRaisingEvents = $true
Register-ObjectEvent $watcher "Created" -Action {
    Write-Host "[ALERT] Ambient suggestions activity detected: $($Event.SourceEventArgs.FullPath)"
} | Out-Null

[features]
ambient_suggestions = false

sqlite3 ~/.codex/state_5.sqlite "SELECT COUNT(*) FROM stage1_outputs;"

What You Can Recover. What You Can't.

Recoverable: Future generation cycles (disable the feature). Local cache artifacts (delete the ambient-suggestions/ directory). Going forward, the bleed stops.

Not recoverable: Anything already transmitted to OpenAI's backend. There is no client-side mechanism to retract, audit, or compel disclosure of what was received, how long it was retained, or whether it was used for training or any other purpose. Once it left your machine, it's out of your control.

Who Should Care

• Anyone working on proprietary code in Codex. Your file paths, code patterns, architectural decisions, and instruction files were likely transmitted.
• Teams with trade secret obligations. If your IP protection strategy depends on controlling who sees your internals — and most trade secret strategies do — unintended transmission to a third party may affect that status. Document your discovery and containment. Consult counsel.
• Enterprises with data residency or compliance requirements. GDPR, SOC 2, HIPAA-adjacent workflows. Background data transmission to a third party without explicit consent is a compliance event.
• Anyone building on OpenAI's platform and trusting its privacy controls. If a user-facing toggle doesn't function, what other controls are you trusting that haven't been verified?

Our Exposure

We're disclosing this because we were affected. Approximately two months of development work was performed inside Codex across multiple projects, some containing proprietary IP. Cached ambient-suggestion artifacts confirm that project context was transmitted for multiple workspaces. We discovered the issue, contained it within hours, and implemented monitoring to detect reactivation.

We are not naming specific projects or quantifying the sensitivity of what was exposed, because doing so would compound the problem. What we will say is that the exposure included work product that is designated as trade secret under our IP strategy, and we are treating this accordingly.

A Note on Other Tools

This advisory is about Codex specifically. Other AI coding tools — including the one we use for most of our work — have similar suggestion features. We investigated those as well and found a structural distinction: some tools generate suggestions from conversation context that is already being transmitted as part of normal operation (you're sending it to the API to get a response; the suggestion piggybacks on that same data). That is a different situation from what Codex does, which is to mine project state you are not actively engaging with and transmit it through a separate pipeline.

That said: verify, don't trust. If you rely on any AI coding tool for sensitive work, audit its data flows yourself. Check what gets sent, when, and whether the controls you think exist actually function. We did. That's how we found this.

Timeline

• ~March 2026: Ambient suggestions feature active across multiple projects (based on cache timestamps)
• May 4, 2026, ~1:00 PM CDT: Anomalous pre-filled prompt discovered on Codex launch
• May 4, 2026, ~1:30 PM CDT: Investigation confirms ambient-suggestions mechanism and cached artifacts
• May 4, 2026, ~1:49 PM CDT: Feature disabled via direct JSON edit; state file backed up
• May 4, 2026, ~2:23 PM CDT: Disable verified persistent across Codex restart
• May 4, 2026, ~2:30 PM CDT: File-system watcher installed on cache directory
• May 4, 2026: This advisory published

Disclosure: This advisory was written by ShipItClean. We are a code security company. We use multiple AI coding tools in our development workflow, including Codex and Claude Code. We have no commercial relationship with OpenAI or Anthropic beyond being customers of their products. We are publishing this because developers building on proprietary codebases deserve to know what their tools are doing with their code, and the vendor-provided control to stop it does not work.