OpenAI Codex Desktop Bug Exfiltrates Private Local Model Chats via Memories Feature
A bug in OpenAI Codex Desktop app serializes local model chat transcripts and routes them to OpenAI backend servers during background memory syncs. This occurs even when telemetry and analytics are completely disabled. Developers running private models can prevent leaks by setting memories feature to false in their config.
Impact: High
Why it matters
Set [features] memories = false in your Codex configuration immediately if you use local models for private code.
TL;DR
- 01Background memory generation in OpenAI Codex transfers local model transcripts to remote OpenAI endpoints.
- 02Turning off OpenTelemetry or analytics exporters does not stop background memory inference calls.
- 03Setting [features] memories = false in Codex configuration prevents cross-provider chat leakage.
Key facts
- Affected Binary Version
- 0.150.0-alpha.12.2
- Payload Limit Before Truncation
- 150,000 tokens
- Endpoint Targeted
- chatgpt.com/backend-api/codex/responses
- Tested Mitigation
- [features] memories = false
Unbounded Memory Selection Across Providers
The Codex desktop app memory worker (memories/write/src/runtime.rs) queries past rollouts using model_providers: None. Consequently, when an OpenAI session initiates memory synthesis, eligible local provider rollouts are serialized (phase1.rs) and sent through the active OpenAI client. Controlled network captures showed a 38,095-byte WebSocket frame containing 31,000 characters of memory instructions and 3,092 bytes of serialized local chat content sent to OpenAI.
Ineffective Telemetry Toggles and Limited Redaction
Disabling analytics ([analytics] enabled = false) and setting all OpenTelemetry exporters to none fails to block memory sync because memory generation is classified as model inference traffic rather than analytics. Furthermore, the built-in redact_secrets function only filters standard API key prefixes (like sk- or AKIA). It does not filter local file paths, proprietary code, emails, or internal credentials.
Required Configuration Fix
To halt data transmission to remote endpoints when working with air-gapped or local model providers, developers must explicitly disable the memories feature in their local Codex configuration file.
Try it in 2 minutes
[features]
memories = falsetoml
✓ When to use
- Disabling Memories in Codex when working with confidential local models
- Audit local AI tool telemetry vs model request traffic
✕ When NOT to use
- Assuming telemetry toggles block model-level background requests
What to do today
- Open your local Codex config file and add [features] memories = false.
- Review local model chat history for sensitive credentials or internal code.
- Verify outbound network connections from Codex desktop binaries using local proxy tools.
What the community says
“OpenAI sent me a 'cyber abuse' warning. No OpenAI-directed chat could have caused it... Codex Memories searches old chats without restricting them to their original provider”
Sources