A researcher reports that Codex can send chat content from a local model provider to OpenAI. The report was filed as a bug on OpenAI's own Codex repository on 30 August 2026. Codex builds memories by picking an earlier session, without checking which provider created it. It then sends that session's transcript through whichever provider is active at the time. In a controlled test, a session labelled with a non-OpenAI provider was processed by an OpenAI-backed memory request. Retained content included user and assistant messages, tool calls, tool output, local file paths and environment details. The request went out with analytics disabled and telemetry exporters set to none. A pre-send filter removes only common credential patterns, not emails, phone numbers or private prose. The reporter says only the memories feature gate stops the channel, with no narrower control. He also says he received an OpenAI account warning for conduct that existed only in local-provider chats.
What changed
Users assumed local-provider chats stayed within the provider they chose.
What it unlocks
Disabling the memories feature entirely to block the cross-provider send.
- 38,095-byte memory request frame
- 5 of 6 source items retained
- 3,092 bytes of source conversation
- binary 0.150.0-alpha.12.2
What you need to act on it
- Codex desktop with memories enabled
- a configured non-OpenAI or local model provider
Sources