OpenAI Codex CLI quietly installs self-updating daemon
Original: Codex CLI installs a persistent, self-updating background daemon by default
Why This Matters
Silent auto-update daemons in dev tools raise supply-chain and audit concerns at scale.
OpenAI's Codex CLI v0.157.0 silently starts a persistent background daemon on every session, copies ~374 MB to disk, and runs an hourly auto-updater — all without user consent, per a GitHub issue filed Sept 25, 2026.
A GitHub issue (#48195) filed against OpenAI's open-source Codex CLI reveals that since version 0.157.0, simply opening an interactive session triggers three undisclosed behaviors: it spawns a persistent background daemon (`codex app-server --managed-daemon`) that survives session closure by reparenting to PID 1; it copies ~374 MB of platform packages (including `codex`, `codex-code-mode-host`, and bundled `bwrap`/`zsh`/`rg`) into `~/.codex/packages/app-server-daemon/releases/<version>/`; and it starts a detached updater process that checks for new releases 5 minutes after launch, then hourly, downloads them, and restarts the backend automatically. The result: the daemon's version becomes decoupled from whatever the user installed via their package manager. The reporter, using Linux (WSL2) via npm, argues that `daemon_auto_start` should default to `false`, or at minimum prompt the user once before activating. The issue is tagged as an enhancement request. No official OpenAI response was present at time of writing.