Codex CLI Runs a Background Daemon by Default Since 0.157.0, and Users Report It Pins Your First Session's Environment

Our verdict

Check your machines today. Since Codex CLI 0.157.0, released on 25 September, eligible interactive sessions start a background server by default, and no stable release since has made that opt-in, including 0.164.0 on 23 October. Users report the process outlives the terminal and keeps the environment of the first session that started it, credentials and proxy settings included.

Our OpenAI Codex verdict stays recommended: this is a default to turn off where it matters, not a reason to drop the tool. We have not reproduced the behaviour ourselves; the environment and updater details below are user reports, not OpenAI statements.

What happened

What OpenAI shipped

The 0.157.0 release notes say: "Enabled automatic background-server startup for eligible interactive sessions, with recovery choices when server settings are incompatible. (#47179, #47318)". The pull request list names it plainly: "#47179 Enable automatic daemon startup by default".

The releases since adjust the daemon without turning auto-start off:

• 0.162.0 (8 October): "#50555 Skip daemon auto-start for Windows-mounted WSL homes" and "#50559 Distinguish daemon release identity from executable contents".
• 0.162.1 (9 October): a patch release with no change to the default.
• 0.164.0 (23 October), the current stable: "Prune unused app-server daemon releases safely", "Support daemon installation from Windows WinGet packages", and bounded daemon logs. None of it makes auto-start opt-in.

What users report

These points come from GitHub issue #48195, opened on 25 September and still open when we read it on 27 October. We found no reply from OpenAI staff in the thread.

The issue author, on 0.157.0, reports that the daemon:

• keeps running after every Codex window is closed, reparented to PID 1;
• copies about 374 MB of platform files into ~/.codex/packages/app-server-daemon/releases/<version>/;
• starts an updater that checks for releases 5 minutes after start and then hourly, downloads them and restarts the backend;
• pins the environment of whichever session started it, including proxy variables such as HTTPS_PROXY.

The issue author describes the trigger: they launch Codex through a wrapper that sets HTTPS_PROXY per invocation, and the daemon keeps the first session's proxy variables.

Why it matters

• Credential bleed between sessions. If you set tokens or proxies per invocation or per project, a later Codex session can run with the values of the session that started the daemon, as the issue author reports for HTTPS_PROXY.
• Version drift. A binary that updates itself hourly sits outside whatever version your package manager or lockfile pins.
• Undocumented switch. A commenter notes that the daemon_auto_start key is absent from the official configuration reference, so the off switch is not something you will find by reading the docs.

What changes for you

The opt-out below is what the issue author reports, not an OpenAI instruction.

codex features disable daemon_auto_start
# or, in ~/.codex/config.toml:
# daemon_auto_start = false
codex app-server daemon stop
pkill -f 'app-server daemon pid-update-loop'

The issue author reports that codex app-server daemon stop alone leaves the updater process (pid-update-loop) running, which is why the pkill line is there. Check the process list afterwards. The same author also removes ~/.codex/packages/app-server-daemon to reclaim the copied files.

If you rely on a single global environment and do not pin Codex versions, the default is less risky, but you should still know the process is there.

FAQ

Is Codex sending my tokens somewhere? Nothing in the issue claims that. The reported problem is that the daemon reuses the first session's environment for later sessions, so the wrong project's credentials can be in scope.

Has OpenAI acknowledged the issue? Not in the thread as of 27 October. The releases since 0.157.0 refine the daemon (WSL handling, pruning, log limits) but keep auto-start on by default.