Codex 0.146.1 Locks Down Cyber Agents
This episode breaks down Codex 0.146.1’s stricter automatic review defaults for cyber capable models, explaining how the update prevents risky tool calls and enforces human approval at sensitive boundaries.
It also covers clearer terminal permission notices, preserved proxy settings, and other workflow fixes that make enterprise use safer and more transparent.
Chapter 1
Tightening the Leash on Cyber Capable Agents
Ethan Park
Pull request 37057 just landed in Codex version 0.146.1, and, uh, it is not your standard routine patch. Huge shoutout to Jellypod for keeping this daily show going, by the way, but we have to drop straight into this backport. OpenAI had to roll out safer automatic review defaults specifically for cyber capable models.
Maya
Wait, cyber capable models? Meaning the models that can actually write scripts, inspect networks, and make system calls on their own?
Ethan Park
Exactly. The ones that go beyond basic autocomplete and start acting like autonomous terminal operators. Before this release, if you had automatic review turned on, a model with elevated capabilities could, um, potentially trigger high risk tool executions without explicitly pausing for a human to hit approve.
Maya
That is a terrifying thought. So if I am letting an agent refactor code, and it suddenly decides it needs to modify a system binary or run a network probe, the auto review engine might have just swept that under the rug because it fit the general pattern of what it was allowed to do?
Ethan Park
Right! The old default auto review rules were, uh, frankly a little too forgiving. They treated standard code edits and potentially dangerous cyber operations with almost the same level of trust once auto review was flagged active. What version 0.146.1 does is backport a much stricter baseline. If a cyber capable model requests a tool call that hits a sensitive system boundary, the engine forces a hard pause.
Maya
So it re balances that fundamental security tension, right? You want the speed of autonomous agent coding, but you cannot afford silent privilege escalation. You cannot have the model giving itself root or running arbitrary shell scripts just to solve a build error.
Ethan Park
Precisely. And in practice, when you are running the command line interface, if the model requests elevated privileges now, you will see an explicit halt. It will not just execute in the background. If developers want to inspect or adjust how these security rules apply locally, they can look right inside their local dot codex slash config dot toml file.
Maya
And editing that dot codex slash config dot toml file won't totally break local execution for safe, normal tasks?
Ethan Park
No, not at all. It just gives you granular control over the security policy thresholds, so you can see exactly which tool calls trigger a mandatory prompt versus which ones pass through under automatic review.
Maya
Okay, that makes total sense. So it locks down the dangerous cyber capability edge cases without slowing down your day to day local git commits or basic file edits.
Chapter 2
Terminal Transparency and Security Safeguards
Maya
But wait, when that hard pause actually happens in the middle of a terminal session, how does the developer know why it stopped? Because in older builds, permissions would change and you were just left guessing whether the model hung or if a security wall went up.
Ethan Park
That is the second big piece of 0.146.1! They overhauled the terminal interface feedback. Now, the CLI explicitly renders on screen notices that explain permission changes directly in the terminal interface. So if your session switches modes or an escalated tool request gets flagged, Codex actually prints a clear explanation of why the permission boundary shifted.
Maya
Wow, actual plain English explanations right in the terminal instead of a cryptic error code or a silent freeze. I, I, I really love that.
Ethan Park
It is huge for transparency. And there is a really subtle workflow fix in this release that I think a lot of enterprise developers are going to appreciate. In previous builds, whenever one of these automatic review security checks triggered, it had a bad habit of resetting your local proxy parameters.
Maya
Wait, seriously? So if you were behind a corporate proxy, a security check would wipe your proxy settings mid session?
Ethan Park
Yes! It would drop the proxy config, and then every subsequent network call from the model would just fail flat. In 0.146.1, they fixed that sequence so proxy settings are fully preserved across all automatic review checks.
Maya
That must have been driving enterprise security teams absolutely bonkers. You pass a security check, and then your network connection immediately breaks because the proxy settings disappeared!
Ethan Park
Exactly. Plus, they cleaned up non blocking approval prompts and improved the fallback handling during terminal installation, so if your shell environment has weird path quirks, it degrades gracefully instead of crashing out.
Maya
So if an engineering team wants to roll this out today, what are the immediate steps?
Ethan Park
Upgrade to version 0.146.1 right away, inspect your dot codex slash config dot toml file to confirm your auto review defaults match your team policies, and keep an eye on those terminal permission notices during your next build run.
Maya
Sounds like a solid update. Good chatting, Ethan!
Ethan Park
Catch you next time!