Codex CLI quietly starts a self-updating background daemon

Since version 0.157.0, OpenAI's Codex CLI does something it does not tell you about. Starting an interactive codex session launches a background daemon, codex app-server --managed-daemon, that keeps running after you close every Codex window and stays up until you reboot or stop it by hand. A GitHub issue documenting this has drawn broad agreement, with individual comments collecting well over a dozen upvotes and several people calling the behavior malware-like.

The specifics are what unsettle people. The CLI copies about 374 MB of its platform package into ~/.codex/packages/ and runs the backend from there, so the running version is decoupled from the one npm installed. A detached updater checks for new versions five minutes after start and then every hour, swapping the backend out underneath you, which can interrupt a turn in progress. The daemon also inherits the environment of whatever session first started it, so proxy settings, the working directory, and secrets like GH_TOKEN from one project can follow it into later sessions in another. And daemon stop does not stop the updater loop, so the clean fix is to set daemon_auto_start = false, stop the daemon, kill the loop, and delete the package directory.

The opt-out exists but is missing from the config reference, and the 0.157.0 release notes never mention the persistent process or the updater. No maintainer has replied in the thread, though a third-party Nix package has already flipped the default off.

Why it matters

If you run Codex CLI, assume a background process is live and self-updating right now unless you have set daemon_auto_start = false. The environment inheritance is the real risk: a token loaded for one repository can quietly follow the daemon into work on another.