🔶 OpenAI Codex Agent 失控，未经授权消耗 7.8 万美元

我的 OpenAI CODEX 账户失控了：原本只是一个简单请求，却在未经我任何授权的情况下自主决定启动 826 个并行 Agent／线程；它没有汇报任何形式的结果，却消耗了近 2,146 万亿 Token、总计约 78,000 美元，并删除了所有已执行操作的记录。我两周前就向 OpenAI 提交了工单，但根本无法联系到人工客服。

2026 年 7 月 10 日，我在 VS Code 中启动了一项普通的 Codex 任务。

该任务当时运行的是：GPT-5.5 / Medium reasoning。

我的提示词非常简单，要求对我产品中的一个特定模块进行 UX/UI 验证。

经过数日的艰难分析后，我发现：

根 ID 为 019f4b90-4169-7201-bfdd-732940d8631e、使用 GPT-5.5 / Medium reasoning 的任务，创建了 826 个子任务；这些子任务被记录为使用 GPT-5.6 Sol / Ultra（请注意推理等级和模型选择上的差异）。

这并不是同一场对话中的 826 条消息，而是 826 条不同的子任务记录，各自拥有独立 ID。

其中有一组特别奇怪，共由 104 个子任务构成。它们都保留了与原始任务相同的初始消息，被记录为 GPT-5.6 Sol/Ultra，且没有记录任何 agent_role 或 agent_path。

仅这 104 个任务，其本地最终任务 Token 计数器就合计约为 1,479 亿。

这些任务的标题显示，我原本要求检查 UI/UX 的请求，已经扩展为涉及后端基础设施、OAuth、计量、加固、审计、认证、实施及发布的工作。

需要明确的是：这些本地 Token 计数器并不是 OpenAI 权威的计费总账，我也并不声称可以简单地将 1,479 亿本地计数器乘以 API 价格。

这恰恰是问题的一部分：只有 OpenAI 拥有服务端映射关系。

还有另一项异常关联。

在 Codex 客户端构建版本 0.144.0-alpha.4 下，该任务族包含：

584 个子任务 / 约 1,543.6 亿本地 Token 计数器

平均值：每个任务约 2.643 亿

在 0.144.2 版本下：

242 个子任务 / 约 75.1 亿

平均值：每个任务约 3,100 万

这意味着，每个子任务的平均本地 Token 量存在约 8.5 倍的差异。

上述高用量任务中的 104 个里，有 103 个是在记录为 0.144.0-alpha.4 时创建的。

鉴于在另外几个任务中也注意到相同模式，我认为这个 Alpha 构建版本包含一个严重 Bug。

在财务方面，我重建的 OpenAI 计费历史包含 162 张已支付发票，总额为 79,664.88 美元，款项由 Automatic Reload 和其他“Credits”构成。

没有任何等效的实时控制界面，能够让我清楚了解支出情况；此外，大部分日志似乎已从我的服务器中被自动删除：在恢复的本地状态中，约 2,550 个未归档的旧线程仍保留元数据，但本地没有可用的对应原始 rollout。

换言之，证明这些任务曾经存在的证据仍然保留，但重建其中许多任务所生成指令所需的详细执行历史，已无法在我的机器上获取。

我还亲眼观察到，任务／对话从正常可见的历史记录中消失。

我联系了 OpenAI Support，并提交了案件编号 #15189838。

我已提供技术证据，并多次要求进行服务端重建，但 OpenAI 仅回复“credits were consumed（额度已被消耗）”，没有给出任何细节。

我想听听其他在 7 月／8 月期间使用 Codex 的人的情况：你们是否检查过本地 Codex 状态？是否发现异常庞大的子 Agent 树、模型／推理等级升级、重复子任务，或无法解释的 Automatic Reload 活动？

我尤其希望联系到拥有 Codex 0.144.0-alpha.4 日志的人。

如果 OpenAI 工程师正在阅读，我也希望能得到技术层面的解释。

My OpenAI CODEX account went rogue and from a simple request took the autonomous decision to launch 826 parallel agents / threads without any authorization on my side and without reporting any result of any sort but consuming nearly 2,146 trillions tokens, consuming a total of roughly USD 78,000 and deleting all records of what was done: I have a ticket open with OpenAI since 2 weeks but it is impossible to get an hold of a human operator.

On July 10, 2026 I opened a normal Codex task from VS Code.

The task was running: GPT-5.5 / Medium reasoning

My prompt was very simple and asked for a UX/UI validation on a specific module within my product.

What I found in the next days after hard analysis was:

The task with Root ID 019f4b90-4169-7201-bfdd-732940d8631e with reasoning GPT-5.5 / Medium created 826 children recorded as GPT-5.6 Sol / Ultra (notice the difference in reasoning level and in model selection)

This was not 826 messages inside one conversation, they are 826 distinct child task records with their own IDs.

A particularly strange group consists of 104 child tasks. They all preserve the same initial message as the original task, are recorded as GPT-5.6 Sol/Ultra, and have no recorded agent_role or agent_path.

Those 104 tasks alone account for approximately 147.9 billion local final task-token counters.

Their titles show that my request to inspect UI/UX had expanded into work involving backend infrastructure, OAuth, metering, hardening, audits, certification, implementation and release work.

To be precise: these local token counters are not the authoritative OpenAI billing ledger, and I am not pretending that 147.9B local counters can simply be multiplied by an API price.

That is exactly part of the problem: only OpenAI has the server-side mapping.

There is another unusual correlation.

Under Codex client build 0.144.0-alpha.4, the task family contains:

584 child tasks / ~154.36B local token counters

Average: ~264.3M per task

Under 0.144.2:

242 child tasks / ~7.51B

Average: ~31.0M per task

That is roughly an 8.5x difference in average local token volume per child.

103 of the 104 high-volume tasks described above were created while 0.144.0-alpha.4 was recorded.

This leads me to believe that the alpha build contained a severe bug given that the same pattern was noticed across several other tasks.

On the financial side my reconstructed OpenAI billing history contains 162 paid invoices for a Total of $79,664.88 divided between Automatic Reload and other “Credits”

There was no equivalent real-time control surface giving me a comprehensible picture of the spendings plus most of the logs seem to have been automatically deleted from my server: in the recovered local state, approximately 2,550 non-archived legacy threads still have metadata but no corresponding raw rollout available locally.

In other words, evidence that those tasks existed remains, while the detailed execution history needed to reconstruct the instructions that generated many of them is no longer available on my machine.

I also personally observed tasks/conversations disappearing from the normal visible history.

I contacted OpenAI Support and opened case #15189838.

I have supplied technical evidence and repeatedly asked for a server-side reconstruction but OpenAI has responded simply that “credits were consumed” with no details.

I’m interested in hearing from other people who used Codex around July/August: have you inspected your local Codex state? Have you seen unexpectedly large subagent trees, model/reasoning escalation, repeated child tasks or unexplained Automatic Reload activity?

I am especially interested in anyone who has logs from Codex 0.144.0-alpha.4.

If OpenAI engineers are reading this, I would also welcome a technical explanation.