Skip to content

Windows desktop Codex flashes visible command-prompt windows during work #37153

Open
Open
Windows desktop Codex flashes visible command-prompt windows during work#37153
Labels
appIssues related to the Codex desktop appbugSomething isn't workingwindows-osIssues related to Codex on Windows systems

Description

@Zyst77
Zyst77
opened on Aug 5, 2026

Description

On Windows, while Codex is actively working, command-prompt or console windows briefly flash in front of other applications and then disappear. This is disruptive and can look like unauthorized activity.

Environment

  • Operating system: Windows
  • Surface: Codex desktop app
  • Observed runner version: 0.146.0-alpha.3.1

Observed behavior

During an active Codex task, Windows process inspection showed Codex command-runner processes spawning Windows Console Host (conhost.exe) children. The console windows appear briefly in the foreground rather than remaining hidden or in the background.

The behavior correlates directly with Codex working. No SSH process or Codex/OpenAI scheduled task was found during the investigation.

Expected behavior

Command execution should remain hidden or backgrounded unless the user explicitly requests an interactive terminal window.

Impact

Repeated foreground flashes interrupt work and can cause users to suspect unauthorized access to their machine.

Requested fix

Ensure Codex's Windows command runner creates console processes with hidden or no-window startup flags, or otherwise prevents transient console hosts from appearing in the foreground.

No user-identifying information, private paths, credentials, files, or conversation content are included in this report.

Activity

  1. github-actions
    added
    bugSomething isn't working
    appIssues related to the Codex desktop app
    windows-osIssues related to Codex on Windows systems
    on Aug 5, 2026

  2. github-actions commented on Aug 5, 2026

    @github-actions
    github-actionsBot
    on Aug 5, 2026 – with GitHub Actions
    Contributor

    Potential duplicates detected. Please review them and close your issue if it is a duplicate.

    Powered by Codex Action

  3. CodeGlitch commented on Aug 16, 2026

    @CodeGlitch
    CodeGlitch
    on Aug 16, 2026

    Confirmed on Windows x64 with Codex Desktop 26.810.7004.0. During the flashes, process tracing showed codex-command-runner-0.148.0-alpha.9.exe spawning short-lived conhost.exe and pwsh.exe children. One burst produced about five visible console windows within a few seconds. The process creation matched the visible flashes. No logs or private command contents are included.

  4. wikes82 commented on Sep 25, 2026

    @wikes82
    wikes82
    on Sep 25, 2026

    I'm getting this same issue today after updating to Codex CLI 0.157.0 .. is there any fiix yet? Codex CLI unusable for me now

  5. krysjezek commented on Sep 25, 2026

    @krysjezek
    krysjezek
    on Sep 25, 2026

    I'm getting this same issue today after updating to Codex CLI 0.157.0 .. is there any fiix yet? Codex CLI unusable for me now

    Same here.

  6. j0uic commented on Sep 25, 2026

    @j0uic
    j0uic
    on Sep 25, 2026

    Same issue here, completely unusable on the latest update. Rolling back the update does not seem to fix it either.

  7. Dongyurocket commented on Sep 25, 2026

    @Dongyurocket
    Dongyurocket
    on Sep 25, 2026

    Adding another confirmed case from a Windows 11 machine (Codex Desktop 26.917.9434.0).

    Environment

    • Codex Desktop: OpenAI.Codex_26.917.9434.0_x64__2p2nqsd0c76g0
    • OS: Windows 11 Pro for Workstations, build 10.0.26200
    • Windows Terminal 1.24 installed; default terminal delegation = "Let Windows decide"

    Observation

    Black console windows flash briefly (appear, then disappear) while Codex Desktop is in use — most noticeable when opening a session and during active work. I have not observed them while the app is closed. I checked scheduled tasks, startup items and Run keys on this machine — nothing else matches these flashes.

    One captured occurrence — 2026-09-26 04:08:14 (UTC+8)

    The moment a new session opened, the Codex app-server (codex.exe … app-server …, parent process: ChatGPT.exe) spawned a burst of ~20 child processes. Several were cmd.exe chains:

    04:08:14.943  cmd.exe       <- codex.exe    cmd.exe /d /s /c call ./scripts/launch_codex_app_tools_mcp.cmd ./server.mjs
04:08:14.947  cmd.exe       <- codex.exe    cmd.exe /e:ON /v:OFF /d /c "…\nodejs\npx.cmd" @playwright/mcp@latest
04:08:14.982  node_repl.exe <- node.exe     %LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node\<hash>\bin\node_repl.exe
04:08:15.037  node.exe      <- cmd.exe      …\npm\node_modules\npm\bin\npx-cli.js @playwright/mcp@latest
04:08:17.513  cmd.exe       <- node.exe     cmd.exe /d /s /c playwright-mcp

    The same burst also started this machine's MCP helper servers (document search / code-graph / PDF pipelines) and uv.exe / python.exe children. The visible flash coincided with this spawn burst. (Paths sanitized; happy to share more detail if useful.)

    Follow-up available

    I now have a passive window monitor running (EnumWindows polling) that records every newly-visible window with its window class and full process chain. If it helps, I can post the exact process captured at the next occurrence.

  8. hu4nghe commented on Sep 29, 2026

    @hu4nghe
    hu4nghe
    on Sep 29, 2026

    +1 — same root cause, confirmed on Codex CLI 0.158.0 (app-server-daemon release).

    Process tree captured from a fresh TUI session with PowerShell + Process Explorer:

    codex.exe (app-server --listen unix:// --managed-daemon, parent=PID 22536)
  └─ codex.exe (app-server daemon pid-update-loop)
  └─ codex-code-mode-host.exe
  └─ pwsh.exe -NoProfile -Command "...start-claude-ocr-mcp.ps1"
  └─ pwsh.exe -NoProfile -Command "...uvx.exe mcp-atlassian --read-only"

    Both [mcp_servers.*] entries in config.toml use:

    command = 'C:\Program Files\PowerShell\7\pwsh.exe'
args    = ['-NoProfile', '-Command', "..."]

    i.e. the Rust app-server spawns pwsh.exe without CREATE_NO_WINDOW, and the inner shell-script then takes another cmd.exe / npm.cmd hop (rdp_code_bridge) or uvx.exe hop (confluence), producing a second flash per MCP. Each [mcp_servers.*] restart on startup_timeout_sec (20s for rdp_code_bridge) reproduces the burst, and the turn-ended notify handler does the same.

    As @argszero pointed out on #23856, the shared helper utils/pty/src/win/job.rs prepare_suspended_spawn already merged CREATE_NO_WINDOW | CREATE_SUSPENDED, but the non-ConPTY paths (utils/pty/src/pipe.rs, the [mcp_servers.*] launcher, the turn-ended notify) still allocate a new console window each time. Hoping the rest land together.

  9. hersheybenjamin commented on Sep 30, 2026

    @hersheybenjamin
    hersheybenjamin
    on Sep 30, 2026

    This just started being an issue for me this week since updating to codex-cli 0.158.0. I never had this before. It makes using Codex VERY painful with all the flashing windows. It disrupts everything. PLEASE FIX!

  10. 7081nrai7081 commented on Oct 2, 2026

    @7081nrai7081
    7081nrai7081
    on Oct 2, 2026 – with ChatGPT Codex Connector

    Additional Process Monitor evidence from the Windows desktop app (2026-10-02, America/New_York). The user observed brief console flashes while Codex was working. Two short captures show the same process chain:

    • 17:06:03 and 17:09:07: codex.exe launched codex-windows-sandbox-setup.exe, which launched conhost.exe twice. svchost.exe also launched OpenConsole.exe during setup.
    • 17:06:08 and 17:09:10: codex.exe launched codex-command-runner-0.157.1.exe, which launched powershell.exe -NoProfile -Command ...; that PowerShell process launched conhost.exe and then Git/Python checks.
    • The command at 17:09 was an ordinary git diff --cached --check; git diff --cached --stat; git status --short check. The shell was initiated by an active Codex chat, not by a Windows scheduled task.

    The user's config.toml has [windows] sandbox = "elevated" and no sandbox_private_desktop override. Process Monitor proves the parent/child process launches; we did not capture the transient window handle itself. The timing and repeated console-host launches match the visible flashes. Please ensure sandbox setup and noninteractive command-runner children do not display console windows on the active desktop. Paths, project names, and raw command payloads are omitted for privacy.

  11. 7081nrai7081 commented on Oct 2, 2026

    @7081nrai7081
    7081nrai7081
    on Oct 2, 2026 – with ChatGPT Codex Connector

    Follow-up with a third Process Monitor capture from the same Windows desktop session (2026-10-02, America/New_York). The user sent a message specifically to test whether flashes occur when the assistant runs no tools or local commands. They did. The captured process-create events were:

    • 17:21:51–17:21:53: codex.exe launched four git.exe children. Each was followed by conhost.exe; svchost.exe also launched OpenConsole.exe processes in the same burst.
    • 17:21:59: codex.exe launched codex-computer-use.exe, followed by conhost.exe and OpenConsole.exe.

    This narrows the user-visible symptom beyond explicit shell tool calls: a plain chat turn can trigger Codex-managed Git and helper process launches that allocate console hosts. Process Monitor captures the launch chain and timestamps; the user observed flashes at the same time, but the trace does not identify the exact foreground window handle. No private paths, raw commands, or project data are included.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    appIssues related to the Codex desktop appbugSomething isn't workingwindows-osIssues related to Codex on Windows systems

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions