[Windows] Codex browser interactions falsely report user denial regardless of site; other ChatGPT workflows work #50153

Summary

Codex-specific browser-control failure on Windows: the affected user reports that any browser interaction through Codex can fail with a false user-denial error, regardless of the website. The site/domain is irrelevant to the reported scope. This is not a Facebook, ClickCease, CarsXE, or individual-site access problem.

The user states that no permission prompt appears and they did not deny permission. Codex nevertheless reports:

Browser Use rejected this action due to browser security policy. Reason: The user declined permission for this action.

The rejection then asserts that the user denied access and prohibits workarounds or alternate browser surfaces, so the agent must stop that browser task.

Only Codex is affected in the user's reported experience. Other ChatGPT workflows, including the ChatGPT desktop app and ChatGPT Chrome extension, work. The mention of "Codex Desktop" below identifies the affected Codex client; it does not mean that the separate ChatGPT desktop app is affected.

Scope clarification — October 2, 2026

The original report framed this too narrowly as rejection of a new site after successful access. The user explicitly corrected that framing: the failure concerns browser interaction through Codex generally, not particular sites. They report that the failure repeatedly produces the same false "you denied" attribution. Earlier successful browser operations are historical observations, not a domain-specific boundary or evidence of an actual denial.

Environment

• Windows; Codex installed package version: 26.928.2636.0 (observed October 1, 2026; current version not rechecked).
• Bundled computer-use plugin exposed in the original task: 26.928.21956.
• Task permissions in the original report: approval_policy = never, sandbox_mode = danger-full-access.
• Chrome browser control through the supported cua API.
• Newly observed/recurrent around September 30–October 1, 2026. Exact onset/build transition unknown.
• User reports a recent Windows update; causal connection unknown.

Evidence

• Earlier Codex sessions had successful browser operations followed by false-denial failures. Several unrelated sites were involved; their names do not define the bug's scope.
• On October 2, another authorized provider-billing browser task failed at cua.createBrowserTab with the same rejection before page access.
• That rejection explicitly said both "The user declined permission for this action" and "the user denied permission for this request."
• The user states that neither occurred and no permission prompt appeared.
• The tool instructed the agent not to attempt workarounds, indirect execution, raw CDP, alternate browser surfaces, or policy circumvention. The agent honored that restriction.
• The user reports that other ChatGPT workflows continue to work, including the desktop app and Chrome extension.
• Earlier restarts were discussed as possible recovery attempts; which restart, if any, resolves the failure is not established.

Expected

Authorized browser interaction through Codex should work or present an actionable permission prompt. A failure without a user decision must not be labeled as a user denial. Browser control should remain reliable across tasks and sites.

Investigation requested

Investigate the Codex browser-control/permission path generally, without narrowing the investigation to an individual site or origin. Trace whether a permission elicitation is emitted, whether it is displayed, and which component supplies the decline result. Distinguish transport/session, lifecycle, stale-policy, or missing/canceled approval failures from an actual user decision. Compare the affected Codex path with the independently working ChatGPT desktop and Chrome-extension workflows. Please provide a supported recovery path and diagnostic guidance.

Limits

The broader scope and unaffected ChatGPT workflows are firsthand user reports; this issue does not claim an exhaustive automated reproduction on every site or browser API. Root cause and the regression-introducing version are not established. No policy bypass was attempted. Raw logs, customer data, account identifiers, and credentials are excluded.