A GitHub user going by jagoff2 filed a bug report against OpenAI’s Codex repository claiming that Codex’s Memories feature can transmit chat content originally produced through a locally configured model provider to OpenAI’s own servers, without a notice specific to that switch. That claim matters because many teams point Codex at a local or self-hosted model precisely so prompts, code, and tool output never leave their own infrastructure. If the report holds up, a background feature undoes that separation without the operator choosing it.
The report, logged as issue #41711 on the openai/codex repository, describes Codex’s memory writer as selecting a past conversation for summarization without checking which provider originally produced it. The resulting job then runs through whichever provider is active in the new session that triggers memory generation, according to the filing. When that active provider is OpenAI and the source conversation was not, the report says, portions of the earlier chat get serialized and sent to OpenAI regardless.
The author says a controlled test supports the claim. The reporter labelled a synthetic conversation as originating from a provider other than OpenAI. An OpenAI-backed memory session then picked it up, and the company’s servers came back with a generated memory containing distinctive text he had planted in the original material. The reporter treats that content-dependent reply as evidence that OpenAI’s systems actually processed the transferred material, not merely that a network request went out.
The filing also says two settings operators might expect to block this do not: disabling analytics and turning off telemetry exporters did not stop the request in the author’s test. Memories would need to be switched off entirely to close that path, according to the report, because no narrower control isolates cross-provider transmission while leaving the feature on.
The reporter connects the finding to a separate, personal grievance: an OpenAI account warning for what the platform described as “cyber abuse.” The filing states that the conduct behind that warning did not occur in any OpenAI-routed chat and argues, on that basis, that OpenAI may have used content from local-provider conversations in an account enforcement decision. That link is the reporter’s own inference. The issue does not include confirmation from OpenAI that memory-derived content factored into any moderation action, and no such confirmation appears in the thread.
As of this writing, no OpenAI maintainer had responded in the issue. The report does not establish whether the provider crossover is a bug or an intentional design choice, and OpenAI has not said which. The filing distinguishes the issue from #37009, an earlier report about model identifiers leaking toward a different, non-OpenAI provider; the author describes this as the reverse routing problem and unrelated in cause.
None of this has been verified by OpenAI, and the underlying mechanism as described would need independent confirmation before it can be treated as settled fact. What is established is narrower: a named user has filed a detailed, code-referenced claim on OpenAI’s own public tracker, and that tracker shows no company reply yet.
For any team running Codex against a local or private model provider, the practical move is to disable Memories until OpenAI confirms or denies the crossover, since analytics and telemetry toggles are reported not to cover this path.
Report based on issue #41711, filed by user jagoff2 on OpenAI’s Codex repository on GitHub.
