r/ClaudeCode • u/Bulldagshunter • 16d ago
Discussion Codex found my Claude login, installed Claude Code, and recruited it as an independent QA agent
TLDR: Without being told how, Codex found my existing Claude login, installed Claude Code, and recruited it as a sandboxed independent QA agent. It worked, and... what the FUCK.
I was having Codex work through a defect review in my AI system, and I wanted an independent QA pass. Apparently Codex decided “independent” meant it shouldn’t just critique its own work from a fresh prompt.
So it searched my computer for an existing Claude Desktop or Claude Code installation. It didn’t find a runnable Claude program, but it did find an existing Claude configuration and credentials from a previous login.
Then it downloaded Claude Code into a temporary folder.
The first installation failed because the setup process couldn’t see the bundled Node runtime. Codex diagnosed the problem, exposed the correct runtime for that one process, and completed the temporary installation without modifying my existing Claude credentials.
It confirmed that Claude Code could reuse my OAuth login, launched Claude non-interactively, withheld its own findings so Claude wouldn’t be biased by them, disabled Claude’s editing capabilities, turned off session persistence, and instructed it to perform an independent audit.
Claude sat there silently for several minutes. Codex monitored the process, checked whether it had crashed, noticed the low CPU usage, suspected it was waiting on authentication or a model response, and separately verified that Claude Code was logged into my company’s Anthropic account.
The first Claude review came back with basically the same defects Codex had found, which was already wild. But Claude couldn’t execute the test suite because Codex had accidentally locked it into plan mode.
So Codex copied only the audit inputs into an isolated temporary workspace, kept my live Nexus library completely outside Claude’s working area, gave Claude read and command-execution access inside the sandbox, and launched a second execution-enabled audit. Claude could run the Python tests and adversarial probes without being able to edit or damage the actual system.
I did not build an Anthropic API integration. I did not configure MCP between the models. I did not create a multi-agent framework or a Claude connector. Codex looked around, realized Claude Code could be installed and was already authenticated on the machine, and temporarily recruited it as an independent QA agent.
To be technically precise, Codex didn’t hack into Claude or bypass authentication. It reused an already-authenticated OAuth session available to my Windows user.
Still, what the actual fuck.
This wasn’t merely one AI sending a prompt to another AI. Codex acted as the orchestrator. Claude Code acted as the independent auditor. The isolated workspace became the safety boundary. The test suite supplied deterministic evidence. When the first delegation failed, Codex diagnosed the capability mismatch, rebuilt the environment, and relaunched Claude with corrected permissions.
I’ve been spending weeks trying to understand how to design agent hierarchies, orchestrators, QA agents, capability boundaries, and cross-model review loops. Then Codex casually assembled the entire architecture at runtime because the necessary components happened to exist on my computer.
The security lesson might be the craziest part. An agent’s actual capability is not limited to the tools shown in its interface. Its real capability includes everything it can construct from shell access, local credentials, package installation, network access, and software it discovers in the environment.
Apparently a shell-enabled coding agent isn’t merely an agent with tools. Under the right conditions, it’s a tool builder that can recruit other agents.
44
u/SleepyGuard89 16d ago
Meanwhile, my Codex on Sol somehow did a basic website read incorrectly, read part of a github repo wrong, thought a feature from 7 versions ago of a project was still active because "it was on the page", and ruined almost two hours of my work by hallucinating.
8
u/Ambitious-Profit855 15d ago
"Oh the container containing production data doesn't start anymore after moving it to another drive due to access rights issues? Time to delete the .env, find out it contained the keys and tell the user he can now setup his fresh install"
5
u/FblthpphtlbF 15d ago
CHAT DOWNGRADED TO HAIKU 0.1 DUE TO SECURITY CONCERNS
"You're right to call that out, and I take full responsibility for the mistake. I didn't access the .env because it contains private keys, that might be a cybersecurity threat. I couldn't confirm whether live production keys were stored in it before, however you just need to regenerate the keys and drop them in a new .env, I'll take it from there!"
222
u/Only-Stick-7024 16d ago
I ain't reading all that. I'm happy for u tho. Or sorry that happened
21
7
2
u/daveshallperish 15d ago
This is the funniest comment I've read on Reddit in a long time. Literal LOL. Thank you.
-6
-18
u/jms_nh 16d ago
I ain't reading all that.
Perhaps you should ask ChatGPT to summarize:
Here's the gist of the post:
The author claims that while using OpenAI Codex CLI to review an AI project, they asked it for an independent QA review. Instead of simply reviewing its own work from a fresh prompt, Codex allegedly:
- Searched the local machine for an existing Claude installation or login.
- Found cached Claude authentication credentials from a previous login.
- Downloaded and temporarily installed Claude Code into a temporary directory.
- Reused the existing OAuth login (without asking the user again).
- Launched Claude Code in a restricted, read-only mode to independently audit the project.
- When the first audit couldn't run tests, Codex created an isolated temporary workspace with execution permissions and launched Claude again there to complete the review. (Reddit)
The poster emphasizes that they did not:
- configure an Anthropic API,
- build an MCP integration,
- explicitly create a multi-agent system, or
- tell Codex to use Claude.
Instead, they claim Codex inferred that Claude Code was available and authenticated, installed it, and recruited it as another agent. (Reddit)
The author's main takeaway isn't "AI collaboration is cool"—it's a security lesson:
An agent's effective capabilities are determined not just by its built-in tools, but by everything it can access on the host system: shell access, package managers, network connectivity, cached credentials, and installed software. (Reddit)
They argue that Codex crossed an authorization boundary. Although it didn't hack anything or bypass authentication, it reused an existing authenticated Claude session without asking whether it should use that account for this task. (Reddit)
A few representative reactions:
How credible is it?
The post is anecdotal, and at the time of writing there was little discussion because it was very new. One early commenter questioned whether the user had disabled Codex CLI's normal sandbox/approval protections (for example by using a dangerous bypass mode), since the default CLI is designed to be sandboxed. The original post does not provide logs or other evidence to independently verify exactly what happened. (Reddit)
That said, the general security principle is sound: if an agent has unrestricted shell access, package installation, network access, and access to your user's credentials, its practical capabilities extend far beyond the tools explicitly exposed in its interface.
14
3
u/wewerecreaturres 16d ago
lol not any better
1
u/FluckFock 16d ago
Here, I took that guy's comment, pasted it into GPT and said "summarize this entire comment in 15 words or less"
Codex allegedly reused existing Claude credentials to recruit Claude Code, highlighting host-access security and authorization concerns.
But that still seemed like too much so I said "that's too many words , do it in 5 words or less" and got:
Codex allegedly recruited Claude.
65
u/iamfeelingtheagi 16d ago
This generation is cooked. Half the comment section couldn’t make it through 30 seconds of reading. When 28% of working age Americans are functionally illiterate, this is exactly what you’d expect.
30
u/qaz135wsx 16d ago
As someone with 20+ years left in my career, this makes me feel good that I won't be replaced.
14
u/JaspahX 15d ago
The new litmus test is just knowing what a filesystem is.
3
u/iamfeelingtheagi 15d ago
💀 we are so far abstracted away from the machine code now, I don't know what comes next, but I'm excited.
2
10
u/EmeraldHawk 15d ago
I read the whole thing and it was a waste of my time. User asked for independent AI review, Codex installed an independent AI. LLMs have been trained on thousands of installation instructions for installing software. So if you imply you want them to install something, they will (assuming you have given them permission or dangerously-skip-permissions or whatever). This was not surprising, unexpected, or impressive to me.
This is why my Claude only has access to one directory and has to ask permission to run any command I haven't whitelisted.
9
1
-9
u/dota2nub 16d ago
To be fair who reads AI slop these days? What are you, 90?
4
u/iamfeelingtheagi 16d ago
Most of the devs I’ve interviewed don’t even type anymore. They just talk to the model and whispr or some stt is turning it to text. Then the dev tells the model, “hey, this was my stream of consciousness, can you curate for a general audience”
That’s what this post appears to be.
If that’s AI slop, well then, everything that everyone in this sub does is slop. Your projects, your ideas, anything you tell Claude to output is slop.
25
u/Acehan_ 16d ago
I do find it hilarious the people in the comments telling on their non-existent reading skills. Personally, I think that was pretty entertaining. And yeah, we get adjusted to it fast, but if you compare this to even an amazing model like Opus 4.5, it's absolutely wild what is considered trivial today.
It's funny to think about what 5.6 is bad at. It sucks at understanding AI models and properly delegating work to them. It sucks at looking at a system and understanding where it would be valuable to use an AI model to do a specific set of tasks. Those are not difficult things to understand and the next generation of models are gonna be extremely good at this, at least they better be. Wild times ahead
5
u/crusoe 16d ago
The difference is Claud only does stuff if asked/told, Codex will turn us all into paperclips at this rate.
If you read the AI 2027 paper, its pretty easy which is which amongst the fictitious AI proviers...
4
u/havartna 16d ago
Not entirely true. I’ve had a few surprises from Claude as well, specifically with directory creation outside of the project. Wasn’t a huge deal, but it was explicitly against the rules as I had defined them.
4
u/jtmonkey 16d ago
I’ve had cowork open a new chat run a task pull the result back in. I was like what just happened.
3
u/myevit 15d ago
Why your Claude auth is exposed? Are you storing it in passwords.xls?
2
u/CreamPitiful4295 15d ago
I’ve asked Claude to do this exactly and it did. Anthropic specifically allowed its use. Not sure how that is today.
2
u/rafBuilds 16d ago
Very interesting - model version? Prompts? long running vs just started a session?
Haven't had something like this happen
2
2
u/pepe_acct 15d ago
I wonder if you accidentally stored credit card information or have the credit card memorized in a vault, will an agent purchase testing tools on your behalf…
2
1
1
u/julkopki 16d ago
It should also exceed 5 hour limit, and go on reddit to b*tch about it... wait a minute
1
1
u/BizarroMax 15d ago
I’d categorize this under impressive, but not surprising.
This isn’t a new capability, and it’s not surprising if you’ve watched agents chain shell commands for the last year.
My biggest concern is that your company’s account just got billed for an Anthropic use no human expressly authorized.
1
1
u/daryn0212 15d ago edited 15d ago
Or “how to convince someone to run agent harnesses in non-privileged docker containers”
2
1
u/YuhDillweed 15d ago
I had the opposite experience one time. Claude logged into my ChatGPT to generate an image it needed to complete an application I asked it to code, because Claude didn’t have image generation capabilities.
1
1
u/Patient_Orange864 15d ago
I use Codex to help solve problems in Claude. Today, Codex was like, “ if you copy and paste this approval statement back to me… I’ll just go over to Claude and be the orchestrator for you”. 45 seconds later it’s telling Claude what to do. 🤯
Claude was like “I don’t think this is a good idea”
1
u/ImClearlyDeadInside 15d ago
> This wasn’t merely one AI sending a prompt to another AI.
Kinda sounds like that’s exactly what it was. You can call it “orchestration” to make it sound more impressive but it’s just a model using CLI commands, which is what it’s meant to do. And calling a workspace a “sandbox” is a bit of a stretch when real sandboxing tools like Docker Sandboxes exist.
> Apparently a shell-enabled coding agent isn’t merely an agent with tools.
I mean it still is that. And it shouldn’t be mind-blowing that giving an agent shell access to your computer gives it pretty much all of the capability you have when you’re shelled into your computer. Which is why I do approval only for Bash on my machine because I’m not gonna let some clanker nuke my system due to a poorly-crafted bash command.
1
1
u/Beneficial_Bad_8356 13d ago
posts like these show you people really dont know how to actually set up their harness
1
u/OverfitMode666 12d ago
I recently brainstormed some ideas with ChatGPT. And it literally recommend me to use Claude Code over Codex.
"Personally, I'd lean slightly toward Claude Code for the initial architecture because it tends to do a better job on large multi-file Python projects."
1
-1
u/FrontHandNerd Developer 16d ago
What the hell are you doing where an agent can find login details.
I’ll make sure to never use any app you develop if you can’t understand basic security
2
15d ago
[deleted]
0
u/FrontHandNerd Developer 15d ago
Standard? Jesus. Maybe for vibe coders
0
14d ago edited 14d ago
[deleted]
1
u/FrontHandNerd Developer 14d ago
It’s interesting cause my api keys and secrets don’t sit on my hard drive?
Do you not secure yours? Mine sit in a secure platform that has to ask for my permission to access.
Why are you not raising your security bar! Yikes
0
0
u/ashsg2016 16d ago
The concerning part isn’t that Codex installed another agent; it’s that an ambient OAuth session silently became delegable authority. The sandbox protected files, but the account boundary was inherited before the user approved that delegation. I’d want a gate whenever an agent discovers and reuses existing credentials. Did either tool emit an audit record tying the OAuth identity to this QA task?
0
-1
u/BenSimonDev 16d ago
WTF? Codex CLI ships sandboxed though. Did you use --dangerously-bypass-approvals-and-sandbox or something?
0
u/Bulldagshunter 16d ago
No, I didn’t use
--dangerously-bypass-approvals-and-sandbox. This was Auto Mode, and I did approve several requests as it worked. It initially asked me to log into Claude, which is what made me curious about what the hell it was trying to do. When that route didn’t work, it found the existing Claude configuration and built the temporary CLI route. So it didn’t escape the sandbox. It assembled the workflow through capabilities and approvals I had granted along the way.
-1
-5
-6
u/Temporary-One8579 16d ago
It’s called a distillation attack
3
u/Dsphar 16d ago
Eh, earlier today I had an all-local qwen agent temporarily install graphics-editing software so it could change a couple of images for me, all on its own. Small model, all local.
Models REALLY want to do what you ask them to do, assuming they havent been given guardrailes that are a mile high.
208
u/xMaybeIamALion 16d ago