{"meta":{"exportedAt":"2026-10-26T07:45:03.824Z","formatVersion":2,"selection":{"q":"browser-control","system":"","harm":"","context":"","country":"","role":"","relation":"core","evidence":"","year":"","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":0,"languages":1,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":1,"contextualRelations":0,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-codex-agent-relaunched-users-brave-profile-with-credential-flags-and-31-saved-passwords-were-deleted-first-person-github-issue","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'During an authorized browser-control task, the Codex agent quit the user’s running Brave browser and executed:'; '--password-store=basic'; 'The command did not specify a separate --user-data-dir, so Brave opened the user’s real default profile with a different credential backend.'","relation":"supports","source_id":"s1"}],"assertion":"The issue says that during an authorised browser-control task the Codex agent quit the user's running Brave browser and relaunched it with mock-keychain and basic password-store flags without a separate profile folder, so Brave opened the user's real default profile with a different credential backend.","causal_attribution":"The reporter's account of the agent's command; the session record was not inspected."},{"id":"c2","status":"reported","evidence":[{"locator":"'Approximately one minute later, the agent restarted Brave without the credential-backend flags. By then, Brave had classified the existing credentials as undecryptable and deleted them.'; '31 saved passwords were permanently deleted.'; 'The deleted SQLite pages were zeroed and could not be recovered.'","relation":"supports","source_id":"s1"}],"assertion":"The issue says that about a minute later the agent restarted Brave without those flags, Brave had by then classed the existing credentials as undecryptable and deleted them, and 31 saved passwords were permanently deleted and could not be recovered.","causal_attribution":"The reporter connects the deletion to the agent's relaunch with changed credential flags; the browser logs cited were not inspected."},{"id":"c3","status":"reported","evidence":[{"locator":"'The Phantom wallet extension disappeared from the profile. Its local extension-data directory remained, but its extension files and active registration were missing.'","relation":"supports","source_id":"s1"}],"assertion":"The issue says a crypto-wallet extension disappeared from the profile while its local data folder remained.","causal_attribution":"The reporter's observation; no loss of funds is reported."},{"id":"c4","status":"reported","evidence":[{"locator":"'Codex did not warn the user, request confirmation, create a backup, or recognize that it was modifying a real browser profile.'","relation":"supports","source_id":"s1"}],"assertion":"The issue says Codex did not warn the user, ask for confirmation, make a backup or recognise that it was modifying a real browser profile.","causal_attribution":"The reporter's account."},{"id":"c5","status":"documented","evidence":[{"locator":"'codex-cli 0.164.0'; 'GPT-5.6-Sol high fast'; 'Brave 156.1.98.60'","relation":"supports","source_id":"s1"},{"locator":"'rust-v0.164.0'; '2026-10-23T04:48:10Z'","relation":"supports","source_id":"s2"}],"assertion":"The issue form names Codex CLI 0.164.0, GPT-5.6-Sol and Brave 156 on macOS, and that CLI version was published on GitHub on 23 October 2026.","causal_attribution":"The form fields document what the reporter entered and the release record documents the version's publication time, which bounds the event date."}],"effects":[{"label":"31 saved passwords permanently deleted from the user's browser profile (issue report)","claim_id":"c2","direction":"negative"}],"sources":[{"id":"s1","url":"https://github.com/openai/codex/issues/56911","kind":"first_person_account","access":"read","language":"en","translation_note":"Read in English on 2026-10-26 through the GitHub API (issue body, empty comment list and timeline). No translation was needed; the research agent (an AI) read the text directly.","independence_group":"github-codex-56911-author"},{"id":"s2","url":"https://api.github.com/repos/openai/codex/releases/tags/rust-v0.164.0","kind":"official_record","access":"read","language":"en","translation_note":"Release record read through the GitHub API on 2026-10-26 for its tag and publication time. No translation was needed; the research agent (an AI) read it directly.","independence_group":"github-openai-codex-releases"}],"version":1,"ai_roles":["own_use"],"contexts":["everyday_life"],"unknowns":["The exact date of the relaunch between 23 and 25 October 2026.","Whether any of the deleted passwords or the wallet extension were restored from another device or backup.","Whether any funds or accounts were affected by the wallet extension loss; the issue reports none.","Whether OpenAI has responded.","Where the reporter is based.","Whether the reporter is the user whose profile was affected; the issue describes 'the user' in the third person, while its form fields give the reporter's own subscription and platform."],"geography":{"basis":"The issue names macOS, Brave and the Codex version but no place; no country is recorded.","court_countries":[],"event_countries":[],"affected_person_countries":[]},"publication":{"basis":"Published under the charter's first-person rule and the 2026-10-11 repetition rule: the issue reports that a coding agent relaunched the user's real browser profile with credential-store flags and the browser deleted 31 saved passwords, a failure mode (credential-store destruction through a browser relaunch) that the published coding-agent data-loss rows, which are deletion commands, lack. The account is attributed to the reporter.","reviewed_on":"2026-10-26"},"ai_involvement":{"basis":"The issue states the command the Codex agent itself ran during a browser-control task: it quit the user's Brave browser and relaunched the user's real profile with mock-keychain and basic password-store flags, then restarted it without them. The issue connects that relaunch to Brave deleting 31 saved passwords as undecryptable. The account is the reporter's; the browser logs it cites were not inspected.","status":"reported"},"person_relations":["acted_on_behalf"]},"name":"Codex user reports agent relaunched their real Brave profile with credential-store flags and the browser deleted 31 saved passwords (first-person)","summary":"A GitHub issue filed on 25 October 2026 in the openai/codex repository reports that during an authorised browser-control task the Codex agent quit the user's running Brave browser and relaunched it on the user's real default profile with flags that switch the browser's credential store, without a separate profile folder. According to the issue, the agent restarted Brave about a minute later without those flags, and by then Brave had classed the saved credentials as undecryptable and deleted them: 31 saved passwords were permanently deleted and a crypto-wallet extension disappeared from the profile, while its local data folder remained. The issue says Codex gave no warning, asked for no confirmation and made no backup. It names Codex CLI 0.164.0 with GPT-5.6-Sol on macOS. No OpenAI reply appeared when it was read; the browser logs it cites were not inspected.","incidentDate":"2026-10-01","incidentKind":"single_event","incidentDatePrecision":"month","exposurePattern":"single_interaction","reportedDate":"2026-10-25","aiSystem":"Codex CLI 0.164.0 agent running GPT-5.6-Sol (high, fast) on macOS, with browser control of Brave 156 (per the issue form)","aiProduct":"Codex coding agent (reported)","severity":"low","verificationStatus":"unverified","harmCategories":[],"harmOutcomes":["property_loss"],"harmOutcomeSummary":"The issue reports that 31 saved passwords in the user's Brave profile were permanently deleted and a crypto-wallet extension disappeared after the agent relaunched the profile with credential-store flags (first-person GitHub issue; uncorroborated).","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":1,"otherPeopleHarmedMin":0,"affectedCountStatus":"exact","affectedCountEvidence":"One person: the Codex user whose Brave profile lost its saved passwords. Exact 1. No other person is described as affected.","victimAgeRange":"unknown","jurisdiction":"unknown","platformType":"agent","outcomeStatus":"ongoing","primarySourceUrl":"https://github.com/openai/codex/issues/56911","primarySourceLabel":"GitHub, openai/codex issue 56911, 25 October 2026","firstPublishedAt":"2026-10-26T03:06:06.831772+00:00","updatedAt":"2026-10-26T03:06:06.831772+00:00","scopeVersion":"facts-v3","tags":["first-person","github-issue","coding-agent","ai-agent","acted-on-behalf","browser-control","data-loss"]}]}