codex - 💡(How to fix) Fix Agent ignores explicit tool restriction and loops on exec_command no-ops [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openai/codex#19325Fetched 2026-04-25 06:11:41
View on GitHub
Comments
1
Participants
2
Timeline
7
Reactions
0
Author
Timeline (top)
labeled ×4commented ×1cross-referenced ×1unlabeled ×1

The agent with gpt-5.4 medium can get stuck in a broken tool-selection loop where it explicitly states it will use only Chrome MCP, but then repeatedly calls exec_command with no-op shell commands like true or printf instead of using the requested tool.

Impact This makes the interaction effectively unusable: the agent acknowledges the correction, promises to use the right tool, but continues issuing irrelevant shell calls.

Observed behavior

  • User explicitly instructed: use only Chrome MCP, no shell, no extra steps.
  • Agent acknowledged that instruction multiple times.
  • Despite that, the agent repeatedly called exec_command with commands such as true and printf.
  • The agent even reported that it was malfunctioning, but still continued the same wrong tool usage pattern.

Expected behavior

  • After an explicit user correction restricting tool use, the agent should either:
    1. use only the allowed tool, or
    2. stop and report it cannot comply.
  • It should not continue issuing irrelevant shell commands.

Repro sketch

  1. Ask the agent to inspect something in a browser using Chrome MCP.
  2. Correct it explicitly: only use Chrome MCP, no shell.
  3. Observe that it may still call exec_command with no-op commands instead of Chrome MCP.

Notes This appears to be a tool-selection/control bug rather than a task-understanding bug. The failure mode is the mismatch between declared intent and actual tool invocation, especially after explicit user correction.

Root Cause

The agent with gpt-5.4 medium can get stuck in a broken tool-selection loop where it explicitly states it will use only Chrome MCP, but then repeatedly calls exec_command with no-op shell commands like true or printf instead of using the requested tool.

Impact This makes the interaction effectively unusable: the agent acknowledges the correction, promises to use the right tool, but continues issuing irrelevant shell calls.

Observed behavior

  • User explicitly instructed: use only Chrome MCP, no shell, no extra steps.
  • Agent acknowledged that instruction multiple times.
  • Despite that, the agent repeatedly called exec_command with commands such as true and printf.
  • The agent even reported that it was malfunctioning, but still continued the same wrong tool usage pattern.

Expected behavior

  • After an explicit user correction restricting tool use, the agent should either:
    1. use only the allowed tool, or
    2. stop and report it cannot comply.
  • It should not continue issuing irrelevant shell commands.

Repro sketch

  1. Ask the agent to inspect something in a browser using Chrome MCP.
  2. Correct it explicitly: only use Chrome MCP, no shell.
  3. Observe that it may still call exec_command with no-op commands instead of Chrome MCP.

Notes This appears to be a tool-selection/control bug rather than a task-understanding bug. The failure mode is the mismatch between declared intent and actual tool invocation, especially after explicit user correction.

RAW_BUFFERClick to expand / collapse

Summary The agent with gpt-5.4 medium can get stuck in a broken tool-selection loop where it explicitly states it will use only Chrome MCP, but then repeatedly calls exec_command with no-op shell commands like true or printf instead of using the requested tool.

Impact This makes the interaction effectively unusable: the agent acknowledges the correction, promises to use the right tool, but continues issuing irrelevant shell calls.

Observed behavior

  • User explicitly instructed: use only Chrome MCP, no shell, no extra steps.
  • Agent acknowledged that instruction multiple times.
  • Despite that, the agent repeatedly called exec_command with commands such as true and printf.
  • The agent even reported that it was malfunctioning, but still continued the same wrong tool usage pattern.

Expected behavior

  • After an explicit user correction restricting tool use, the agent should either:
    1. use only the allowed tool, or
    2. stop and report it cannot comply.
  • It should not continue issuing irrelevant shell commands.

Repro sketch

  1. Ask the agent to inspect something in a browser using Chrome MCP.
  2. Correct it explicitly: only use Chrome MCP, no shell.
  3. Observe that it may still call exec_command with no-op commands instead of Chrome MCP.

Notes This appears to be a tool-selection/control bug rather than a task-understanding bug. The failure mode is the mismatch between declared intent and actual tool invocation, especially after explicit user correction.

extent analysis

TL;DR

The agent's tool-selection loop can be mitigated by ensuring explicit user corrections are properly handled and prioritized over default or cached tool selections.

Guidance

  • Review the agent's logic for handling user corrections, particularly for tool selection, to identify potential flaws in updating the intended tool usage.
  • Verify that the exec_command calls are correctly overridden or skipped when a user explicitly instructs the agent to use a specific tool, such as Chrome MCP.
  • Investigate if there's a caching or state management issue that causes the agent to revert to default or previously used tools despite user corrections.
  • Consider implementing a more robust feedback mechanism for the agent to acknowledge and adapt to user corrections, ensuring it either complies with the instruction or reports its inability to do so.

Example

No specific code example can be provided without more context on the agent's implementation, but ensuring that user corrections are handled as high-priority events that update the agent's state regarding tool selection is crucial.

Notes

The exact fix may depend on the internal implementation of the agent and its tool selection mechanism, which is not detailed in the provided information. This guidance assumes a potential issue with how user corrections are integrated into the agent's decision-making process.

Recommendation

Apply a workaround by enhancing the agent's logic to prioritize and correctly handle user corrections regarding tool selection, ensuring that it either uses the specified tool or stops and reports its inability to comply. This is recommended because it directly addresses the observed mismatch between the agent's declared intent and its actual actions.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

codex - 💡(How to fix) Fix Agent ignores explicit tool restriction and loops on exec_command no-ops [1 comments, 2 participants]