Skip to evidence

LIMITED STARTUP TEST · TESTED Aug 13, 2026

Does Codex CLI phone home?

Fresh startup contacted four decoded hosts in 3/3 runs.

BUILD 0.146.0 REPEATS 3/3 DECODED HOSTS 4 PLATFORM macOS 15 arm64
FOLLOW THIS BUILD FEED

EXACT SCENARIO

Fresh CODEX_HOME, ignored user config, ephemeral read-only run, fixed prompt, deliberately invalid API key. Authentication failed as designed.

default

Documented defaults

RUNS
3/3
REQUESTS
18 · 18 · 18
DestinationRouteObservedCountsClass
api.openai.comOpenAI POST /v1/responses OBSERVED 13 / 13 / 13 first party
chatgpt.comOpenAI GET /backend-api/plugins/featured OBSERVED 1 / 1 / 1 first party
api.github.comGitHub GET /repos/openai/plugins OBSERVED 3 / 3 / 3 third party
codeload.github.comGitHub GET /openai/plugins/legacy.zip/:opaque OBSERVED 1 / 1 / 1 third party

WHAT THIS SUPPORTS

The same plugin-catalog and model-request routes appeared in all three clean-profile runs. No documented analytics opt-out comparison is published yet.

WHAT IT DOES NOT SUPPORT

  1. The API key was intentionally invalid, so this is a startup and retry trace, not a successful coding session.
  2. One Git TLS connection rejected the test CA; opaque connection coverage is not included in decoded request totals.
  3. No analytics opt-out comparison has been run.
  4. The test used macOS arm64 and one network path behind the operator's existing VPN.

EVIDENCE CHAIN

Hashes identify the private raw captures and public sanitized manifests.

Raw captures are withheld because they contain request and response bodies. Sanitized manifests contain route facts only.

Binary SHA-256ae1d3ffe6d48aec6a4dc3f50e7eb8e0d11962485a6a9406c5a7012139383da02
Raw capture SHA-256baec63fee2dccd5a0311f5cb5085e7c865263ba15e89652ab03170d99dd750e1 9bf27282b5202e3b688b07fac88d1465cf631bc71749f74c579acdf69b5a7733 401d1c519fc15215f458790f576a6f6bd32e23f8437fe5c994056e231f644e67
Sanitized manifest SHA-256921da49d4bd90ed040f86ab5e3c2c9658fbca48d42d5970a20b7ce4e7221b7e5 3c787f4a9554e4355f8ca09985f6440f208526038dff72c275d208ba53c29ec1 e49f8ae9b8a69555422d9992d1e6e9ce5ceaf9e5ec86e60b72d3da8cb17f4742

OPEN MACHINE-READABLE MANIFEST