A developer report published on GitHub has drawn attention to a behavior baked into OpenAI's Codex CLI: the tool installs a persistent, self-updating background daemon by default when set up via npm. The issue, filed against the openai/codex repository, asks the company to make the daemon_auto_start option opt-in, with a default value of false.
The report specifies the exact setup where the behavior was observed: Codex CLI version 0.157.0, installed through the global npm command @openai/codex, running on Linux via WSL2. The complaint is not about a bug but about a design decision — a background process that survives sessions and updates itself without the user explicitly enabling it.
What the GitHub issue asks for
The request is straightforward: turn daemon_auto_start into an opt-in setting. By default it should be off, so a fresh installation does not leave a running service behind. The developer frames this as a feature request rather than a security disclosure, but the implication is clear — many users do not expect a coding assistant to install a self-updating service without asking.
The issue sits on a repository that has accumulated thousands of open reports, indicating active community scrutiny. While the thread itself does not include an official OpenAI response in the material reviewed, the fact that it was filed at all highlights growing unease with how AI developer tools handle background processes.
Why a silent daemon matters for developers
A daemon that starts automatically and updates itself is not merely a convenience feature. It means a process runs outside the visible terminal session, consumes resources, and can change its own code without direct user action. On shared machines, CI runners, or corporate laptops, that behavior can conflict with security policies that forbid unauthorized background services.
