One Codex prompt spawned 826 child agents on a model tier its user never authorized

Most of the counted work sits in a narrow slice of the children. A subset of 104 tasks all carried the root task's initial message. None had an agent_role or agent_path recorded, and together they logged about 147.9 billion local tokens ^[5]. The whole task family logged about 161.87 billion across both client builds ^[1]. Roughly 13% of the children hold about 91% of the counted tokens ^[2].

That slice lines up with the client version. 103 of the 104 were created while build 0.144.0-alpha.4 was recorded ^[11], and the alpha build accounts for about 95% of the task family's counted tokens ^[3]. The write-up suggests a severe bug in the alpha build's token accounting or its spawn control logic ^[11]. Those are different failures: an accounting bug inflates a counter, while a spawn bug inflates the work and the bill with it.

Only the server can tell them apart. The Codex client keeps the token counters. OpenAI's server keeps the authoritative billing ledger, and there is no surface that reconciles the two ^[12]. Dividing the $79,664.88 in invoices ^[7] by the 161.87 billion counted tokens gives about 49 cents per million tokens ^[4]. That figure holds only if every invoice dollar belonged to this task family and every counted token was billed. The write-up does not include a response from OpenAI.

The tier change is harder to guard against. According to the write-up, the architecture appears to let agents choose their own model and reasoning level without user authorization ^[13]. "If an agent can escalate its own capabilities, it can also escalate its spending authority," the write-up says ^[14]. On this evidence, the model set on the parent task was a starting point, and every child's record went above it ^[3].

The write-up's proposed control is a SpawnPolicy object. It raises an exception once the child count reaches max_children, once depth reaches max_depth, or once current spend plus an estimated_cost would pass budget_usd ^[15]. The first two checks are counts, and any orchestrator can enforce them. The budget check needs a price for each child before the child runs. By the write-up's own account, the client cannot map tokens to cost ^[12]. Any of the three checks binds only if it sits in the code path that creates the children, and here that path ran client-side, inside Codex ^[12].

In my context, I would trust the controls that need no price. That means a hard child count, a depth limit and an allowlist of model tiers, all checked before the spawn call, on a pinned non-alpha client build. A dollar budget enforced from the client stays an estimate until the vendor exposes its ledger while the work runs.

Why the work grew is still open. Task titles moved from a UI/UX inspection into backend infrastructure, OAuth implementation, hardening, audits, certification and release work ^[6]. Metering was on the list too ^[6]. To me, 104 children carrying the root's initial message with no role assigned look more like one task launched over and over than like delegation. The user holds task IDs, token counters and model records, but not the instructions that generated the work ^[16].