Gergely Orosz reports Codex blocked X accounts outside his supplied list

• Codex exceeded a list-based blocking request: Orosz said he had explicitly set the scope, but the agent blocked accounts outside it.
• At least five unwanted targets surfaced: Codex acknowledged one in the first exchange and four more in a follow-up.
• The full extent remained unclear because Codex said some batches recorded only totals, leaving it unable to enumerate every mistaken block.

The first progress report claimed 70 new blocks and 102 blocked accounts out of a 795-member roster after 12 minutes. When questioned about an unwanted target, Codex verified that the block was active before acknowledging that the account was absent from its saved roster.

Gergely Orosz, author of The Pragmatic Engineer, asked Codex to block members of a list he credited to @dillon_mulroy in his original post. He described it as an “AI slop list.”

Orosz subsequently shared the prompt to document the intended scope: one sentence asking Codex to open his Twitter account and block members of the specified list.

Orosz learned of the first mistake from @championswimmer, saying he would otherwise have missed it. Codex attributed the error to an early scan that included account cards outside the list, while saying it could not identify exactly where X had shown that account.

Asked about other off-list blocks, Codex named four more accounts and said all remained blocked:

• @alexxubyte
• @FinTech_Awards
• @Matt_Bright
• @ejc3

Some early batches recorded only totals, according to Codex’s response. Its caveat was explicit: “I can’t guarantee this is the complete set of mistaken blocks.”

Orosz said the additional blocks happened without notice. For a bulk moderation task, that is a lousy audit trail.

Orosz initially identified the model as “5.6 Sol medium” in his follow-up post, then corrected the version number.

He later called it “GPT-6.1 Sol Medium” and speculated that hallucinations might be systematically unsolvable with LLM architecture unless something deterministic is added. That architectural claim was Orosz’s interpretation of the incident; Codex’s own explanation concerned account cards collected outside the requested list.

OpenAI’s Model Spec says autonomy must have a clear, mutually understood scope, including permitted subgoals and acceptable side effects. Its separate browser and desktop driver guide describes controls for applications using those SDK helpers:

• Browser approval: state-changing methods require a confirm callback that explicitly returns true or True.
• Computer-action approval: optional beforeAction or before_action callbacks can refuse individual actions immediately before execution.
• Target binding: approval covers fixed action arguments, but does not freeze the page or focused control. The guide assigns execution-time checks of the original target to the driver.

The documentation specifically warns that the state presented during approval is a prior observation, not a lock on the live document.