Codex CLI SSD Bug: Fix 640TB Write Issue

Abstract

In June 2026, a critical defect was uncovered within OpenAI Codex CLI. Its built‑in SQLite log collector hard‑coded the global TRACE logging level, continuously writing diagnostic data to local storage at approximately 5 MiB/s. Real‑world measurements recorded 37 TB of disk writes within a 21‑day runtime window, extrapolating to an annual write volume of 640 TB. This workload can consume nearly the full write‑endurance rating of a typical 1 TB consumer SSD within a single calendar year. The GitHub issue #28224 documented this failure, drawing extensive community discussion. OpenAI resolved this vulnerability in release v0.142.0, cutting roughly 85 % of redundant log‑output volume. This article preserves all measured metrics, reconstructs the technical root cause, defines affected user profiles, compares three practical mitigation approaches, and discusses operational lessons from silent‑wear‑type software defects. When operating multiple AI coding agents across different backend providers, developers can leverage an API gateway such as 4sapi to consolidate multi‑model invocation management.

1. Overview of the Defect and Empirical Measurement Data

Reported via GitHub issue #28224 on June 14, 2026, the bug description explicitly highlighted that Codex CLI’s SQLite feedback‑log sink could generate up to 640 TB of disk writes per year and rapidly deplete SSD endurance. Practical runtime observation formed the core evidence base: over 21 continuous days of agent workload execution, the host SSD accumulated 37 TB of write traffic. File‑level auditing confirmed that the logs_2.sqlite database maintained by Codex constituted the dominant write source. Annualized projection yields 640 TB total writes. For mainstream consumer‑grade 1 TB SSD hardware with a typical TBW (Terabytes Written) rating of 600 TB, this load is sufficient to exhaust the drive’s rated service life within twelve months.

This is neither a storage‑hardware flaw nor user‑configuration error. It originates from a hard‑coded design choice inside Codex CLI itself. The timeline of public events unfolds as follows:

• April 2026: Initial problem report logged as issue #17320.
• June 14 2026: Issue #28224 submitted with quantitative runtime measurement data.
• June 23 2026: Version v0.142.0 published, merging pull‑requests #29432 and #29457 to roll out the official fix.

Statistical breakdown of log‑entry volume before remediation shows TRACE‑level records accounted for 70.7 % of total written bytes. Combined TRACE and OpenTelemetry tracing payloads represented around 96 % of overall write throughput. Filtering only these two categories would eliminate the vast majority of unnecessary disk I/O. INFO‑level logs contributed 25.7 %, DEBUG made up 3.0 %, and WARN messages represented merely 0.6 % of logged volume.

2. Technical Root‑Cause: Hard‑Coded TRACE Logging Level for SQLite Collector

Codex CLI implements a SQLite‑based feedback‑log sink, persisted on disk at path ~/.codex/logs_2.sqlite. This component collects diagnostic telemetry generated internally by the agent runtime. The critical flaw comes from a Rust source‑code statement that statically sets the logging sink level to TRACE by default. No environment‑variable override existed for this dedicated SQLite collector, ignoring standard RUST_LOG configuration variables developers normally rely on to adjust application verbosity.

TRACE represents the finest‑grained logging tier. It persistently captures a broad spectrum of low‑frequency internal events:

• Every send‑receive cycle for WebSocket socket traffic.
• All filesystem notifications triggered by inotify, tracking edits to configuration files.
• Full OpenTelemetry event mirroring, generating multiple auxiliary records for each user dialogue turn.
• Internal state transitions from the tokio‑tungstenite asynchronous stack.

Even though the application logic performs logical deletion of old records, SQLite continues executing write‑ahead‑log (WAL) cycles. Database row deletion does not erase prior physical disk writes. Each insertion‑then‑delete iteration still counts toward SSD wear metrics. In sampled 15‑second observation windows, the database could ingest more than 36 000 new records while retaining an unchanged visible‑row count. Physical flash‑memory wear accumulates regardless of whether old log entries remain visible to end‑users.

3. Affected User Groups and Observable Symptoms

The bug impacts users running Codex CLI versions prior to v0.142.0. The earliest related ticket dates back to April 2026 (issue #17320), implying the defective behaviour existed for longer than publicly documented.

Platform‑wise, Linux and macOS users bore the primary impact, with log databases stored under the home‑directory .codex folder. Windows and WSL environments were also vulnerable, though available temporary workarounds were more limited on Windows systems.

Workload intensity directly correlates with hardware degradation risk:

• High‑exposure profiles: Long‑running background agent tasks, parallel multi‑agent invocation, sustained sessions with heavy tool‑call activity. These scenarios amplify write throughput far above idle‑usage levels.
• Light‑usage profiles: Short, infrequent interactive sessions see comparatively mild wear accumulation.

End‑user visible symptoms included gradual UI‑interaction lag over extended sessions, input‑response stalls described as “cannot type normally”. In extreme instances, SQLite log files swelled to hundreds of gigabytes, triggering full‑process crashes after roughly 30‑105 minutes of continuous runtime.

4. Three Practical Remediation Approaches

Three distinct solution paths exist: official version upgrade, SQLite‑trigger‑based write blocking, and symbolic‑link redirection to volatile in‑memory storage.

4.1 Option One: Upgrade to v0.142.0 (Recommended Permanent Fix)

Upgrading the Codex CLI installation constitutes the root‑cause resolution. Merged PR #29432 and #29457 reduce log‑entry write volume by approximately 85 %. Further optimisation landed in v0.143.0 via PR #29599. Installation command:

npm install -g @openai/codex@latest

After applying upgrade, operators should verify whether log‑file growth has subsided, by periodically inspecting size metrics for logs_2.sqlite and associated WAL files.

4.2 Option Two: SQLite Trigger to Block Insert Operations (Temporary Intermediate Measure)

Proposed within GitHub‑issue community comments, this workaround creates a database‑level trigger that intercepts and discards all incoming INSERT operations against the log table. It halts new log writes completely without disrupting core Codex runtime behaviour. Historical diagnostic records become unavailable after applying this intervention. This suits transitional scenarios where users cannot immediately complete version updates.

sqlite3 ~/.codex/logs_2.sqlite "CREATE TRIGGER IF NOT EXISTS block_log_inserts BEFORE INSERT ON logs BEGIN SELECT RAISE(IGNORE); END;"

4.3 Option Three: Symbolic‑Link Redirect to tmpfs (Linux / macOS Only)

This workaround remaps the log database path onto volatile tmpfs storage under /tmp. Log data writes go purely into system RAM instead of persistent flash media. All diagnostic content vanishes upon system reboot, and symbolic‑link reconstruction is required after restarts. No user‑conversation history is touched; only diagnostic telemetry is discarded.

# backup existing log database
mv ~/.codex/logs_2.sqlite ~/.codex/logs_2.sqlite.bak
ln -s /tmp/codex_logs.sqlite ~/.codex/logs_2.sqlite

For Windows‑WSL users, tmpfs redirection is not reliably applicable. The advised course is to prioritise official package upgrade, paired with SMART monitoring utilities to track SSD health attributes.

5. Timeline of OpenAI Response

6. Why Silent Wear‑Inducing Bugs Carry Unique Risk

This class of software defect differs from conventional functional bugs. Data‑corruption or crash bugs produce immediate obvious failure. Storage‑endurance degradation progresses silently and irreversibly. SSD TBW consumption accumulates invisibly; hardware damage may only surface months after the triggering software behaviour began. Users could run affected tooling for extended periods without perceiving any obvious functional fault.

The industry shift toward persistent long‑lived AI agent workflows amplifies this risk. Tools including Codex, Claude Code, and DeepSeek Harness routinely run multi‑hour or multi‑day background agent tasks. Any unregulated persistent‑write behaviour inside long‑lived processes compounds physical‑hardware wear rapidly.

Teams running heterogeneous AI developer tooling frequently face fragmented API‑key management across multiple model vendors. Centralised access control provided by 4sapi helps streamline cross‑provider model consumption.

7. Frequently Asked Operational Questions

7.1 Will SSD damage reverse after upgrading to v0.142.0?

Existing accumulated TBW cannot roll back. Flash‑memory wear is a physical irreversible metric. Version upgrade stops further excessive logging writes; it cannot restore already‑consumed drive endurance. Operators should inspect drive‑SMART attributes to assess residual life for heavily‑used SSD hardware.

7.2 How can I verify whether my local instance is affected?

Observe file‑size growth of logs_2.sqlite and logs_2.sqlite‑wal. If these files keep expanding even when Codex remains idle, the system is running the vulnerable build. After successful upgrade, continuous file growth should cease.

7.3 Does this logging bug capture user source‑code or dialogue content?

Issue submitter analysis indicates the overwhelming majority of logged payload consists of internal runtime telemetry: WebSocket metrics, inotify filesystem events, OpenTelemetry tracing metadata. Actual prompt‑and‑response user‑dialogue payloads are not the dominant stored content. Even so, for strict‑privacy deployments, clearing old log databases post‑upgrade remains good operational hygiene.

7.4 How to confirm real‑time write activity on macOS or Linux?

Platform‑specific system tracing utilities such as iotop and fs_usage can monitor per‑process disk write activity. Persistent high‑volume write events attributed to Codex binaries indicate the defective logging path is still active.

8. Conclusion

The Codex CLI SQLite‑logging bug (GitHub #28224) illustrates a high‑impact silent hardware‑wear failure. Hard‑coded TRACE log level generated sustained 5 MiB/s disk writes, reaching measured 37 TB within 21 days and extrapolating to 640 TB annualised write load. The official v0.142.0 release cuts roughly 85 % of redundant log output. For hosts unable to upgrade immediately, SQLite trigger blocking or tmpfs symbolic‑link redirection serve as viable interim countermeasures, each carrying distinct trade‑offs regarding diagnostic‑data retention.

As AI agent tooling moves toward long‑running background execution patterns, developers must pay increased attention to hidden persistent‑write patterns. Even functionally‑correct‑seeming applications can inflict gradual, irreversible storage‑hardware degradation. System administrators should incorporate disk‑I/O auditing and endurance monitoring into operational checklists for locally‑deployed AI developer tooling.

Learn more：https://4sapi.com