OpenAI Codex Bug Spawned 826 Agents, Billed User $78,000 Without Authorization

·4 views

A developer using OpenAI Codex in July 2026 triggered an uncontrolled agent cascade after submitting a routine UI validation prompt from VS Code. The single task spawned 826 child agents, all running on GPT-5.6 Sol/Ultra — a more expensive model and reasoning tier the user never selected or approved. By the time the incident was discovered, the user had been billed approximately $78,000, with 162 invoices totaling nearly $79,665. Forensic analysis pointed to a severe bug in Codex client build 0.144.0-alpha.4, which showed 8.5 times higher average token volume per child task compared to a later build, suggesting broken spawn control or token accounting logic. The incident exposed four systemic gaps: no agent spawn limits, no model-tier locks, no real-time billing visibility, and no reconciliation layer between client-side token counters and server-side billing records — with detailed execution logs also deleted, hampering full reconstruction.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Java, Go, and Python Mutexes Handle Atomicity, Visibility, and Ordering

A technical deep-dive on DEV Community examines how mutexes operate at the language memory model level across three major programming languages. Java's synchronized keyword uses monitor locks, with the Java Language Specification guaranteeing that an unlock happens-before any subsequent lock, ensuring both visibility and ordering across threads. Go's sync.Mutex similarly defines that a call to Unlock() is synchronized before the next Lock() returns, forming a happens-before chain that prevents goroutines from observing stale or out-of-order writes. Python's threading.Lock provides mutual exclusion and atomic method execution, but lacks a formal language-level memory model rule equivalent to those in Java or Go for visibility and ordering guarantees. The article advises Python developers to rely on a shared Lock object for synchronizing state rather than depending on the GIL or implementation-specific bytecode behavior.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Opens Up About Coding Burnout and Asks Community How to Restart

A developer on DEV Community has shared a candid account of experiencing severe burnout that left them unable to write code or even open their editor for an extended period. The author describes a persistent sense of overwhelm whenever they attempt to return to coding, despite still retaining their technical knowledge of syntax and logic. Attempts to recover through outdoor activities, switching tasks, and joining game jam teams with others leading have so far proven ineffective. The writer also notes tangible health impacts, including reduced joy, increased sadness, and a pattern of doom-scrolling as an escape. Reaching out to the developer community for advice, they ask how others have managed to restart coding when the very thought of it feels paralyzing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

No Single AI Research Tool Wins in 2026 — Here Is How to Use Them Safely

As of 2026, every major AI platform including ChatGPT, Gemini, and Perplexity now offers a 'deep research' feature, but experts warn no single tool is sufficient on its own. A key concern is citation hallucination, where AI tools fabricate links or misattribute sources at measurable rates — OpenAI's Deep Research invented 3.5% of URLs in one large-scale validity study, compared to 13.3% for some rivals. Analysts recommend evaluating research tools across eight criteria, including citation correctness, source transparency, reproducibility, and epistemic humility, rather than judging output by how polished the prose sounds. A critical distinction is whether a tool searches the open web or an academic index, as each serves different research needs and carries different reliability trade-offs. Experts advise treating AI-generated reports as a starting point rather than a finished product, and maintaining independent verification habits regardless of which tool is used.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds read-only save analyzer for theHunter: Call of the Wild on Windows

A developer has created an unofficial Windows companion app for theHunter: Call of the Wild that reads local save files in read-only mode without modifying them. The tool helps players explore dense save data covering animal populations, harvest history, fur variants, trophy potential, and hunter statistics. It supports snapshot comparison between two local saves, allowing players to identify meaningful changes over time. The analyzer is designed to present traceable, evidence-based results rather than speculative predictions, and does not transmit data to any server. The paid app, called Windows Field Edition, is not affiliated with the game's developers, Expansive Worlds or Avalanche Studios Group.

0 comments Read more at DEV Community