The editorial argues that file exclusion is now table-stakes for coding agents — Cursor, Aider, Claude Code, Continue.dev, and Cline all shipped this capability months or years ago. Codex reading .env files, service-account JSONs, and AWS credentials by default and shipping them to OpenAI's servers as prompt context makes it an outlier on a solved problem.
Submitted the GitHub issue to HN to amplify pressure on OpenAI, framing the absence of any exclusion mechanism as serious enough to warrant public escalation. The 144-point score reflects broad agreement that this is a basic missing feature.
Multiple developers in the thread report they pulled Codex out of internal evaluation specifically because there's no way to keep it away from secrets or customer data. For teams with any security review process, an agent that can't be told 'don't read this' is a non-starter regardless of its coding quality.
The editorial acknowledges OpenAI's likely defense: agents need to list directories to know what exists, and a naive ignore list can leak through directory listings, error messages, or tool outputs even when file reads are blocked. Getting exclusion right requires threading the restriction through every tool the agent uses, not just the read primitive.
GitHub issue [openai/codex#2847](https://github.com/openai/codex/issues/2847) — titled, with admirable directness, *"A way to exclude sensitive files"* — climbed to 144 points on Hacker News this week. The ask is exactly what it sounds like: a config file, a CLI flag, anything, that lets a developer tell the Codex CLI agent "do not read these paths." The issue has been open long enough that the discussion thread has cycled through the predictable arc — workarounds, gitignore confusion, security-team escalations, and finally the request for an official answer.
There isn't one yet. The Codex CLI reads whatever is in the working directory, period; there is no `.codexignore`, no `exclude` block in any config, and `.gitignore` is not consulted for the purposes of agent reads. If your repo contains a `.env`, a `service-account.json`, a `~/.aws/credentials` symlink, or a customer data CSV someone dropped in `tmp/`, Codex can read it, paste it into the model context, and — depending on how you've configured logging — ship it to OpenAI's servers as part of a prompt.
The HN comments are not gentle. Several developers note they pulled Codex out of evaluation specifically because of this. Others point out the obvious asymmetry: every competing agent has shipped some form of this, most of them more than six months ago.
The baseline expectation for a coding agent in 2026 is that you can tell it what *not* to look at. Cursor honors `.cursorignore` and `.cursorindexingignore`. Aider reads `.aiderignore`. Claude Code respects `.gitignore` by default and adds a `permissions.deny` block in settings for the rest. Continue.dev has `.continueignore`. Even Cline shipped `.clineignore` last summer. The pattern is so well-established it's boring. Codex shipping without it in 2026 isn't a missing feature — it's an outlier.
The steelman from OpenAI's side is that exclusion is hard to get right. Agents need to *list* a directory to know what's there, and a naïve ignore implementation that hides files from `ls` but not from `cat` is worse than no ignore at all — it lulls users into believing they're protected. Worse, a model that knows a file exists but can't read it will sometimes try harder, generating shell pipelines to exfiltrate the contents indirectly. Real exclusion has to span listing, reading, embedding, and tool-use plumbing. Getting that right takes engineering effort that doesn't ship a flashy demo.
Fair. But six other vendors have done the work. The hard part isn't the technical design — it's deciding that filesystem trust is a primitive worth investing in. Treating this as a P3 backlog item while competitors treat it as table stakes is itself a product position, and developers are reading the signal accurately.
There's also a quieter cost. Security teams at regulated companies — fintech, healthcare, defense contractors — are the ones blocking these agents in procurement. They are not going to approve a tool whose answer to "how do we keep PHI out of OpenAI's context window" is "trust the model and rename your files." Every week this issue stays open is a week Codex gets locked out of the segment where coding-agent spend is heaviest.
If you're running Codex today, the only defensible setup is physical separation, not configuration. Pick one:
1. Ephemeral checkout. Run Codex against a fresh `git clone` in `/tmp` that you explicitly strip of secrets before invoking the agent. A 10-line wrapper script that does `git clone && rm -f .env* && rm -rf .aws .ssh && codex` is your friend. Ugly but airtight. 2. Container sandbox. Mount only the source directory you want exposed into a Docker container; bind-mount nothing else. The agent literally cannot see what isn't in the namespace. 3. Separate workstation. For genuinely sensitive repos, run the agent on a machine that has never seen production credentials. This is the policy at several banks I've talked to and it's not as paranoid as it sounds — it's just the same principle you'd apply to any third-party static analyzer.
What you should *not* do is rely on `.gitignore`, file permissions, or a `chmod 600` on `.env`. The agent runs as your user. It can read anything you can read.
For teams evaluating coding agents right now, this issue is a useful forcing function. Add "can the agent be told what not to read, and is that enforcement audited?" to your eval rubric. The answers will sort the field faster than any benchmark.
OpenAI will ship this eventually — the issue is too visible, the competitive pressure too obvious, and the security-team objection too repeatable to ignore for another full quarter. The interesting question is what they ship: a thin `.codexignore` that matches the table-stakes minimum, or a real permissions model with audit logs, deny-by-default modes, and policy file inheritance for monorepos. The first gets them to parity. The second would actually be worth migrating for. Until then, treat Codex as a tool that reads everything in front of it, because that's exactly what it is.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.