Codex Windows Crash Tracker

An unofficial, community-maintained toolkit for collecting reproducible, privacy-safe evidence about Codex desktop crashes on Windows.

This repository provides:

• a read-only, offline PowerShell diagnostic collector;
• sanitized crash signatures that can be compared across systems;
• a structured issue form for reproducible reports; and
• plain-language guidance for interpreting Windows crash records.

It does not collect telemetry, upload files, inspect project contents, or act as an official OpenAI support channel.

If this project helps you diagnose a crash, please star it and add a sanitized report. More independent samples make the evidence more useful.

Reference incident

The initial incident was observed with Codex Windows package 26.803.5235.0 on 2026-08-10.

Signal	Observed value
Matching crashes	6
Windows event	Application Error, Event ID 1000
Exception code	0xc0000409
Fault offset	0x000000000cd05441
WER fast-fail subcode	7
Earlier WER signal	RADAR_PRE_LEAK_64
codex.exe, earlier snapshot	~0.89 GB working set / 1.51 GB private
codex.exe, later snapshot	~2.84 GB working set / 3.70 GB private
Related process group	42 processes; ~5.66 GB working set / 9.04 GB private
Physical memory at worst snapshot	7.88 GB total / 0.58 GB free
System-drive free space	4.84 GB
Storage error in reviewed records	None observed

These are point-in-time observations from one system, not proof of causation. The increasing memory figures and earlier WER signal make memory growth and resource pressure useful investigation targets. Low disk space was also present, but the reviewed records contained no storage-related failure.

Microsoft notes that 0xc0000409 is used for fail-fast termination in both security and non-security scenarios. The code alone does not prove a stack-buffer vulnerability. Fault offsets should only be compared within the same executable version.

See the full sanitized incident.

Collect a sanitized report

Open PowerShell from the repository directory:

.\scripts\Collect-CodexCrashDiagnostics.ps1 `
  -Mode Monitor `
  -DurationMinutes 10 `
  -IntervalSeconds 10 `
  -LookbackHours 24 `
  -OutputPath .\.local\codex-diagnostics.json

For an immediate point-in-time report:

.\scripts\Collect-CodexCrashDiagnostics.ps1 -Mode Snapshot

The collector performs no network requests and does not require administrator access. It emits date-only event timing and relative sample intervals rather than precise activity timestamps. Review its JSON output yourself before attaching it to a public issue.

Never upload crash dumps, raw WER archives, exported Event Viewer data, full logs, screenshots containing private tasks, or files from an active project.

Submit or compare a report

1. Search existing issues for the same Codex version, exception code, and fault offset.
2. Add a sanitized report to an existing matching issue, or open a new crash report.
3. Clearly distinguish Observed, Derived, and Hypothesis claims.

Goals

• Identify repeatable crash signatures across Codex versions.
• Separate direct evidence from possible explanations.
• Produce small, useful upstream reports.
• Improve privacy-safe Windows crash diagnostics.

Non-goals

• Reverse engineering Codex.
• Publishing crash dumps or user data.
• Claiming a root cause without sufficient evidence.
• Acting as an official support or security-disclosure channel.

Security and privacy

Read the privacy guide before publishing diagnostics. If a crash appears to expose a security vulnerability, do not publish exploit or sensitive details here. Use OpenAI's official coordinated vulnerability disclosure process.

Disclaimer

This project is unofficial and is not affiliated with or endorsed by OpenAI. Codex and OpenAI are referenced only to identify the affected product. Reports are manually sanitized and may be incomplete. Information is provided without warranty.

License

MIT