Codex is able to use web search even when tool is not provided

[eaftan]

Context: https://discord.com/channels/735557230698692749/1405934747690995732/1480304975857844318

A user created this workflow: https://github.com/drehelis/gcp-emulator-ui/blob/24120edf4d5213b87f31067920ea61bf32e18182/.github/workflows/check-emulator-updates.md?plain=1

Note that web-search is not included in the tools section.

In this run, you can see that Codex used web search:

🌐 Searched: site:github.com/drehelis/gcp-emulator-ui/issues "emulator release notes" "559.0.0"
2026-03-08T04:11:37.750396Z DEBUG codex_exec: Received event: Event { id: "019ccba4-8110-7d50-9428-7d3ac7ec34f7", msg: RawResponseItem(RawResponseItemEvent { item: WebSearchCall { id: Some("ws_09eaaf924a0151210169acf6f7b030819da91c012df596f950"), status: Some("completed"), action: Some(Search { query: Some("site:github.com/drehelis/gcp-emulator-ui/issues \"emulator release notes\" \"559.0.0\""), queries: Some(["site:github.com/drehelis/gcp-emulator-ui/issues \"emulator release notes\" \"559.0.0\""]) }) } }) }

It seems like we should disable web search in Codex by default, and only enable it if the web-search tool is passed. Here are Codex docs on how to disable web search: https://developers.openai.com/codex/cli/features/#web-search