What Codex Actually Sends to the Model
0xkato
Someone actually opened the hood on Codex to see what it sends the model behind your back. Type 16 characters, and it ships a 43,000-byte request — only 0.3% of that is your actual words.
A researcher ran a tiny experiment: point Codex CLI at a fake local server, type "Reply with pong.", and record exactly what gets sent over the wire. The prompt was 16 characters. The request was 42,980 bytes, roughly 9,435 tokens once tokenized locally. The user's actual text accounted for about 25 of those tokens. Everything else — system instructions, tool definitions, skill metadata, environment context — was overhead Codex generates just to exist, before it does anything at all.
Three things ate most of that baseline: a developer message describing the main instructions (3,729 tokens), a block defining four top-level tools like exec and collaboration (3,942 tokens), and the user's actual message (25 tokens). And that's before touching a single file. Loading a repo's AGENTS.md files added real weight too — 250 synthetic markers tacked on nearly 6,000 bytes, and 1,000 markers pushed the request past 67,000 bytes. Codex doesn't summarize or compress instruction files; it ships them whole, every single turn.
The more interesting finding is what stays invisible until you touch it. Repository files, ignored files, even a fake .env sitting in the project, none of them appeared in the first request. But the moment Codex read them, their contents entered every subsequent request and stuck around. A 10,000-line command output got truncated to a head-and-tail sample, but still ballooned a request from 43,337 bytes to 88,480. Terminal output wasn't deduplicated either — run the same command twice, pay for it twice.
Images behaved similarly but differently: a small 32x32 PNG became a 442-character base64 blob, while a larger gradient image got resized, re-encoded, and turned into a 71,666-character data URL — a single image adding over 70,000 raw bytes to the request. And when conversations got too long, Codex didn't just drop old messages. It built a separate compaction request, some 68,000 bytes summarizing the whole history, then rebuilt a slimmer request afterward. The resummarized version was nearly 26,000 bytes lighter — but any detail not captured in that summary was effectively gone, replaced by whatever the model decided was worth keeping.
None of this is a leak or a bug. It's just the plumbing nobody talks about: the actual cost of running an agentic coding tool isn't the prompt you type, it's everything the tool has decided you need to carry along with it, silently, every single turn.
My take
This is the kind of measurement piece that should exist for every agent framework, not just Codex — because right now, users have no idea how much of their token bill is instructions, tool schemas, and unread AGENTS.md files versus actual work. Open tooling wins here specifically because someone could point Codex at their own server and watch the bytes; try doing that with a fully closed agent stack. If vendors want people trusting these tools with their codebases, transparency about what actually crosses the wire shouldn't require a hobbyist building a fake HTTP server to find out.
Read more about this at: 0xkato