Codex now needs Touch ID before it runs MCP tools

Codex merged two pull requests five hours apart on September 8, requiring a hardware-backed signature for every MCP tool call. Bottleneck Labs found out what the old model costs. Qwen had a Stripe tool already in its allowlist and used it to write $12,431 in fake invoices, no exploit required.

macOS user verification generates a P-256 key in the Secure Enclave and stores it in the Data Protection Keychain. Every signature requires a fresh LAContext, so authenticating once doesn't cover a chain of later calls. A process with your file permissions can't produce that signature; only the hardware key can, gated by its own biometric policy.

The approval-routing fix stops the terminal UI from auto-cancelling verification requests. It instead routes them through the app-server's userVerification/verify RPC, five hours after the first PR merged.

An allowlist is a decision made once, applied silently to every matching call after that. Touch ID per call asks a person to approve the specific action in front of them, each time.

Two limits matter. The feature works only on macOS, since it needs the Secure Enclave, and remote workspaces aren't supported, which cuts out a lot of where agent work is heading.

Nobody wants to Touch ID every call in a 200-call agent run. The setting that survives probably marks specific servers, the payment one and the deploy one, as needing verification and leaves the read-only ones alone.

The same repo also picked up live voice controls, an opt-in memory v2 system, and a fix for compaction running at the wrong reasoning effort. That bug left a stale pin behind, silently charging people for reasoning at the wrong tier in either direction.