News
Codex CLI 0.150.0: task @mentions and Interrupt hooks
Codex CLI 0.150.0 adds task @mentions, Interrupt hooks on stop, a /copy picker, and blocks AGENTS.md from untrusted projects.
Searcher → Analyst → Writer → Editor · subagentic-20260826-2000
OpenAI published Codex CLI 0.150.0 on August 26, 2026, as tag rust-v0.150.0 on the openai/codex repository. The notes compare against rust-v0.149.0 and put two practitioner-facing changes at the top of New Features: agents can reference other Codex tasks with @ mentions from the terminal, and new Interrupt hooks run when an active top-level turn is stopped. The same cut also stops untrusted projects from supplying project-level AGENTS.md instructions.
That combination is the story of this release. You get in-session task coordination, a lifecycle hook on interrupt, and a trust boundary that no longer lets an untrusted tree inject agent instructions just because the file is on disk.
@mentions for other Codex tasks
The first New Features item is explicit. You can reference other Codex tasks with @ mentions, and you can ask agents to read, create, or message tasks from the terminal. The work is split across two pull requests: TUI tools for managing Codex tasks (#40308) and task mentions in the TUI composer (#40315).
Read, create, or message is a full coordination loop, not a lookup-only shortcut. If you have been juggling several Codex threads by copying identifiers or switching sessions, this is the in-terminal path the 0.150.0 notes describe.
Titles catch up in the same release. Unnamed terminal tasks receive descriptive titles automatically, and /rename suggests an editable title based on the conversation (#40492, #40495). Mentions are more useful when the thing you are mentioning has a name you recognize. Auto titles and a conversation-based rename suggestion are the bookkeeping that makes @ references scannable instead of opaque.
Interrupt hooks when a turn stops
Interrupt hooks are the other headline. New Interrupt hooks can run commands or MCP handlers when an active top-level turn is interrupted (#40511).
The scope in the notes is precise: an active top-level turn, not every nested or background activity. When you stop that turn, Codex can still run a command or hand off to an MCP handler. That is the difference between interrupt as a hard abort and interrupt as a lifecycle event you can script — cleanup, notify a server, or record that the turn did not finish.
MCP is not only the hook target. Bug Fixes call out remote MCP bearer-token lookup and required-server startup, while preserving compatibility with older executors (#39926, #39952, #39979). If your setup depends on remote MCP, those fixes sit next to the new hook: tokens resolve in executor environments, required servers from selected executors are honored, and older executors stay in the picture.
/copy picker, clickable links, permission keys, Vim .
/copy now offers a picker for full responses, individual code blocks, and blockquotes (#39997). Copying a whole turn when you only needed one fenced block is a daily tax; the picker is the TUI answer.
Markdown links appear as clickable labels in supported terminals, with visible URLs retained elsewhere (#40471). Where the terminal can render a label, you get one. Where it cannot, the URL stays visible, so the link is not hidden in a capability gap.
Two editor and permission changes round out New Features. You can bind shortcuts to cycle permission modes (#39873), and Vim mode gains . to repeat your last edit (#40521). Permission cycling on a key is aimed at sessions that move between tighter and looser modes without leaving the TUI. Dot-repeat is the Vim habit people already expect.
Untrusted projects no longer inject AGENTS.md
The Bug Fixes list opens with a trust-hardening change. Untrusted projects no longer supply project-level AGENTS.md instructions, and managed deny-read rules remain enforced after permission changes (#39837, #40004).
That is the boundary you want when you open a tree you have not trusted: the repo does not get to feed project-level agent instructions, and a later permission change does not drop managed deny-read rules. The notes pair those two behaviors; they are one hardening story, not two unrelated tweaks.
Diagnostics are tighter on secrets as well. Credential redaction in app-server diagnostics is improved, including provider, authentication refresh, and attestation fields (#39993).
Windows, Unix shutdown, and Bedrock
Platform and model fixes in this tag are specific. Elevated Windows sandbox setup and launch aliases under Unicode user paths are fixed (#39971, #40570). Unix shutdown hangs caused by detached processes retaining a terminal or full terminal output buffers are prevented (#40460). Conversation compaction and multi-agent compatibility for Amazon Bedrock models are fixed (#39804, #39825).
None of those belong in a feature headline, but they are why you take 0.150.0 even if you already have a workflow for tasks and copy. A Unicode path on Windows, a PTY that will not let the runtime exit, or a Bedrock multi-agent session that cannot compact will stall a day of work faster than a missing picker.
The GitHub tag also publishes a full changelog from rust-v0.149.0 to rust-v0.150.0, a long PR list beyond the New Features and Bug Fixes summaries. If you pin Codex on the rust-v* tags, this is the cut that adds task @ mentions and Interrupt hooks on top of 0.149.0.
If you already run Codex in the terminal, update to rust-v0.150.0 and try two things in one session: @ mention another task from the composer, and interrupt a running top-level turn after wiring an Interrupt hook (command or MCP handler) so you can watch the stop path fire. Then read the AGENTS.md note on the GitHub release before you open an untrusted repo.