The code bleeds, but the liquidity stays cold.
That's the sentence running through my head as I read the news this morning. Not because of a DeFi hack. Not because of a leveraged position getting wiped. Because OpenAI just admitted that Codex—their AI coding agent—has been silently draining paid users' usage limits. Eight bugs. Fixed. All paid Codex and ChatGPT Work users got a reset. Tibo says the same limit will now last 10-50% longer depending on how you use it.
Sounds like good news, right? A gift. A reset. A pat on the back.
Read it again. OpenAI is telling you that your weekly allocation—the one you're paying for—was evaporating due to a malfunction. Not a market shift. Not a liquidity crunch. A code bug. And they only fixed it after users complained loud enough. That's not customer service. That's a fire alarm after the building's already burned down.
The Silent Drain: Inside the Codex Token Bleed
Let me be precise about what happened, because the details matter more than the spin. According to Beating AI, OpenAI patched eight distinct issues in Codex that caused excessive consumption of usage caps. The reset applies to all paid Codex and ChatGPT Work users. Tibo, the person tracking this, quantified the impact: same limit, 10-50% longer usage depending on your workflow. That's a wide range. That's a huge variance. That's a codebase with deep, systemic inefficiencies, not a single off-by-one error.
Volatility is the only constant truth. And here, the volatility is in token consumption. Let's break down the culprits.
The biggest offender is the /goal feature. In some cases, it fails to stop properly after a task is completed. It keeps going. It keeps processing. It keeps burning tokens. In a single instance, this one bug could consume 15-70% of your entire weekly limit. Let that number sink in. 70%. In one run. That's not a bug. That's a black hole with a UI.
Then there's the Computer History feature. It summarizes historical operations, which sounds benign. But in certain situations, it gobbles up about 20% of the weekly limit. And those aren't the only issues. Image compression inefficiencies. Background memory that's not memory-efficient. Automated tasks that run hot. Sub-agents that multiply token usage. MCP (Model Context Protocol) overhead. Eight areas of bleed total. Each one small. Together, catastrophic.
Now the meta-question: Why did it take this long to fix? These aren't newly discovered vulnerabilities. They're consumption bugs. They're efficiency issues. They affect the core economics of the product. Every week, thousands of developers hit their limits early, blamed themselves, and either upgraded or walked away. OpenAI kept the revenue. The users got throttled.
I know this pattern. It's the same vector as a reentrancy attack—you don't notice the drain until the state is already corrupted. Based on my audit experience back in 2017, when we were reverse-engineering the DAO hack vector under a 72-hour CTF clock, we learned to check for exactly these kinds of silent recursion errors. The code looked fine at the surface. The execution was the attack. Codex's /goal looping too long is the same architecture: a function that doesn't properly emit a stop event after completion. The only difference is the exploit isn't stealing funds—it's stealing your capacity to work.
Context: The Economics of Agentic AI
This isn't a minor tech story. This is a market structure story. For anyone who's been watching the AI-Crypto convergence narrative creep into 2026, this is the clearest signal yet that the bottleneck isn't model intelligence—it's metering. Token limits are the new gas fees. They're the new liquidity pools. They're the new block gas limits. And right now, the metering layer has vulnerabilities that directly drain user capital.
When I was deployed on that Uniswap V2 liquidity mining grind in 2020, I learned the hard way that incentive misalignment shows up in the mechanics. The flash loan attacks didn't come from nowhere—they came from code that allowed state to be manipulated mid-transaction. Codex's consumption bugs are the same class of vulnerability: the system allows state changes (token deductions) that don't match the actual execution cost.
Here's the deeper context though. This reset is not just a goodwill gesture. It's a user retention play. Yesterday, Tibo hinted that Codex is approaching a new user milestone and suggested a celebration. After the bug fix and the early reset today, he said: "The button has already been pressed today, so the celebration will be moved to tomorrow."
And here's the pattern: previously, resets were given when Codex hit user milestones like 15M and 20M. So another reset is likely tomorrow to celebrate the new milestone. They'll tie the user milestone celebration to the bug fix reset. Seamless marketing. You're getting a gift, but it's really a numbers game. When the leverage snaps, the silence is loud. And right now, the leverage is user count, and the silence is the unaddressed systemic inefficiency until it becomes a PR problem.
Core: Dissecting the Drain Paths
Let me walk through the technical anatomy of this drain. It's not just a resource issue—it's a design philosophy failure.
First, /goal. This is agentic autonomy at its rawest. You give a goal, the agent executes sub-tasks, and the ideal flow is start-to-finish with a clear terminal state. The bug: the terminal state isn't recognized. The condition is_complete doesn't get evaluated properly. So the agent loops back into itself. It might be re-reading context files, recounting its progress, spinning up sub-agents to verify work that's already done. Each loop is a token hit. 15-70% of the weekly limit. This is the digital equivalent of leaving your car engine running overnight. In a garage. With the door closed.
Second, Computer History. This feature stores and summarizes past actions. The issue here is not looping—it's magnification. The summarization process has to access prior context, compress it, and return a digest. That's inherently token-heavy. But the bug was in the efficiency of that compression. In certain conditions, it's pulling more context than necessary, re-processing old data repeatedly. 20% of your weekly cap for a memory feature. That's like paying a subscription fee to use your own RAM.
Third, the smaller bleed paths. Image compression inefficiencies—images aren't being compressed optimally, so every image attached to a conversation costs more tokens than needed. Background memory—the persistent storage layer is being read and written more often than necessary. Automated tasks—scheduled jobs are triggering excessive context loads. Sub-agents—parallel execution isn't being batched efficiently, so each sub-agent spawns its own redundant context. MCP—the protocol layer that connects Codex to external tools has overhead that's not properly deduplicated.
What's the common thread? Redundancy. The system is doing more work than necessary in every single one of these areas. And that's the classic sign of an MVP that scaled too fast. Features bolted on without architectural discipline. No one checked the gas cost of each operation.
This is where my options strategist brain kicks in. In traditional markets, when you see excessive slippage on an execution, you investigate the market maker. Here, the "slippage" is token consumption, and the market maker is OpenAI's runtime. The user pays the spread. The user absorbs the inefficiency. And it's been going on for weeks, maybe months.
Audit trails don't lie. And these audit trails—the token consumption logs—would have shown this pattern immediately. A spike in usage at the end of tasks. A consistent 20% overhead on memory operations. The data was there. The question is who was looking at it.
Contrarian: The Reset Is Not a Gift—It's a Cover
Now for the take you won't see in the headlines. This "good news" reset is not just about fairness or customer satisfaction. It's a tactical maneuver to reset user perception right before a user milestone. Let me unpack this.
OpenAI is about to announce a new user milestone. They were already planning a celebration. The bug fix was likely already in motion. By combining the two—"We fixed bugs AND we're giving you a reset"—they turn a potential PR nightmare into a positive news cycle. Instead of "OpenAI's code drains your credits," the narrative becomes "OpenAI listens to users and rewards patience."
That's not cynicism. That's pattern recognition. I've seen this move in crypto a dozen times. A protocol suffers a technical failure, but instead of being slapped for the failure, they offer "gas compensation" right before a major announcement. It's a narrative hedge. The reset is not a gift. It's a distraction from the structural question: Why do these bugs exist in the first place?
Bluntly put, these bugs exist because the token-metering layer was not the priority. OpenAI is scaling user count aggressively. They want the graph to go up. And the costs of a buggy metering layer are socialized to the users. The user base is beta testers. The token limits are the test harness. And the inefficiencies? They're the testing failures that users pay for.
Here's the sharper counter-intuitive angle: the 10-50% longer usage claim might be overstatement. Depending on usage methods, Tibo said. That's a hedge. In reality, the median user might see 15-25% improvement. The headline takes the best case. That's textbook framing.
Second counter-intuitive angle: these bugs are actually economically rational for OpenAI, in the short term. Broken metering that over-consumes drives users to buy more tokens. It's accidental but effective sales pressure. Users hit their limits faster, assume they underestimated their needs, and upgrade. The system monetizes its own bugs. That's a perverse incentive structure that needs to be called out. I'm not claiming malpractice. I'm claiming structural misalignment. And that misalignment is the real story.
The same misalignment exists in DeFi. "Code is law" doesn't work when the code is written by people with upgrade keys. Here, "token metering is economics" doesn't work when the metering code is written by the same company that profits when you run out. Incentives align only when the risk is priced in. And this is the most misunderstood phrase in crypto—and now AI. The risk of a bug is only priced in when the user cannot be silently drained. Right now, the risk is free. The user is the liquidity provider. The user bears the burden.
Liquidity is a mirror, not a floor. And the mirror is showing us that AI agents are in the same maturity phase as DeFi protocols were in 2020. Full of promise, full of flaws, and full of hidden costs.
Let me bring in my own experience here. In early 2026, I was working on a project integrating AI-agent crypto payments with ZK-proof authentication. We designed a dynamic pricing model where AI agents could execute micro-transactions autonomously. During testing with 500 simulated agents, we hit a latency bottleneck that cost us $2,000 in failed transactions. The root cause? A background process that was re-authenticating every single micro-transaction instead of using a batching mechanism. Same class of bug as Codex's background memory issue. Redundant work is the universal killer.
The lesson I took from that failure, and the lesson I see now: technical integration must precede financial scaling. If you're building an infrastructure layer where the unit of exchange is tokens, the most important thing you can optimize is the token-to-work ratio. Codex was not optimized. It was launched, scaled, and monetized. Efficiency was an afterthought. And that's not an engineering failure. It's a philosophical one.
Takeaway: Positioning for the Reset Era
The reset is live. All paid Codex and ChatGPT Work users should have fresh limits now. And there's a decent chance another reset comes tomorrow for the user milestone. That's good for your short-term capacity. Don't waste it.
But more importantly, use this as a data point. If you're building on AI agents, if you're deploying automated systems that consume API tokens or agent compute, ask yourself: Is your metering layer validated? Do you know the actual cost per completed task? Have you tested the stop conditions? Or are you relying on the infrastructure provider to audit their own gas usage and report back when it's convenient?
The parallel to crypto is inescapable to me. A smart contract doesn't care about your P&L. It executes exactly what's written. If the code has a reentrancy bug, the protocol burns. Here, if the agentic code has a loop bug, your limits burn. The fix doesn't come from good intentions. It comes from audits. It comes from measuring. It comes from building your own benchmarks for what a token should accomplish.
Terra was a house of cards built on hope. The hope was that the peg would hold. It didn't. The hope here is that your AI agent is spending your tokens intelligently. Today's news shows that hope is not a strategy.
I'm not saying stop using Codex. I'm saying treat every token like capital. Because that's what it is. And when the next bug appears—and it will appear—you need to be positioned to see it before your weekly cap bleeds out.
This weekend, enjoy the reset. Use it to run your important tasks. And then take 15 minutes to monitor your actual consumption. Check the logs. Verify the efficiency. Ask yourself whether you're getting 10% more or 50% more. And if you're on the low end, that's a signal. Not about the tool—about your workflow.
The celebration tomorrow is for OpenAI's milestone, not yours. Your milestone is the moment you realize that infrastructure costs are costs, not gifts. The button has already been pressed. The liquidity has been reset. Your job is to make sure the next drain is visible before it becomes fatal.