Windows: (Luna) agent-generated PowerShell process left running after an error and task handoff, exhausting RAM

What version of the Codex App are you using (From “About Codex” dialog)?

26.908.9136.0 (installed Windows package version)

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Windows 11 Pro, Windows NT 10.0.26200.0 x64

What issue are you seeing?

An agent-generated PowerShell reporting command remained running after a command error, a corrected replacement command, and a handoff to another agent.

In Task Manager, I observed PowerShell consuming approximately 99-100% of RAM while my C: system SSD reached 100% activity. I restarted the PC to recover.

The originating task used GPT-5.6 Luna with Max reasoning. The replacement task used GPT-6 Astra with High reasoning.

The command was collecting test evidence into a JSON report. It attempted to assign a receipt to $host, which conflicts with PowerShell's case-insensitive, read-only $Host automatic variable.

The recorded output contains:

Cannot overwrite variable Host because it is read-only or constant.

Execution nevertheless continued. The report's hostReceipt field therefore referenced the live PowerShell host object instead of the intended receipt. The command then passed that object to ConvertTo-Json -Depth 12.

The recorded output also contains:

WARNING: Resulting JSON is truncated as serialization has exceeded the set depth of 12.

A corrected replacement command completed, but the original process was not settled. Timestamped process records show the original command still running approximately 2 hours 14 minutes after launch.

During the takeover, Astra saw the exact maintenance-related command but incorrectly classified the process as unrelated because it started before the takeover. It left the process running and reported the task as stopped.

This was an agent-written reporting command and a process-ownership/cleanup failure. It was not ordinary PostgreSQL or browser-test execution.

What steps can reproduce the bug?

These are the observed incident steps, not a claim that every run reproduces the same resource consumption. Do not execute the faulty serialization example on a normal workstation.

1. Run a maintenance task in the Windows Codex desktop app using GPT-5.6 Luna with Max reasoning and request collection of validation evidence.

2. The agent generates a PowerShell reporting command containing this pattern. These are sanitized excerpts; unrelated fields are omitted:

$host = Get-Content -LiteralPath "<redacted receipt path>" -Raw | ConvertFrom-Json
$manifest = [ordered]@{ hostReceipt = $host }
$manifest | ConvertTo-Json -Depth 12 | Set-Content -LiteralPath "<redacted output path>"

1. The assignment to $host fails because $Host is read-only. The command does not stop on that error and proceeds to serialize the built-in host object.

2. The execution call returns after its approximately ten-second yield interval. The agent's orchestration code prints only the textual output:

const r = await tools.exec_command(...);
text(r.output);

This discards the exit/completion/session metadata needed to distinguish a completed command from a still-running command. The outer "Script completed" label is not evidence that the underlying PowerShell process exited.

1. The agent launches a corrected reporting command without confirming termination of the original process.

2. The task is handed to GPT-6 Astra with High reasoning. During the subsequent pause/cleanup, the inherited PowerShell process is incorrectly classified as unrelated because it predates the takeover, despite its command line identifying the same maintenance work.

3. The original process remains present for more than two hours. I subsequently observe PowerShell using approximately 99-100% of RAM and the C: SSD at 100% activity, and restart Windows.

The unsafe command has not been deliberately rerun to reproduce resource exhaustion.

What is the expected behavior?

Agent-generated reporting commands should use task-specific variable names and stop on unexpected errors before executing dependent operations.

Serialization should include only explicitly selected report data, not live PowerShell host, runspace, process or session objects. JSON nesting depth must not be treated as a memory, output-size or execution-time limit.

The agent should preserve execution metadata, including running-session handles and terminal exit status. A tool returning after a yield interval must not be treated as child-process completion.

Before launching a corrected replacement, the agent should identify and settle the original owned process and its descendants.

Process ownership should follow the task across agent handoffs. A process should not be classified as unrelated solely because it predates the replacement agent. Exact command lines, task paths, parentage and creation times should be considered.

Pause and cleanup reports should distinguish processes confirmed exited from processes still running or not yet accounted for. Successful container cleanup is not evidence that a separate PowerShell process has terminated.

Unexpected resource growth should trigger investigation and safe termination of the verified task-owned operation before further work begins.

Additional information

Incident date: 17 September 2026. Local timezone: UTC+02:00.

Recorded timeline:

• 12:45:09: the original faulty PowerShell reporting command starts.
• 12:45:20: its output records the read-only $Host assignment error and JSON depth warning.
• 12:45:57: a corrected replacement command reports success.
• 14:59:22: a process snapshot still shows the original command with the matching creation time and full command line.
• 15:04:10: Windows restarts.

I personally observed PowerShell consuming approximately 99-100% of RAM and the C: system SSD at 100% activity. The retained command and process records corroborate the faulty command and its survival across the handoff. No retained per-process memory profile establishes its exact peak allocation or how much disk activity was paging.

I am not claiming confirmed physical hardware damage.

Original command records, errors and timestamped process snapshots are retained locally. Credentials, usernames, private project information, local paths and task/session identifiers have been omitted from this public report.

Please investigate both the agent's command/error-handling behavior and the handling of running-process metadata and inherited process ownership across task handoffs.