OpenAI built ChatGPT interfaces that keep running after answers appear

Finding

OpenAI’s Codex desktop client contains an undocumented GenUI architecture capable of delivering structured conversational interfaces, alongside a locally bundled catalog of 467 versioned “Learning Block” types.

How we verified

Methods: reverse engineering.

RuntimeWire independently extracted and analyzed the signed Windows distribution of OpenAI’s Codex desktop client. The package contains a 1.09 MB Learning Block runtime with 442 embedded manifests representing 467 unique type-and-version combinations. The client describes these objects to users as “Interactive learning block[s]” and includes dedicated rendering, control, caption, example, analytics and error-handling systems. Recovered metadata includes matched_type, server_learning_block_version, rendered_learning_block_version, initial_values, thumbnail_asset_key, widget_type and display_mode. Separate application code exposes a generic genui message type and an authenticated endpoint at: /conversation/{conversation_id}/message/{message_id}/genui/refresh_widget The associated client operation is named refreshGenUiWidget, with genui_refresh metadata. The code can also reinterpret a generic GenUI payload as a charts_widget_v2, indicating that GenUI is a broader delivery layer rather than another name for Learning Blocks. Learning Blocks identify their default render source as: CHATGPT_MATH_BLOCK_RENDER_SOURCE_GENUI_LEARNING_BLOCK This establishes the relationship supported by the code: GenUI is the underlying interface architecture, while Learning Blocks are a first-party family of interactive modules delivered through it. The package includes explicit fallback reasons—missing_matched_type, unsupported_matched_type and external_egress_blocked—showing that the server selects a block type and the client renders it only when the necessary local implementation and permissions are available. RuntimeWire found 901 visualization-related JavaScript chunks and 552 example-related chunks. Those numbers describe compiled files, not unique products. The defensible catalog count is 467 unique versioned types, recovered from the manifests themselves. Public OpenAI documentation describes the currently available Visualize feature, but does not document the GenUI name, its refresh endpoint, the Learning Blocks registry or the scale of the bundled catalog.

1. Parsed the supplied Codex `app.asar` without modifying the signed installation. 2. Verified its cryptographic hash against the installed package. 3. Indexed the webview assets. 4. Located the generic GenUI request and refresh paths. 5. Traced generic `genui` references into recognized widget types. 6. Identified the explicit `GENUI_LEARNING_BLOCK` source value. 7. Followed the Learning Block content-reference renderer. 8. Extracted the Learning Block manifest registry. 9. Mapped minified manifest variables back to 467 unique identifiers. 10. Counted manifest versions. 11. Recovered subject-group labels. 12. Traced visualization, controls, captions, thumbnails and examples. 13. Examined fallback, analytics, feedback and follow-up behavior. 14. Compared the findings with OpenAI’s public description of Visualize. 15. Separated confirmed client behavior from claims requiring server-side evidence.

Tested versions: Windows package: `OpenAI.Codex_26.820.7780.0_x64__2p2nqsd0c76g0` Internal application version: `26.820.60940` Build: `7119`.

Reproduction

RuntimeWire independently reproduced the core finding.

Obtain the same signed Codex Windows package. Record the SHA-256 digest of app/resources/app.asar. Copy the archive to a separate analysis directory. Extract it using an Electron-compatible ASAR utility. Locate webview/assets/learning-block-Cr6UKzy-.js. Parse the embedded manifests and deduplicate entries by their type and version fields. Confirm 467 unique type/version combinations. Search the remaining compiled bundles for:- refreshGenUiWidget - genui_refresh - /genui/refresh_widget - charts_widget_v2 - CHATGPT_MATH_BLOCK_RENDER_SOURCE_GENUI_LEARNING_BLOCK - missing_matched_type - unsupported_matched_type - external_egress_blocked Preserve screenshots, extracted strings, parsing output and hashes as the reporting record. Do not modify the installed or signed application.

File hashes

• 5DF8BF5A9D30742919390AB11FA419E83AAB0891152569A42C6EA4ABF15386C2

Company response

RuntimeWire requested comment; the company had not responded by publication time.