Codex Couldn't Load Its Resources? Update the Extension

If the Codex sidebar started showing The extension couldn't load its resources after openai.chatgpt updated to a 26.803 build, update through the VS Code Marketplace to 26.810.41047 stable or 26.5810.41047 pre-release. OpenAI released those builds on August 13, 2026 to fix the startup watchdog that could reject an initialization taking longer than 30 seconds. Roll back only when the fixed build is unavailable or fails a controlled canary.

Preserve the failing version, exact error, and logs before changing anything, then retest the fixed build against the same workspace. A blocked data:font request may appear nearby, but OpenAI did not identify it as the startup blocker, so do not weaken VS Code's Content Security Policy. If the updated extension remains stuck, check proxy, VPN, networking, and authentication separately before filing a new report.

Match the Resolved 26.803 Regression

Use this guide when most of the following are true:

• The installed extension is openai.chatgpt 26.803.41515 or 26.803.61601.

• The Codex extension host activates, but the sidebar never becomes ready.

• After roughly 30 seconds, VS Code shows Codex could not start and The extension couldn't load its resources.

• Codex logs include Webview did not finish starting.

• Developer Tools may show a font-src violation for a data:font/woff2 resource.

• Reloading the window, restarting VS Code, reinstalling the same version, or using a clean profile does not help.

OpenAI's Codex IDE guide confirms that VS Code and compatible editors use the Codex extension and normally open it through the Codex sidebar. The current failure happens before that sidebar finishes initializing.

Two independent reports on issue 37458 reproduced the same error on VS Code 1.132.0 for Windows. Later reports reproduced it on 26.803.61601. A separate Remote-SSH report in issue 37517 found the same message with the extension running on a Linux remote host.

Do not conclude that the CSP warning alone caused the failure. One reporter locally bypassed that warning for diagnosis and the webview still timed out. The strongest shared evidence was the controlled version comparison: the 26.803 builds failed while earlier Marketplace builds worked in the same environments. OpenAI's closing update says the new stable and pre-release builds remove the 30-second startup-watchdog failure. Issue 37458 is closed as completed, and issue 37517 is closed as a duplicate.

Record the Failing State First

Save open files and let any active terminal command finish. Then record the VS Code and extension versions:

code --version
code --list-extensions --show-versions

Find the openai.chatgpt@... line in the second command. Also copy these details into a private diagnostic note:

• operating system and architecture;

• local, WSL, container, or Remote-SSH context;

• VS Code version and commit;

• Codex extension version;

• the two-line visible error;

• whether Webview did not finish starting appears;

• whether the data:font CSP warning appears;

• UTC time of the failed startup.

Do not include ChatGPT tokens, API keys, private repository paths, workspace source, or unrelated log content. If the sidebar opens but an existing conversation reports an ownership error instead, use the separate active-writer handoff guide. That is a session-lifecycle problem, not this webview startup regression.

Update Through the VS Code Marketplace

VS Code officially supports installing a specific extension version. Use that built-in path:

1. Open Extensions with Ctrl+Shift+X on Windows or Linux, or Cmd+Shift+X on macOS.

2. Search for @id:openai.chatgpt.

3. Open the Codex extension's Manage menu.

4. Choose Update. If VS Code does not offer it, choose Install Another Version.

5. Select 26.810.41047 stable or a later stable build. Use 26.5810.41047 only when you intentionally follow the pre-release channel.

6. Restart the extension host when prompted.

7. Open the Codex sidebar and wait for it to become interactive.

If your organization pins approved extension versions, stop and ask the administrator to approve the fixed build. Do not work around an enterprise allowlist or install an unapproved package.

Keep auto-update enabled after the fixed stable build passes the canary. If the fixed build is not available for your platform, a temporary rollback to the last known working Marketplace build remains safer than modifying extension files or disabling signature checks.

This mirrors the safest pattern for any version-boundary regression: hold the workspace, account, editor, and network constant while changing only the affected extension version. The same controlled comparison is useful when diagnosing Codex CLI custom-provider regressions.

Handle Remote-SSH Separately

Remote environments can run a Marketplace extension on the remote extension host even when a different version is installed locally. VS Code's remote extension documentation explains that Remote-SSH, containers, WSL, and Codespaces can install their own Marketplace copy.

For Remote-SSH:

1. Connect to the affected host and keep that remote VS Code window focused.

2. Run Developer: Show Running Extensions.

3. Confirm whether openai.chatgpt is running locally or remotely.

4. Open Extensions in that same remote window.

5. Update the affected instance to the fixed stable build.

6. Reload the remote window and retest the sidebar.

A successful local update does not prove the remote copy changed. Record both versions when both instances exist.

Use a Signed VSIX Only When the Version Picker Fails

If Install Another Version cannot download the package, stay inside the official Marketplace workflow:

1. On the extension's Marketplace entry, choose Download Specific Version VSIX for the approved fixed build.

2. In the affected VS Code window, run Extensions: Install from VSIX.

3. Select the signed file you downloaded from the Marketplace.

4. Reload VS Code and verify the installed version again.

For Remote-SSH, run Install from VSIX while connected to the remote window so the package reaches the affected extension host. Do not download VSIX files from mirrors, disable extension signature checks, or modify the package.

Verify the Fix

The fixed build passes only when all of these are true:

• code --list-extensions --show-versions reports openai.chatgpt@26.810.41047 or a later stable version;

• the Codex sidebar becomes interactive without the 30-second timeout;

• a new disposable chat accepts a short read-only question;

• Webview did not finish starting does not recur;

• the workspace and repository files are unchanged;

• the affected remote instance, if any, reports the same working result.

Do not use an old production conversation as the first canary. A fresh read-only chat separates sidebar startup from session history, tool permissions, MCP servers, and repository state.

If the Fixed Version Still Fails

The shipped fix removes the watchdog error, but it cannot repair a separate request that never completes. Check these narrower branches instead:

• Run Developer: Show Running Extensions and confirm which host owns Codex.

• Run VS Code's Extension Bisect to detect an interaction with another extension.

• Test a clean profile without deleting the normal profile.

• Check whether the Marketplace download or enterprise policy selected the fixed version requested.

• Compare local and remote extension versions independently.

• Check proxy and VPN settings, then separate a pending account or authentication request from the resolved watchdog symptom.

• Attach sanitized startup evidence to a new upstream report when the fixed version still fails.

Avoid broad cleanup. Deleting the whole VS Code profile, changing webview CSP rules, disabling signature verification, or repeatedly reinstalling the same broken build removes evidence without proving a cause.

Verify the Shipped Fix Without Reopening GitHub Manually

Aident Loadout can check the upstream reports through a schema-inspected, read-only GitHub Action. Install or update Aident with this exact instruction:

Follow https://aident.ai/SETUP.md

Then give your agent this prompt:

Check my Aident Loadout account authentication and Vault status. Search the staging capability catalog for a connected read-only GitHub issue Action, inspect its current schema, and preflight the exact request. If the estimate is free, return only the state, state reason, closed time, latest maintainer comment, and URL for openai/codex issues 37458 and 37517. Do not comment, edit, close, label, publish, install, change files, start OAuth, or ask me for GitHub credentials.

Success is measurable: authentication and Vault checks complete; capability discovery, schema inspection, and preflight succeed; both issue summaries show the shipped resolution; and no GitHub write or credential request occurs. Set up Aident Loadout and verify the Codex extension fix.

For a closely related guide, read Codex Chats Disappeared After an Update? Recover Safely.

Sources

• OpenAI's stable-fix announcement on Codex issue 37458

• OpenAI Codex issue 37517: Remote-SSH webview startup failure

• OpenAI Codex issue 37508: related extension startup report

• Official OpenAI Codex IDE extension guide

• Official VS Code extension Marketplace documentation

• Official VS Code remote extension documentation

Refresh this guide when OpenAI supersedes the fixed builds, changes the remaining proxy or authentication guidance, restores Windows packages to Open VSX, or VS Code changes its specific-version installation workflow.