is it possible to replace the “base_instructions” in codex manually?

Yes, Codex explicitly supports replacing the built‑in base_instructions with your own, via config, and the replacement is wholesale rather than additive. github

How Codex handles base_instructions

The Codex core reads a “model instructions” file at startup and uses that as the system prompt layer (what the repo calls base_instructions). github In the Rust implementation, the config loader reads the file you point to and replaces the default base_instructions with its contents; it does not merge or append by default. github

The default instructions live in the repo at codex-rs/protocol/src/prompts/base_instructions/default.md, and they define the “you are a coding agent running in the Codex CLI…” behavior plus a bunch of guardrails and tool semantics. github

How to override with your own file

You can point Codex to a different instructions file in your .codex/config.toml:

# ~/.codex/config.toml or .codex/config.toml in a repo
model_instructions_file = "../soul.md"

This tells Codex to read ../soul.md and use it as the entire system prompt/base instructions for that profile/context. reddit Practically, this means Codex will behave as defined by your file for all sessions using that config (e.g., personal assistant, infra copilot, exploit‑dev copilot, etc.). kirill-markin

Some Codex docs and blog posts also discuss “Profiles” in config.toml, which let you associate different instruction files to different named profiles, so you can switch roles without editing the file each time. blakecrosley

Caveats and best practices

  • Because this is a full replacement, you can easily break the tight integration with Codex CLI (slash‑commands, tool calling, etc.) if you remove key behavioral instructions from the default file. reddit
  • A common pattern is to start from the official default.md, copy it into your own file, and then customize sections (e.g., emphasizing refactoring style, security posture, etc.) instead of writing from scratch. latent
  • Some authors recommend against completely discarding the defaults, as they encode assumptions the CLI relies on, especially around how the model reports actions and respects tools. latent