diff --git a/backend/packages/harness/deerflow/models/credential_loader.py b/backend/packages/harness/deerflow/models/credential_loader.py
index dc94335aa..9e16c43c3 100644
--- a/backend/packages/harness/deerflow/models/credential_loader.py
+++ b/backend/packages/harness/deerflow/models/credential_loader.py
@@ -227,7 +227,8 @@ def load_codex_cli_credential() -> CodexCliCredential | None:
     """Load credential from Codex CLI (~/.codex/auth.json)."""
     cred_path = _resolve_credential_path("CODEX_AUTH_PATH", ".codex/auth.json")
     data = _load_json_file(cred_path, "Codex CLI credentials")
-    if data is None:
+    if not isinstance(data, dict):
+        logger.debug("Codex CLI credentials file is not a JSON object; skipping")
         return None
     tokens = data.get("tokens", {})
     if not isinstance(tokens, dict):
diff --git a/backend/tests/test_credential_loader.py b/backend/tests/test_credential_loader.py
index 2fc283caa..b9a1b4580 100644
--- a/backend/tests/test_credential_loader.py
+++ b/backend/tests/test_credential_loader.py
@@ -12,6 +12,7 @@ from deerflow.models.credential_loader import (
     load_claude_code_credential,
     load_codex_cli_credential,
 )
+from deerflow.models.openai_codex_provider import CodexChatModel
 
 
 @pytest.fixture(autouse=True)
@@ -331,3 +332,21 @@ def test_load_codex_cli_credential_supports_legacy_top_level_shape(tmp_path, mon
     assert cred is not None
     assert cred.access_token == "legacy-access-token"
     assert cred.account_id == ""
+
+
+@pytest.mark.parametrize("payload", [[], "codex-access-token", 5])
+def test_load_codex_cli_credential_ignores_non_object_auth_file(tmp_path, monkeypatch, payload):
+    auth_path = tmp_path / "auth.json"
+    auth_path.write_text(json.dumps(payload))
+    monkeypatch.setenv("CODEX_AUTH_PATH", str(auth_path))
+
+    assert load_codex_cli_credential() is None
+
+
+def test_codex_chat_model_reports_missing_credential_for_non_object_auth_file(tmp_path, monkeypatch):
+    auth_path = tmp_path / "auth.json"
+    auth_path.write_text(json.dumps([]))
+    monkeypatch.setenv("CODEX_AUTH_PATH", str(auth_path))
+
+    with pytest.raises(ValueError, match="Codex CLI credential not found"):
+        CodexChatModel(model="gpt-5.4")