It created 2 new users and then assigned new NTFS permissions for every single file under my user directory to them. This of course wrecked havoc, ssh refused to work, several applications refusing to start and a ton of permission errors. It did this without even a warning in the background and it also does not undo any of it when you uninstall it.
It took around 3 hours to fix it by updating ~10 million NTFS permissions for every single file under my user directory.
I’ve been using Codex in full access mode constantly for the past couple months on a Pro plan and I haven’t had a single incident like this. I’ve used it across macOS, Linux, and Windows as well, so my usage isn’t limited to a specific setup either.
That is not how it works: the "but it works for me" is a logical fallacy.
Haven't you followed a bit all the posts about models, for example, escaping their environments?
The "but it works for me" is a random data point: an anecdote.
That there are people / companies where models ran wild and destroyed files / messed up projects is a fact.
When there are documented cases of stuff gone wrong, people must find ways to protect their data.
We literally see posts frontpage, daily, about AI sandboxing and we regularly see posts about AI escapes or AI SNAFUs.
And you come and post "show me your prompt, for it works on my machine"...
https://medium.com/conquering-corporate-america/10-tricks-to...
For instance recently, media downloads on my NAS became quite a bit slower. I asked it to investigate and it quickly got back to me saying the issue was the ethernet link had been downgraded to 100Mbps from 1Gbps. It even went through journalctl to tell me when this had happened. To fix it I just had to plug an ethernet cable out and back in. Now this is the kind of thing, earlier I would have to spend an evening on. But given an open system like Linux, a well made safe model just makes it so much more accessible than having to RTFM for one off things I am sure to forget in a month.
I dont really let it run loose through my systems, and keep an eye on the thinking traces it puts out and the permissions it asks for. But now I dont have to slog through manuals and deal with gruff people on the internet. I can choose to do so after the fact, depending on how much free time and curiosity I have.
It’s a prison of your own making.
I’ve personally adopted a process where I structure my projects to ALWAYS keep credentials and sensitive information in a separate directory.
The working copy gets rsynced to and from a dedicated VM with whatever $HARNESS.
And for your hypothetical client.
Especially as judging by your description they despite this allow any VSCode plugin to be installed alongside it.
> and I am not making my life miserable to work with editors lacking the specific tools
And that’s the self-imposed prison I was talking about, there’s always alternative tools. In my mind a specific tool is something like Ghidra.
Sectors involved in, in no particular order: government, financial, telecom, energy (gas and electric), manufacturing (large european conglomerates), healthcare, logistics
In fact I was the one usually helping IT Teams put the torture devices and policies you’re subjected to in place lol.
Banks would usually give us laptops with smart card readers and only allowed access to their VPN from a limited set of public IP addresses.
Govt was a bit more lax, but same principles applied, was really fun doing any kind of work over a laggy VNC.
My favourite one was probably where you’d have to hop from one Azure cloud VM, to Citrix to a bastion windows box, off of which you’d RDP to the actual work VM only to putty to the actual damn Linux box you cared about.
Energy sector was more lax, they let us set up a GitLab instance and a small CICD setup to which we’d push the code developed on our local boxes.
Oh and the ones I mentioned - they usually ask us what tools we wanted on our boxes as well.
I would rather live in a shopping cart tent under a bridge.
Weak argument. People don't have infinite time. People just want tools they trust and that aren't enshitified.
In fact, VSCode’s support for Lean is via LSP anyways.
Manual tool calls. I ask AI to give me all the necessary reconnaissance commands, then I run them myself on the host and paste the output on the terminal with the SSH connection into the guest virtual machine where the harness is running. The AI then either figures it out and gives me the answer or runs additional tool calls by me. Repeat until annoying task is done, interrupt if anything suspicious shows up at any point.
If you can’t make that judgement call because of lack of knowledge/familiarity it’s okay - spawn a new fresh chat, get up to speed on the topic first and then resume.
That way you accomplish three things: you learn something new, you fix your problem and you don’t let a Trojan do whatever the hell it wants to your box which among other thing contains all the browser sessions and cookies :)
Also note, that RAG and even vector search are more paths of the early days that didn't prove too valuable. Just let your agent search it directly and optionally create an index as a default entrypoint for common topics.
I guess OpenBSD is the only OS where I never had any problem with Bluetooth audio.
So, yes, I would say agents are pretty good at working with Bluetooth on Linux
- I inspect the agent's changes, and only apply them - at once - if they are OK. So I have no half applied bad changes to my system, and I can catch critical mistakes before they are applied.
- I can roll back the changes by just doing a `git revert` and reapplying
- The agent cannot read secrets or unrelated data, just config.
- The agent gets the full configuration of all systems at once, without having to maintain parallel documentation (which can get out of sync) or rediscover each time from scratch (access my running systems, for example with `ssh root@server`).
- It's harder for the agent to miss some aspect of the configuration, because it's all in my dotfiles. If it's not there, it's nowhere
Also in the news: https://www.whitehouse.gov/presidential-actions/2026/08/expa...
"The American private sector is the most innovative and
technologically advanced in the world, and its scale,
speed, and capacity secure a critical offensive cyber
advantage for the United States."Since we now have three "Codex"es, I think it's worth specifying you're talking about codex-cli/tui. Codex the hosted version and Codex the GUI are both fully proprietary I think (besides the codex-cli/tui parts they use, I'm guessing mainly the app-server stuff).
Or we are just assuming that was a PR stunt, which it almost certainly was.
Either way, this shit isn’t getting near my system.
No.
> Or we are just assuming that was a PR stunt, which it almost certainly was.
It wasn't.
> Either way, this shit isn’t getting near my system.
Sounds about right.
> It wasn't.
Prove it. But you can’t, which is problematic for you.
Nobody should believe anything OpenAI says about anything. They either lied about it breaking out of a sand box, or they’re incompetent by building a sandbox their AI could break out of.
It’s a cute story, though.