upvote

points

by matheusmoreira20 hours ago |
comments
upvoteby oefrha19 hours ago|
next
[-]
As long as the email is in the context, which it is IIRC, it can totally decide to run curl –H 'User-Agent: <your email blah blah>'. You need to have a pretty poor understanding of LLMs to think this is a deterministic problem of reading user agent builder source code. Unless you found explicit filter code that blocks the behavior, that is. LLM info leaks to third parties mostly aren’t deterministically coded behavior.

Edit: I’m not completely sure if Codex injects email into system prompt (not at the computer, can’t check, but IIRC the model does know my org domain), but even if it doesn’t, it will be in the context as soon as it makes a git commit anyway.

reply
upvoteby matheusmoreira19 hours ago|
parent|
[-]
I never claimed the LLMs themselves couldn't "accidentally" leak the information through. Obviously, the LLMs can do anything they want.

The issue here is whether the harness is doing it. Claude Code is doing it. Codex is not.

reply
upvoteby oefrha18 hours ago|
parent|
[-]
The problem here literally is the non-deterministic model cooking up commands with the user email address in the header, and the harness not blocking that (and the implemented fix is to deterministically block that), not the harness deterministically hardcoding the email in the web search tool. No technical report I’ve seen has claimed the latter, although this particular linked report which is low quality and vague can be misinterpreted as that.
reply
upvoteby matheusmoreira18 hours ago|
parent|
[-]
> although this particular linked report which is low quality and vague can be misinterpreted as that

Seems that way... Here's how I interpreted it:

> claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission

"Claude Code" refers to the harness, not the model. Web search is also one of the tools provided to the model by the harness.

https://code.claude.com/docs/en/tools-reference#websearch-to...

https://platform.claude.com/docs/en/agents-and-tools/tool-us...

reply
upvoteby oefrha18 hours ago|
parent|
[-]
And that’s why you shouldn’t have blindly trusted a single low quality report with ambiguous language and zero technical detail (and worse, trusted one interpretation of the vague language). It’s okay to spend time to understand the problem and think critically yourself.
reply
upvoteby matheusmoreira15 hours ago|
parent|
[-]
No need to be so hostile. It's not unreasonable to assume the problem is in the harness when the issue says things like "it needs to be removed from the harness entirely".
reply
upvoteby 19 hours ago|
prev|
next
[-]
deleted
reply
upvoteby lukan20 hours ago|
prev|
next
[-]
I would not recommend of getting in the habit of just trusting that.

"For the record, I just asked Astra to verify that Codex does NOT do this, and it doesn't. Thanks for not screwing this up, OpenAI."

reply
upvoteby matheusmoreira19 hours ago|
parent|
[-]
Astra checked the Codex source code that gets compiled and shipped by Arch Linux. Straight up linked me to the User-Agent builder code.

https://github.com/openai/codex/blob/687a119f0fcaace47e1f1ab...

That's more than sufficient for me. The open source codex client seems clean.

There is some kind of "hosted search service" that I couldn't verify. I don't have a remote server I can point it at in order to inspect the traffic. Would be cool if someone else could shed some light on that.

reply
upvoteby agentdev00115 hours ago|
parent|
[-]
Hosted search service sounds like its referring to the alpha/v1 web_run hosted search api. Alternative to the hosted websearch tool, which is a tool- rather than api surface
reply
upvoteby hendiatris20 hours ago|
prev|
next
[-]
You asked it to verify it doesn’t do this? That allayed your fears?

доверяй, но проверяй

reply
upvoteby matheusmoreira19 hours ago|
parent|
[-]
I read the codex source code it linked me to.
reply
upvoteby yubblegum19 hours ago|
parent|
[-]
Unless you are building from source yourself that means exactly and precisely zip.
reply
upvoteby matheusmoreira19 hours ago|
parent|
next
[-]
I'm using the codex package from the official Arch Linux repositories.

https://gitlab.archlinux.org/archlinux/packaging/packages/op...

It is sourced from the GitHub repository.

reply
upvoteby noir_lord18 hours ago|
parent|
prev|
[-]
Did you also build the compiler?

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

> Perhaps it's more important to trust the people who wrote the code

Yeah... about that.

reply
upvoteby yubblegum18 hours ago|
parent|
[-]
> > Perhaps it's more important to trust the people who wrote the code

> Yeah... about that.

Well done. You presented a straw man and drag poor Ken into this, and then proceeded to burn it. +1. Yeah, it is precisely about the people behind the product. To wit, I may not have liked the Gophers but I did trust them to build a trustworthy compiler.

reply
upvoteby cadamsdotcom19 hours ago|
prev|
[-]
Why not find out the truth instead of putting a hallucinating probability box in between you and the truth.

One way would be to fire up a little web server locally, have the agent make a request to it, then check the logs.

reply