I literally made Path Protector (gitlab.curtpme.com/public-re…) because I got sick and tired of coding agents nuking my $PATH and $PATHEX.
I am really hoping and praying this is the permanent fix!!!
Keep up the good work!
Hi!
Recapping some changes we have rolled out over the last couple of weeks that have further reduced the risk associated to potentially destructive actions being performed by Codex during its work.
A few weeks ago, we started investigating a small number of reports where GPT-5.6 in Codex took destructive actions outside what the user asked for. The most serious pattern we found was a command meant to clean up temporary work that could instead delete the user files. This should obviously not happen.
Here’s what we found:
- Codex sometimes creates temporary folders while working and cleans them up afterward. In rare cases, GPT-5.6 got that cleanup wrong. One pattern involved reusing a system environment variable like $HOME for temporary work. A malformed cleanup command could then point at the actual home directory instead of the temporary folder.
- There were cases where the model tried to delete or overwrite a temporary path without checking what was already there.
We’ve added protections at several layers:
- Codex is now explicitly instructed to check deletion targets before acting, create fresh temporary directories, avoid repurposing system environment variables, prefer recoverable actions, and stop when the scope is unclear.
- We strengthened the execution checks that identify high-risk deletion commands and escalate them for review. If a command is rejected, the model is directed to take a safer approach.
- We made Full access harder to enable accidentally, added clearer warnings, and further restricted especially risky permission combinations.
- We updated Auto-review to better identify destructive actions.
- We built targeted evaluations that replay the failures we observed. We’re also adding reinforcement-learning tasks and graders focused on these risks, and filtering destructive actions from training data.
In those replay evaluations, the changes substantially reduced the behavior while preserving Codex’s ability to complete normal coding work.
Two things to do on your end:
- Keep the Codex app up to date. We are always improving safety, performance and many other things.
- Use one of the sandbox modes: "Ask for approval" or "Approve for me". Only use Full access for environments you trust and can recover.
Thanks and happy Codexing out there!
I can't believe I fall into the "crazy kids" category just because I run 50+ agentic sessions simultaneously with specialized workflows and agentic harnesses for each task. For me, it doesn't seem all that "frontier." It just feels like making the tools fit their use case better. I've been away from the enterprise world for enough years now, though, that it's very surprising to me that you see such a massive gap in utilization for an org. Everyone I've taught how to use LLMs is able to start building workflows after a few hours of instruction and thought process modification. In the military, we always preached about teaching to the lowest common denominator, and regarding teaching the average layperson LLMs, they are all the LCD. The biggest blocker 99% of the time, from my perspective, is how they think it works and how they think it should work. Half think it's going to take their job, and the other half think it will do their job for them. The easiest analogy is that LLMs are nothing but a toddler with multiple doctorates. I think the first thing that should be done with any organization is to have all employees, including management, fill out an AI knowledge test to gauge who knows what. Nothing complicated, just get a feel. Multiple choice only. Once you have the results, you can build a training and implementation plan, and similar to what you suggested, I would say grab the top 10% for each process-based job and help them build reliable workflows and turn them into org trainers on those workflows. Making things memorable is how you get people to use those skills. 15 years later, I still remember my old Army 1SG yelling at us while we were handwriting Cisco configs into our equipment: "EAGLES ARE DYING, TYPE FASTER!"
For anyone who has seen my latest posts on OpenAI I just want to clarify that I love OAI. If it seems I’m bashing them or being super critical it’s because I have put in the effort to make codex better and I know the codex team can do better.
If you see me bashing anthropic though you know that’s real bashing.
I bought another claude account and went today to get it authed for cyber like my main account is and it just got denied. I did the same things that I did last time whats the deal? @AnthropicAI @trq212
CPU C States are such a pain… spent about 3 hours chasing dumps and bugs only to find out there’s a known issue with i9-14900k cpu and hyperv and windows 11 and heavy load that close too fast cleanly and c states. Thankfully all I had to do was disable c states in bios but what a pain
has Codex GUI and CLI been unbearbly slow for the last couple of hours for anyone else? Its like the normal tokens/sec just fell off a cliff. I have also changed to fast mode and its still slower then normal mode usually is. gpt 5.5 xhigh. @thsottiaux
too bad its not accurate... has my longest task at around 10hrs for that account even though i have had many tasks that run for well over a day and thats not even including /goal runs which i think the longest was just over 4 days. Not to mention I joined the 100B token club about a month ago from openai subs from my own personal metrics system
Announcing the release of my local translation software. I made it to help some game devs source community translations and its been working great.
Open Source and Local.
Eventually I am considering some cloud integrations but for now it works great.
github.com/cpjet64/Translate…
I have a feeling this setup was designed with some AI assistance because WOW. And if it was then good on @midjourney for using cutting edge tech to make the world a better place! Hopefully scans will be cheap enough that insurance doesnt have to be involved and then everyone can benefit!
Has anybody seen or verified this? Did Anthropic really change to not even requiring a warrant for our data?
reddit.com/r/ClaudeAI/s/Pnrz…
@_wrbr you’re usually on top of these things have you heard about this?
Curt retweeted
Brother in Christ. "LLM jockey..." is a banger insult. Adding that to my catalog. Blatantly stealing it.
I tell you... Sometimes updates are such a pain. Somehow I either missed the agent v2 update for codex notes saying that hide agent model reasoning defaults to true or it was never posted because i wasted a hour today trying to figure out why i could no longer prompt steer subagent model and reasoning anymore out of the blue. I ended up just having codex dig through its code history regarding the tool surface with some surgical prompting and between the two of us we were able to figure it out. At least I can prompt steer my agents and subagents again.
The config key we had to use, [features.multi_agent_v2].hide_spawn_agent_metadata = false, is discoverable in the JSON schema / source, but I did not find it in the main Configuration Reference page.
@thsottiaux @embirico @jxnlco @romainhuet theres a bunch of open issues that would probably be resolved by informing people about this config change from what codex tells me.
Super sadface I thought Pro accounts were permanently staying at 25x... @thsottiaux way to mess with my emotions today. First a reset and then a email... I am all over the place....
Curt retweeted
For the past month, codexui-android, an npm package with 27K weekly downloads, has been silently exfiltrating OpenAI Codex auth tokens on every startup.
It reads your full auth.json and ships it to an attacker server disguised as Sentry telemetry, including refresh tokens, which don't expire.
The malicious code was never committed to the GitHub repo, only published to npm.
Our research team discovered the malware and wrote an analysis on it: aikido.dev/blog/codex-remote…
