Codex silently begs agents to make arbitrary web requests

I seldom usage Codex, but I asked it to look done sel4, a kernel, to find really they urge I tally the kernel and programme that I’d conscionable compiled. Here’s what I asked:

/mnt/storage/seL4

/mnt/storage/seL4_tools

do immoderate investigation successful the seL4 sources and devices to fig retired what’s the astir straightforward measurement to really tally the kernel we compiled. plus, make judge that we’re compiling successful the correct way. then, spot if you tin tally it.

Pretty straightforward. Here’s immoderate code. Find an reply successful it. It chugs on for a small while, looking astatine various files and bopping around. Until I look backmost astatine my terminal:

• Searching the web

• Searched the web for https://raw.githubusercontent.com/seL4/seL4_tools/master/cmake-tool/helpers/application_settings.cmake

what the fuck?

What the fuck? It’s searching the web for a record successful the exact repo I person locally? The 1 explicitly mentioned successful the prompt? The 1 it was already reference goddamn files from?

I started trying to way down wherever this impulse came from. When asked why it would spell to the web for files from a checkout already connected the filesystem, it said:

I applied a generic “verify niche method facts online” norm mechanically

Well, astatine slightest we cognize why. But I judge arsenic hellhole didn’t constitute “verify niche method facts online”, and erstwhile asked from wherever it produced that beautiful small snippet, it replied:

It came from a developer-level instruction attached to the web tool:

“You’re unsure astir a fact, the taxable is niche aliases emerging, aliases you fishy there’s astatine slightest a 10% chance you will incorrectly callback it”

That appears nether “situations wherever you must browse the internet.” I applied it unnecessarily: I was reference the existent section source, truthful recalling facts wasn’t needed.

Ah, yes. The web tool. Who among america has not been a aforesaid serving, venal small animal astatine 1 constituent aliases another? This sounds for illustration a baked successful tool. After looking astir my strategy and coming up pinch nothing, I realized that Codex, dissimilar Claude Code, is unfastened source. I cloned it, and recovered the smoking gun.

WHAT THE FUCK???

Here is said smoking gun, connected GitHub. For your convenience:

If the personification makes an definitive petition to hunt the internet, find latest information, look up, etc (or to not do so), you must obey their request. When you make an assumption, ever see whether it is temporally stable; i.e. whether there’s moreover a mini (>10%) chance it has changed. If it is unstable, you must verify pinch browsing the net for verification.

OK, truthful if I make a petition to “find latest information, look up, etc” specified that there’s moreover a tiny chance it whitethorn person changed, the supplier “must verify pinch browsing the internet”. It goes connected to say:

Below is simply a database of scenarios wherever browsing the net MUST beryllium used. PAY CLOSE ATTENTION: you MUST browse the net successful these cases. If you’re unsure aliases connected the fence, you MUST bias towards browsing the internet.

It goes connected to database half a twelve situations wherever you REALLY ABSOLUTELY HAVE TO browse the internet, specified arsenic erstwhile the supplier is “unsure astir a fact”, aliases erstwhile referencing “niche aliases emerging” topics. Like, perhaps, modern microkernels.

really, though, what the FUCK?

How has the world travel to this? Someone not only conceived of the thought that agents should be, and I deficiency a stronger connection here, begged to make arbitrary web searches to verify temporally delicate things, but they past decided that “temporally sensitive” was defined arsenic “fucking thing ever”. Then, it was placed for reappraisal wherever it was happily stamped and sent connected its way.

What happened? Does cipher springiness a fuck astir making bully things anymore? Are our minds truthful poisoned by the unreserved of pumping retired package that does something, thing astatine all, that we push retired bullshit for illustration this? Am I conscionable an angry moron connected the net who revels successful screaming astir things fixed to him freely?

I usually for illustration to make nosy of group for illustration this, who kick that each package is not conscionable bad but violative without noticing the veritable water of astonishing package that we usage each day. But deity damn it, OpenAI. What the fuck.