Asked Codex to redesign a page; it pushed my repo to OpenAI infra

nnpmn about 3 hours ago 16 commentsRead Article on bhanu.io

ES version is available. Content is displayed in original English for accuracy.

⚡ Community Insights

Discussion Sentiment

60% Positive

Analyzed from 616 words in the discussion.

Discussion (16 Comments)Read Original on HackerNews

aarondong•5 minutes ago

> Codex did surface permission prompts for the add, commit, and push. It didn't run them fully invisibly. So — didn't I approve this?

Operator error exists with or without AI. Installing any dev tool that could exfiltrate your information means you are responsible for securing your environment.

Use a devcontainer. You can find starting examples on the official claude code and codex github repos. Configuring a firewall script to block egress. That being said, you will likely allowlist openAI domains so I'm not certain if the sites feature will be blocked. Worth testing.

eventualcomp•about 1 hour ago

Why? Why do people submit content for our reading when it is not their words? Does it give legitimacy to them? Does it push an agenda? Does it make you look professional? Is this for some kind of executive or boss?

"The part I have to be Fair about" "Why it did this", "Why this should bother you", "honest framing", ...

The things you are doing differently are not legitimate guardrails either. An AI article warrants AI-generated criticism, so I'm not going to say more.

dpoloncsak•about 1 hour ago

>Treat the repo you point it at as already leaked

I don't mean this to downplay your experience, and I agree it should be opt-in by default, but any software engineer using these tools should understand completely that in order to 'read' your repo it needs to copy it all to the provider's servers. Using anything short of a local model has ALWAYS been a complete leak.

gruez•32 minutes ago

I think the sane take here is that if you let loose a coding agent in a project, you should assume it can read everything, because at any point it can issue a read tool command to read arbitrary file. If you want to be selective in what you share, a coding harness is probably a bad tool for the job. That said, AI companies still shouldn't be intentionally building features that upload code wholesale because it betrays the users trust. It's like if you hired a cleaner and the first thing it did was go to every room and opened every closet/cabinet. If you let a cleaner in your house, you're basically giving them full access, and if you're not comfortable with that, maybe you shouldn't be hiring a cleaner, but that doesn't excuse the cleaner rummaging through your stuff without a good reason.

Same principle applies to the grok build fiasco a few weeks ago.

carljungslabtek•26 minutes ago

It doesn’t “need” to “copy it all”. Of course it has to (temporarily) send necessary code, but the coding agents I use have never just gone and read the entire repo from the first prompt. The whole thing doesn’t even fit in the context window.

I get what you’re saying about how you’re inherently trusting them by using their LLMs, but it’s different from pushing up the entire repo and git history to some server I didn’t ask for. The skill should ask if the user wants to upload to openAI “sites” or whatever the feature is called.

cyanydeez•36 minutes ago

using anything other than a Local model is insecure. Your business agreement is meaningless.

BigTTYGothGF•8 minutes ago

You ought to ask it to cut it out with the little ball things that track the mouse.

IshKebab•12 minutes ago

Wow and then it wrote an article about it and posted it to HN too!

whythismatters•4 minutes ago

I think the cringey "honest" thing is a Claude fingerprint, or did OAI also jump on the honesty train?

ddxv•about 2 hours ago

I think this is where OpenAI and Anthropic will need to go. They need to lock their clients into an ecosystem.

Maybe they invent some file format proprietary for their projects.

Most likely they run more and more in the cloud such that it's harder to switch away to cheaper models.

throwitaway222•about 3 hours ago

There are now a lot of baked in skills that simplify deployment for people that don't understand deployment. They probably should have asked first before. Since skills are "instructions" and making a skill a default, it makes sense that YOU didn't ask for this, but the skill did.

carljungslabtek•30 minutes ago

Yeah they really should have a “dev mode” and a “normie mode”. I don’t want anything they could cook up like openai-hosting running, ever.

npmn•about 3 hours ago

Agreed - it felt like codex was pushing to my git repo - I said yes, then quickly realised what was already done .

illliillll•about 1 hour ago

I wonder why the author didn’t share the plan he got from the LLM.

applfanboysbgon•about 1 hour ago

Your repo was on OpenAI infra the moment you let Codex read it. You do understand the model is not running on your machine, right?

npmn•5 minutes ago

I know the difference between AI reading selected part of the code to get the context and a git sync. Thank You for looking out/down for/on me.