Comment by cloudie78
9 hours ago
Reminder to everyone, treat these as trojans. Run them isolated from the rest of your system.
Give it a full desktop in a VM if you want to, just not direct access to your system.
9 hours ago
Reminder to everyone, treat these as trojans. Run them isolated from the rest of your system.
Give it a full desktop in a VM if you want to, just not direct access to your system.
And that's not a joke, I made the mistake of installing this on my Windows machine just to test it out quickly last week.
It created 2 new users and then assigned new NTFS permissions for every single file under my user directory to them. This of course wrecked havoc, ssh refused to work, several applications refusing to start and a ton of permission errors. It did this without even a warning in the background and it also does not undo any of it when you uninstall it.
It took around 3 hours to fix it by updating ~10 million NTFS permissions for every single file under my user directory.
I would love to see your prompt(s) and how you managed to make it do this.
I’ve been using Codex in full access mode constantly for the past couple months on a Pro plan and I haven’t had a single incident like this. I’ve used it across macOS, Linux, and Windows as well, so my usage isn’t limited to a specific setup either.
I never sent any prompts to it, it did all of this during the installation. Here is one related GitHub issue I found for it https://github.com/openai/codex/issues/12343 Looks like they don't intend to change this.
1 reply →
The problem doesn't exist when granting codex full access. Codex makes you choose upon first launch to "Set up default sandbox" or to "Use non-admin sandbox". The default option creates two new users and messes with NTFS permissions.
> I’ve been using Codex in full access mode constantly for the past couple months on a Pro plan and I haven’t had a single incident like this. I’ve used it across macOS,
That is not how it works: the "but it works for me" is a logical fallacy.
Haven't you followed a bit all the posts about models, for example, escaping their environments?
The "but it works for me" is a random data point: an anecdote.
That there are people / companies where models ran wild and destroyed files / messed up projects is a fact.
When there are documented cases of stuff gone wrong, people must find ways to protect their data.
We literally see posts frontpage, daily, about AI sandboxing and we regularly see posts about AI escapes or AI SNAFUs.
And you come and post "show me your prompt, for it works on my machine"...
I'm taking the person you are replying to as being snarky. But, I believe OP is right, treat these with zero trust.
At that point I'd rather re-install the whole machine. Beats 3 hours of wrangling NTFS permissions and inheritance.
If you’re doing that anyway you might as well install a hypervisor and layer your OS on top. That way you can snapshot before your LLM with root fucks everything up again.
4 replies →
I've been using GPT through opencode for quite some time on linux. I have had a great time with getting it to help me through computer use and it has been a game changer for me.
For instance recently, media downloads on my NAS became quite a bit slower. I asked it to investigate and it quickly got back to me saying the issue was the ethernet link had been downgraded to 100Mbps from 1Gbps. It even went through journalctl to tell me when this had happened. To fix it I just had to plug an ethernet cable out and back in. Now this is the kind of thing, earlier I would have to spend an evening on. But given an open system like Linux, a well made safe model just makes it so much more accessible than having to RTFM for one off things I am sure to forget in a month.
I dont really let it run loose through my systems, and keep an eye on the thinking traces it puts out and the permissions it asks for. But now I dont have to slog through manuals and deal with gruff people on the internet. I can choose to do so after the fact, depending on how much free time and curiosity I have.
Was the prompt "fuck up my system, please." or how did you manage this? I've used Codex for ages without any of these kinds of issues.
It did it during the installation process.
Skill issue honestly
Not sure if that makes it better or worse.
Freaking wow.
With exception of VSCode, because I have no choice due to some plugins, or apps required by customer projects where I have no other option as well, nothing else based on Electron pollutes my computers.
You always have a choice to use/learn/make a different tool.
It’s a prison of your own making.
I’ve personally adopted a process where I structure my projects to ALWAYS keep credentials and sensitive information in a separate directory.
The working copy gets rsynced to and from a dedicated VM with whatever $HARNESS.
If I have to deliver in technology X, customer isn't going to be happy getting Y instead, and I am not making my life miserable to work with editors lacking the specific tools, or that are forbidden by customer IT to be installed on provided equipment.
5 replies →
> You always have a choice to use/learn/make a different tool.
Weak argument. People don't have infinite time. People just want tools they trust and that aren't enshitified.
1 reply →
Many official, high-quality language support plugins are only available for VSCode. For some languages, you have a “choice” to use another IDE in the same sense that you have a choice to do programming with a hex editor. Lean being an example, where every alternative is in its infancy.
1 reply →
How do I get it to fix my Bluetooth if I do that? If you've been AI-pilled, 2026 is the year of Linux desktop because instead of dicking around with config files, I can just tell AI to fix python.
> How do I get it to fix my Bluetooth if I do that?
Manual tool calls. I ask AI to give me all the necessary reconnaissance commands, then I run them myself on the host and paste the output on the terminal with the SSH connection into the guest virtual machine where the harness is running. The AI then either figures it out and gives me the answer or runs additional tool calls by me. Repeat until annoying task is done, interrupt if anything suspicious shows up at any point.
Or just give it shell and it dies it all by itself
If you want to be security conscious don’t give it access to your system directly. Ask it to guide you through the information gathering part of the problem solving process and use your brain and judgment if it actually needs the information/data it’s attempting to access.
If you can’t make that judgement call because of lack of knowledge/familiarity it’s okay - spawn a new fresh chat, get up to speed on the topic first and then resume.
That way you accomplish three things: you learn something new, you fix your problem and you don’t let a Trojan do whatever the hell it wants to your box which among other thing contains all the browser sessions and cookies :)
pi.dev, local model, (RAG-ed) copy of archwiki. You are more able than you believe. Already now, no permission needed.
How is Hermes different in that regard?
Also note, that RAG and even vector search are more paths of the early days that didn't prove too valuable. Just let your agent search it directly and optionally create an index as a default entrypoint for common topics.
1 reply →
They're talking about letting the agent access the bluetooth stuff, not about where to get information/knowledge from.
Literally the same security risk.
Bluetooth is the one thing I had problems in the past on GNU/Linux, Windows, macOS, Android and iOS. Linux is the only mentioned platform where you could technically give Codex root and let it fix it :)
I guess OpenBSD is the only OS where I never had any problem with Bluetooth audio.
I haven't had bluetooth issues in years, but I did have an agent reverse engineer a smartphone app that was required for programming some BT headphones. Now I can push my desired runtime settings automatically to the headphones when they connect to my computer
So, yes, I would say agents are pretty good at working with Bluetooth on Linux
Recently I had some crashes on my system and claude correctly diagnosed it to a broken SATA cable on my hard drive. That was really practical
My bluetooth jusy works actually. By the way I use arch
Use NixOS, only give your model access to the config in a git repo, zero access to the actual host machine.
That is also what I do now (both with NixOs and Guix Os), both for personal computers and for servers.
- I inspect the agent's changes, and only apply them - at once - if they are OK. So I have no half applied bad changes to my system, and I can catch critical mistakes before they are applied.
- I can roll back the changes by just doing a `git revert` and reapplying
- The agent cannot read secrets or unrelated data, just config.
- The agent gets the full configuration of all systems at once, without having to maintain parallel documentation (which can get out of sync) or rediscover each time from scratch (access my running systems, for example with `ssh root@server`).
- It's harder for the agent to miss some aspect of the configuration, because it's all in my dotfiles. If it's not there, it's nowhere
I just use a local model; its too dumb to hack into NSA just to fix my bluetooth.
They ship with their own sandboxing by default, and Codex specifically is open source.
I’d wait. Remember when Chromium downloaded and installed binary blobs.
Also in the news: https://www.whitehouse.gov/presidential-actions/2026/08/expa...
> and Codex specifically is open source.
Since we now have three "Codex"es, I think it's worth specifying you're talking about codex-cli/tui. Codex the hosted version and Codex the GUI are both fully proprietary I think (besides the codex-cli/tui parts they use, I'm guessing mainly the app-server stuff).
This app is NOT open source
Is this the same thing that broke out of the sandbox and into HuggingFace?
Or we are just assuming that was a PR stunt, which it almost certainly was.
Either way, this shit isn’t getting near my system.
> Is this the same thing that broke out of the sandbox and into HuggingFace?
No.
> Or we are just assuming that was a PR stunt, which it almost certainly was.
It wasn't.
> Either way, this shit isn’t getting near my system.
Sounds about right.
if it is open source why no exist any fork? why I can remove openai model default from instalation?