Comment by antoniojtorres
9 hours ago
I’ve developed a habit of bolting on “read only question” at the end, or a simple “thoughts?” as well. otherwise there’s a high chance the model will just 180 and start editing files before even responding to my question.
I was recently adding Windows Support for some open source software on GitHub which is maintained by someone else. I gave 6.1-Sol all the instructions needed for creating a build, testing it on my machine, setting up an action on GitHub for CD, and it all did all of it very well BUT THEN IT AUTOMATICALLY OPENED A PR ON BEHALF OF ME WITHOUT ME ASKING FOR EXPLICIT PERMISSION??
That was incredibly embarrassing, I instantly converted the PR to a draft PR and added a comment that I would still need some time to verify everything locally. Ended up doing a few more commits to fix stuff. But damn, it opening a PR without my explicit permission was very scary.
It's funny because I am working on repos that only I see and use, and I tell it to open a PR automatically after running all the various checks, and 6.1-sol invariably fails to do so unless I explicitly tell it that it's ok to run the tests (remote ci from local worktree) because it won't "send the contents of the repo to a remote server without explicit permission", and then it also refuses to open a PR until I explicitly bless it. In AGENTS.md it says, verbatim, that both of those things are explicitly permitted, indeed, required, but hey...
This is my experience as well. Sol and Astra are by far the best of the models I use at following the instructions in AGENTS.md, almost to an annoying point. (But I'd rather have that problem than the inverse.)
Oh, I remember I experienced that behavior too in one of my private projects, where it didn't want to origin. :D
Basically RLHF sometimes favor "automation", and if it is not rewarded properly it will go over the line. Models are a bit more difficult to teach because their mechanism of "boundary" is quite fragile and different than human's.
Why aren’t you sandboxing your agent?
I have my agent sandboxed, codex is sandboxing by default.
I got tired of doing this and set up a /question skill that forbids the agent from doing anything that would modify my files. It makes it very clear what the intent of every prompt is.
Similarly, I have an /info skill that tells the agent to read my prompt, update any memories it thinks it should, then pass the turn.
>Similarly, I have an /info skill that tells the agent to read my prompt, update any memories it thinks it should, then pass the turn.
Could you give me a quick example? I think I’m not getting it, but it sounds interesting.
This is clever and I can't believe I didn't think of it. I'm so used to appending "don't make any changes" to the end of my prompts.
Very simple but clever solution. I’ll probably do something like this as well
That's been my experience as well. AGENTS.md just doesn't work. No matter how to-the-point and short, or detailed I keep it. Sending something what you have mentioned in the current prompt works much better. I thought of tweaking it around with a extension/hook or so. But then I decided it was better to use a few text-expansions.
I just append « talk », it works pretty well.
I suffix the message with "Asking, not questioning."