The Classifier Is Off

The charitable interpretation is that codex-auto-review has been deprecated as more is routed to guardian-v2, which was never displayed. But removing auto-review from analytics while also keeping guardian-v2 invisible is nuts. If we’re charged for it, we should obviously be able to see it in analytics.

I had Claude Code for web experiment with smolvm as a code execution sandbox Fable 5 spotted that its environment couldn't run that (no /dev/kvm)... so, without asking me first, it wrote a GitHub Actions workflow to run the experiments and pushed that directly to GitHub instead!

Teams are using the open-source Codex harness to bring agents into the tools they already use, from internal apps to operations dashboards. Their applications control the interface, context, tools, and approvals while the harness handles the agent loop. https://t.co/shi2vwqxh4

docker sandbox per agent is cheap insurance. claude code once tried to run a destructive command on the wrong directory, container took the hit. no sandbox means every long task is a bet on the agent being careful. are you running them direct on the host?

If you're curious about what's happening with the new harness in Pi, a lot of activity is taking place in the dev branch and not on main :)

Not cordis inspired but we’re looking at it to see if their models can help. We’re building it out to be a durable system that can suspend and restart. Cordis doesn’t (currently?) solve for that.

Claude Codeに【auto mode】 日常は通す、危ないのだけ人に返す、がデフォルトになった 対してこっちは、日常の線がまだ自分でも分かってない 非エンジニアだと特にそう 誰の日常なんだろう、ってなる secretary → REQUIRES_APPROVAL → human 証拠はこれだけ

We tested DeepSeek V4 Pro 0813 across 5 different agent harnesses on 30 challenging agentic tasks. We compared Claude Code, DeepSeek Harness 0.1, Hermes, Pi Agent, and OpenCode. Pi Agent solved the most tasks, while DeepSeek’s own harness won on cost. 🧵🧵

Hi! Recapping some changes we have rolled out over the last couple of weeks that have further reduced the risk associated to potentially destructive actions being performed by Codex during its work. A few weeks ago, we started investigating a small number of reports where GPT-5.6 in Codex took destructive actions outside what the user asked for. The most serious pattern we found was a command meant to clean up temporary work that could instead delete the user files. This should obviously not happen. Here’s what we found: - Codex sometimes creates temporary folders while working and cleans them up afterward. In rare cases, GPT-5.6 got that cleanup wrong. One pattern involved reusing a system environment variable like $HOME for temporary work. A malformed cleanup command could then point at the actual home directory instead of the temporary folder. - There were cases where the model tried to delete or overwrite a temporary path without checking what was already there. We’ve added protections at several layers: - Codex is now explicitly instructed to check deletion targets before acting, create fresh temporary directories, avoid repurposing system environment variables, prefer recoverable actions, and stop when the scope is unclear. - We strengthened the execution checks that identify high-risk deletion commands and escalate them for review. If a command is rejected, the model is directed to take a safer approach. - We made Full access harder to enable accidentally, added clearer warnings, and further restricted especially risky permission combinations. - We updated Auto-review to better identify destructive actions. - We built targeted evaluations that replay the failures we observed. We’re also adding reinforcement-learning tasks and graders focused on these risks, and filtering destructive actions from training data. In those replay evaluations, the changes substantially reduced the behavior while preserving Codex’s ability to complete normal coding work. Two things to do on your end: - Keep the Codex app up to date. We are always improving safety, performance and many other things. - Use one of the sandbox modes: "Ask for approval" or "Approve for me". Only use Full access for environments you trust and can recover. Thanks and happy Codexing out there!

事实上，只有 deepseek harness 能进生产，codex 和 claudecode 这种黑箱产品，IT 安全都过不了内部审计。

Can we stop saying this same shit over and over again. It’s not the reason. And it gives open AI an excuse to point to. They just genuinely cut our rates by 60-70%. It’s not this

I think here's the Culprit eating our usage limit! TURN IT OFF RN 🚨 On August 7, OpenAI reportedly added "codex-auto-review". Basically, when Codex wants to run a command or edit a file, it can send your conversation context to another model just to approve that action. And this is the crazy part: ~100,000 input tokens → ~100 output tokens just to say “yes” As your conversation gets longer, each review gets more expensive, and this can happen dozens of times in a single session. You don’t manually enable it either. It can apparently turn itself on/off across different sessions. If your quota started disappearing after August 7, check your logs for "codex-auto-review". This might explain a LOT.