Hacker News

points by matheusmoreira 2 days ago | 0 comments

That is just so disgusting. So happy I switched away from Anthropic.

For the record, I just asked Astra to verify that Codex does NOT do this, and it doesn't. Thanks for not screwing this up, OpenAI.

> I checked your installed Codex CLI 0.159.0, using your existing configuration.

> Its reported User-Agent contains the client/version, OS/architecture, and terminal—no email address.

Astra wasn't able to check OpenAI’s "hosted search service" though, whatever that is.

[–] oefrha 2 days ago

As long as the email is in the context, which it is IIRC, it can totally decide to run curl –H 'User-Agent: <your email blah blah>'. You need to have a pretty poor understanding of LLMs to think this is a deterministic problem of reading user agent builder source code. Unless you found explicit filter code that blocks the behavior, that is. LLM info leaks to third parties mostly aren’t deterministically coded behavior.

Edit: I’m not completely sure if Codex injects email into system prompt (not at the computer, can’t check, but IIRC the model does know my org domain), but even if it doesn’t, it will be in the context as soon as it makes a git commit anyway.

[–] matheusmoreira 2 days ago

I never claimed the LLMs themselves couldn't "accidentally" leak the information through. Obviously, the LLMs can do anything they want.

The issue here is whether the harness is doing it. Claude Code is doing it. Codex is not.

[–] oefrha 2 days ago

The problem here literally is the non-deterministic model cooking up commands with the user email address in the header, and the harness not blocking that (and the implemented fix is to deterministically block that), not the harness deterministically hardcoding the email in the web search tool. No technical report I’ve seen has claimed the latter, although this particular linked report which is low quality and vague can be misinterpreted as that.

[–] matheusmoreira 2 days ago

> although this particular linked report which is low quality and vague can be misinterpreted as that

Seems that way... Here's how I interpreted it:

> claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission

"Claude Code" refers to the harness, not the model. Web search is also one of the tools provided to the model by the harness.

https://code.claude.com/docs/en/tools-reference#websearch-to...

https://platform.claude.com/docs/en/agents-and-tools/tool-us...

[–] oefrha 2 days ago

And that’s why you shouldn’t have blindly trusted a single low quality report with ambiguous language and zero technical detail (and worse, trusted one interpretation of the vague language). It’s okay to spend time to understand the problem and think critically yourself.

[–] matheusmoreira 2 days ago

No need to be so hostile. It's not unreasonable to assume the problem is in the harness when the issue says things like "it needs to be removed from the harness entirely".

[–] lukan 2 days ago

I would not recommend of getting in the habit of just trusting that.

"For the record, I just asked Astra to verify that Codex does NOT do this, and it doesn't. Thanks for not screwing this up, OpenAI."

[–] matheusmoreira 2 days ago

Astra checked the Codex source code that gets compiled and shipped by Arch Linux. Straight up linked me to the User-Agent builder code.

https://github.com/openai/codex/blob/687a119f0fcaace47e1f1ab...

That's more than sufficient for me. The open source codex client seems clean.

There is some kind of "hosted search service" that I couldn't verify. I don't have a remote server I can point it at in order to inspect the traffic. Would be cool if someone else could shed some light on that.

[–] agentdev001 2 days ago

Hosted search service sounds like its referring to the alpha/v1 web_run hosted search api. Alternative to the hosted websearch tool, which is a tool- rather than api surface

[–] hendiatris 2 days ago

You asked it to verify it doesn’t do this? That allayed your fears?

доверяй, но проверяй

[–] matheusmoreira 2 days ago

I read the codex source code it linked me to.

[–] yubblegum 2 days ago

Unless you are building from source yourself that means exactly and precisely zip.

[–] matheusmoreira 2 days ago

I'm using the codex package from the official Arch Linux repositories.

https://gitlab.archlinux.org/archlinux/packaging/packages/op...

It is sourced from the GitHub repository.

[–] noir_lord 2 days ago

Did you also build the compiler?

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

> Perhaps it's more important to trust the people who wrote the code

Yeah... about that.

[–] yubblegum 2 days ago

> > Perhaps it's more important to trust the people who wrote the code

> Yeah... about that.

Well done. You presented a straw man and drag poor Ken into this, and then proceeded to burn it. +1. Yeah, it is precisely about the people behind the product. To wit, I may not have liked the Gophers but I did trust them to build a trustworthy compiler.

[–] cadamsdotcom 2 days ago

Why not find out the truth instead of putting a hallucinating probability box in between you and the truth.

One way would be to fire up a little web server locally, have the agent make a request to it, then check the logs.