Coding agents like codex and claude are ultimately company products, so users often set up harnesses to prevent the leakage of sensitive internal information or data, as well as unintended execution.
But harnesses are also sometimes configured with coding agent instructions, and as this article points out, problems can arise because it's the coding agent that executes those instructions. To prevent this, a separate program or conditions must be set up deterministically.
For example, blocking web requests at the proxy level, or attaching a program that automatically masks personal or sensitive information within the input context.
Personally I can understand why these instructions were added. Back in the GPT-5 days I tried using that model for a uv/Python project but it consistently ran the wrong commands or used pip despite my instructions within AGENTS.md . This was because whatever uv features/behavior I was using was added after that model’s cut off date. It got so bad that I switched to Claude which had a sooner knowledge cut-off.
That said, in the case that the author brought up here I agree that web searches shouldn’t be performed. I personally don’t like having my main agent search the web (mostly for preserving my context) so I’ve restricted the web search tool to a dedicated web search subagent.
Yesterday it was solving some problem for me, the number 2500 came up and it searched the web for “2500”. What possible information could you find from that web search?
I intimately recognize the familiar structure of “notice something odd when operating software, pull on thread and track down the offending line of code, experience righteous indignation at the bad engineering revealed underneath”. Where it becomes a funhouse-hall-of-mirrors moment for me is that it’s a line in an .md file. And it ascends to a clown-world moment when it expects better from OpenAI.
Coding agents like codex and claude are ultimately company products, so users often set up harnesses to prevent the leakage of sensitive internal information or data, as well as unintended execution.
But harnesses are also sometimes configured with coding agent instructions, and as this article points out, problems can arise because it's the coding agent that executes those instructions. To prevent this, a separate program or conditions must be set up deterministically.
For example, blocking web requests at the proxy level, or attaching a program that automatically masks personal or sensitive information within the input context.
Personally I can understand why these instructions were added. Back in the GPT-5 days I tried using that model for a uv/Python project but it consistently ran the wrong commands or used pip despite my instructions within AGENTS.md . This was because whatever uv features/behavior I was using was added after that model’s cut off date. It got so bad that I switched to Claude which had a sooner knowledge cut-off.
That said, in the case that the author brought up here I agree that web searches shouldn’t be performed. I personally don’t like having my main agent search the web (mostly for preserving my context) so I’ve restricted the web search tool to a dedicated web search subagent.
Yesterday it was solving some problem for me, the number 2500 came up and it searched the web for “2500”. What possible information could you find from that web search?
Maybe it was thinking it would be like 2600? https://www.2600.com
I intimately recognize the familiar structure of “notice something odd when operating software, pull on thread and track down the offending line of code, experience righteous indignation at the bad engineering revealed underneath”. Where it becomes a funhouse-hall-of-mirrors moment for me is that it’s a line in an .md file. And it ascends to a clown-world moment when it expects better from OpenAI.
Its an interesting bit of research into how codex works but what is with the expletive laden tirades?
[flagged]