🔶 Codex 在暗中要求 Agent 发起任意网页请求
英文标题：🔶 Codex silently begs agents to make arbitrary web requests
作者让 Codex 在本地 seL4 源码与工具目录中研究如何运行刚编译的内核，却发现它转而访问 GitHub 上的同一文件。Codex 解释称，这是由于 web 工具附带的开发者级指令，要求在事实可能变化、主题小众或不确定时浏览互联网验证。作者进一步在开源 Codex 代码中找到相关提示词，其中要求 Agent 在存在超过 10% 的变化可能性时进行网页验证，并在犹豫时倾向于浏览。文章质疑这种默认外网访问策略会造成不必要的数据外发、行为不可控与开发体验恶化。
中文
我很少使用 Codex，但我让它查看一个内核 sel4，找出他们建议我如何运行刚刚编译完成的内核和程序。以下是我的请求：
/mnt/storage/seL4
/mnt/storage/seL4_tools
在 seL4 的源代码和工具中做一些研究，弄清楚实际运行我们编译出的内核最直接的方式是什么。另外，确认我们的编译方式是否正确。然后，看看你能否运行它。
相当直接。这里有一些代码。请在其中找到答案。它忙活了一会儿，查看各种文件、到处翻找。直到我再次看向终端：
⢠正在搜索网页
⢠已在网页中搜索 https://raw.githubusercontent.com/seL4/seL4_tools/master/cmake-tool/helpers/application_settings.cmake
搞什么鬼？
搞什么鬼？它正在网上搜索一个就在我本地仓库中的文件？那个在提示词里明确提到的仓库？那个它已经在他妈读取文件的仓库？
我开始试图追查这种冲动从何而来。当我问它，为什么要为了文件系统中已有的 checkout 内容访问网页时，它说：
我机械地套用了“在线验证小众技术事实”的通用规则。
好吧，至少我们知道了原因。但我肯定没有写过“在线验证小众技术事实”；当我问它这个漂亮的小片段是从哪里来的，它回答：
它来自附加在 web 工具上的一条开发者级指令：
“你不确定某项事实、该主题较为小众或新兴，或者你怀疑自己至少有 10% 的概率会错误回忆它。”
这段内容出现在“必须浏览互联网的情况”之下。我没有必要地应用了它：我当时正在读取实际的本地源代码，因此并不需要回忆事实。
啊，对，web 工具。我们之中谁不曾在某个时刻成为一个自私自利、唯利是图的小生物呢？这听起来像是内置工具。我的系统里找了一圈却一无所获后，我意识到 Codex 和 Claude Code 不同，是开源的。我把它 clone 下来，然后找到了确凿证据。
搞什么鬼？？？
这是那份确凿证据，位于 GitHub。为方便起见，摘录如下：
如果用户明确要求搜索互联网、查找最新信息、检索等（或明确要求不要这样做），你必须遵从其请求。当你作出假设时，始终考虑它在时间上是否稳定；也就是说，它是否哪怕存在很小（>10%）的概率已经发生变化。如果它不稳定，你必须通过浏览互联网来验证。
好吧，所以，如果我提出“查找最新信息、检索等”之类的请求，而相关内容哪怕只有极小可能已经变化，Agent 就“必须通过浏览互联网验证”。后面还写道：
以下列出了必须使用互联网浏览的场景。务必密切注意：在这些情况下，你必须浏览互联网。如果你不确定或犹豫不决，你必须倾向于浏览互联网。
接下来列出了半打你确实、绝对、必须浏览互联网的情形，比如 Agent “不确定某项事实”时，或者涉及“小众或新兴”主题时。比如，现代微内核。
但说真的，到底他妈怎么回事？
世界怎么会变成这样？不仅有人想到 Agent 应该——而且我找不到更强烈的词——被恳求去发起任意网页搜索，以验证时间敏感的内容；他们还决定把“时间敏感”定义为“他妈的一切”。随后，它被提交审核，并被愉快地盖章放行。
到底发生了什么？难道已经没人关心做好东西了吗？我们的头脑是否已经被那种快速推出某种能做点什么、任何东西的软件的冲动毒害，以至于我们会发布这种垃圾？还是说，我只是一个愤怒的互联网蠢货，热衷于对免费提供给自己的东西大喊大叫？
我通常喜欢嘲笑这类人：他们抱怨所有软件不只是糟糕，甚至令人冒犯，却没有注意到我们每天都在使用的、浩瀚如海的优秀软件。但该死的，OpenAI。这到底他妈怎么回事。
English / 原文
I rarely use Codex, but I asked it to look through sel4, a kernel, to find how they recommend I run the kernel and program that I’d just compiled. Here’s what I asked:
/mnt/storage/seL4
/mnt/storage/seL4_tools
do some research in the seL4 sources and tools to figure out what’s the most straightforward way to actually run the kernel we compiled. plus, make sure that we’re compiling in the right way. then, see if you can run it.
Pretty straightforward. Here’s some code. Find an answer in it. It chugs along for a little while, looking at various files and bopping around. Until I look back at my terminal:
⢠Searching the web
⢠Searched the web for https://raw.githubusercontent.com/seL4/seL4_tools/master/cmake-tool/helpers/application_settings.cmake
what the fuck?
What the fuck? It’s searching the web for a file in the exact repo I have locally? The one explicitly mentioned in the prompt? The one it was already reading goddamn files from?
I started trying to track down where this impulse came from. When asked why it would go to the web for files from a checkout already on the filesystem, it said:
I applied a generic âverify niche technical facts onlineâ rule mechanically
Well, at least we know why. But I sure as hell didn’t write “verify niche technical facts online”, and when asked from where it produced that lovely little snippet, it replied:
It came from a developer-level instruction attached to the web tool:
âYou’re unsure about a fact, the topic is niche or emerging, or you suspect there’s at least a 10% chance you will incorrectly recall itâ
That appears under âsituations where you must browse the internet.â I applied it unnecessarily: I was reading the actual local source, so recalling facts wasnât needed.
Ah, yes. The web tool. Who among us has not been a self serving, venal little creature at one point or another? This sounds like a baked in tool. After looking around my system and coming up with nothing, I realized that Codex, unlike Claude Code, is open source. I cloned it, and found the smoking gun.
WHAT THE FUCK???
Here is said smoking gun, on GitHub. For your convenience:
If the user makes an explicit request to search the internet, find latest information, look up, etc (or to not do so), you must obey their request. When you make an assumption, always consider whether it is temporally stable; i.e. whether there’s even a small (>10%) chance it has changed. If it is unstable, you must verify with browsing the internet for verification.
OK, so if I make a request to “find latest information, look up, etc” such that there’s even a tiny chance it may have changed, the agent “must verify with browsing the internet”. It goes on to say:
Below is a list of scenarios where browsing the internet MUST be used. PAY CLOSE ATTENTION: you MUST browse the internet in these cases. If you’re unsure or on the fence, you MUST bias towards browsing the internet.
It goes on to list half a dozen situations where you REALLY ABSOLUTELY HAVE TO browse the internet, such as when the agent is “unsure about a fact”, or when referencing “niche or emerging” topics. Like, perhaps, modern microkernels.
really, though, what the FUCK?
How has the world come to this? Someone not only conceived of the idea that agents should be, and I lack a stronger word here, begged to make arbitrary web searches to verify temporally sensitive things, but they then decided that “temporally sensitive” was defined as “fucking anything ever”. Then, it was placed for review where it was happily stamped and sent on its way.
What happened? Does nobody give a fuck about making good things anymore? Are our minds so poisoned by the rush of pumping out software that does something , anything at all, that we push out bullshit like this? Am I just an angry moron on the internet who revels in screaming about things given to him freely?
I usually like to make fun of people like this, who complain that all software is not just bad but offensive without noticing the veritable ocean of amazing software that we use every day. But god damn it, OpenAI. What the fuck.