›_ Codex Issues
Codex Issues / #32910

Model exposes system prompt instruction 'Inform the user' in output after update

Open 💬 2 comments Opened Jul 14, 2026 by wang1970
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

问题描述

更新后，当模型遇到不支持的图片输入时，会把 system prompt 中的指令文本 Inform the user 作为回复内容输出给用户。这是内部指令暴露（instruction leakage），用户不应看到这些内容。

复现步骤

  1. 发送包含图片的请求到不支持 vision/多模态的模型
  2. 模型返回以下格式的回复：
ERROR: Cannot read "image.png" (this model does not support image input). Inform the user.
  1. 用户看到 Inform the user 这条系统指令

期望行为

  • 对于不支持图片输入的模型，应返回标准 HTTP 错误（如 400 Bad Request），而不是把系统指令作为模型输出返回
  • 系统指令（如 Inform the user）不应暴露给用户

实际行为

  • 模型把 Inform the user 作为回复文本输出
  • 这是 system prompt 指令的泄露
  • 用户看到内部指令文本

时间线

  • 更新前：正常（不支持图片的模型不会返回此类文本）
  • 更新后：出现上述问题

影响

  • 内部 prompt 设计暴露给用户
  • 用户体验受损
  • 可能存在 prompt injection 风险

环境

  • OpenAI Codex CLI 最新版本
  • 通过代理层访问（api-switch，透明转发，不修改响应内容）

补充

该问题通过代理层的 raw protocol 日志已确认：上游原始响应中已包含 Inform the user 指令文本，非下游代理生成。请检查最新版本中是否在 system prompt 里新增了类似指令，或模型行为是否有变化。

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 1 month ago

English translation:

Problem Description

After the update, when the model encounters unsupported image input, it outputs the instruction text Inform the user from the system prompt to the user as part of its response. This is internal instruction leakage, and users should not see this content.

Steps to Reproduce

  1. Send a request containing an image to a model that does not support vision/multimodal input
  2. The model returns a response in the following format:
ERROR: Cannot read "image.png" (this model does not support image input). Inform the user.
  1. The user sees the system instruction Inform the user

Expected Behavior

  • Models that do not support image input should return a standard HTTP error (such as 400 Bad Request), rather than returning a system instruction as model output
  • System instructions (such as Inform the user) should not be exposed to users

Actual Behavior

  • The model outputs Inform the user as response text
  • This leaks a system prompt instruction
  • The user sees internal instruction text

Timeline

  • Before the update: Worked normally (models that do not support images did not return this type of text)
  • After the update: The issue described above appeared

Impact

  • Internal prompt design is exposed to users
  • Degraded user experience
  • Potential prompt injection risk

Environment

  • Latest version of OpenAI Codex CLI
  • Accessed through a proxy layer (api-switch, which transparently forwards requests and does not modify response content)

Additional Information

This issue has been confirmed through the proxy layer's raw protocol logs: the upstream raw response already contained the instruction text Inform the user; it was not generated by the downstream proxy. Please check whether a similar instruction was added to the system prompt in the latest version, or whether the model's behavior has changed.

<!-- codex-issue-translator -->

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #32352

Powered by Codex Action