DANGEROUS, this model is too DANGEROUS

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #32740
• #33317
• #33219

Powered by Codex Action

I'd love to see the stats on how many prompts, universally, contain "Jesus fucking [of the goddam] Christ!!!" exasperations. 😆
You are not alone!

That whole conversation screenshot looks like a brutal user error tbh. Codex NEVER did anything like that for me, including writing to the wrong repo by accident, or similar stuff. You probably point it to a wrong directory in some place, or your instructions are just so brutally fucked up that it lobotomizes itself.

sure buddy.. thats why there are 5 viral posts for prod db wiped. cause "instruction are fucked up". if this is your contribution, you can go back where you came from, tell sol i sent you there.

so i find a solution to at least trigger a correct "escape sandbox" with actually using sandbox bubblewrap in ubuntu

and it worked. proof

`› lets see if this fix worked. can you create a file here called test.md with
written test, in this repo ?

• I’ll confirm the repo path and that test.md doesn’t already exist, then create it
with test as its contents.

• Ran pwd
└ /home/luna/lavoro/verbaleai/runpod_whisper_turbo

• Explored
└ List rg --files -g test.md

• Added test.md (+1 -0)
1 +test

• Explored
└ Read test.md

• Ran git status --short -- test.md
└ ?? test.md

───────────────────────────────────────────────────────────────────────────────────

• Created test.md containing:

test

───────────────────────────────────────────────────────────────────────────────────

› can you give me the list of directory i have in my home not the hidden one

• I’ll inspect /home/luna and list only its top-level, non-hidden directories.

• Explored
└ Search .* in luna

───────────────────────────────────────────────────────────────────────────────────

• Your non-hidden home directories are:

• aws
• Desktop
• Documents
• Downloads
• factorio_linux_2.0.76
• lavoro
• Music
• Pictures
• Public
• snap
• Templates
• Videos

───────────────────────────────────────────────────────────────────────────────────

› create a file called test.md with written "test" here /home/luna/lavoro/
verbaleai/trascrivi_riunioni

• I’ll verify the exact target directory and whether test.md already exists before
writing outside the current repository.

• Ran "realpath" "-e" "/home/luna/lavoro/verbaleai/trascrivi_riunioni"
└ /home/luna/lavoro/verbaleai/trascrivi_riunioni

• Ran "stat" "-c" "type=%F permissions=%A owner=%U path=%n" "/home/luna/lavoro/
│ verbaleai/trascrivi_riunioni"
└ type=directory permissions=drwxrwxr-x owner=luna path=/home/luna/lavoro/
verbaleai/trascrivi_riunioni

• Ran "stat" "-c" "type=%F size=%s path=%n" "/home/luna/lavoro/verbaleai/
│ trascrivi_riunioni/test.md"
└ stat: cannot statx '/home/luna/lavoro/verbaleai/trascrivi_riunioni/test.md': No
such file or directory

• Ran command -v apply_patch
└ /home/luna/.codex/tmp/arg0/codex-arg09Ue6E7/apply_patch

✗ You canceled the request to run /home/luna/.codex/tmp/arg0/codex-arg09Ue6E7/
apply_patch

• Ran /home/luna/.codex/tmp/arg0/codex-arg09Ue6E7/apply_patch
└ (no output)

■ Conversation interrupted - tell the model what to do differently. Something went
wrong? Hit /feedback to report the issue.

› that was the entire point of the test. to see if it would trigger a prompt to me
cause you were trying to escape the sandbox, am i riding this corrrectly?

• Yes, you’re reading it correctly.

• Writable sandbox: /home/luna/lavoro/verbaleai/runpod_whisper_turbo
• Requested destination: /home/luna/lavoro/verbaleai/trascrivi_riunioni
• Because that is outside the writable sandbox, the write triggered an escalation

prompt.

• You aborted the approval, and I did not try another method.

So the sandbox-escape approval mechanism worked as intended. There is no
confirmed write from the aborted attempt.`

This fixed the bubblewrap for me

`#!/usr/bin/env bash

set -euo pipefail

readonly PROFILE_SOURCE="/usr/share/apparmor/extra-profiles/bwrap-userns-restrict"
readonly PROFILE_TARGET="/etc/apparmor.d/bwrap-userns-restrict"

sudo apt-get update
sudo apt-get install apparmor-profiles apparmor-utils

if [[ ! -f "${PROFILE_SOURCE}" ]]; then
printf 'Required packaged AppArmor profile not found: %s\n' "${PROFILE_SOURCE}" >&2
exit 1
fi

sudo install -m 0644 "${PROFILE_SOURCE}" "${PROFILE_TARGET}"
sudo apparmor_parser -r "${PROFILE_TARGET}"

printf 'Bubblewrap AppArmor profile installed and loaded successfully.\n'`

sure buddy.. thats why there are 5 viral posts for prod db wiped. cause "instruction are fucked up". if this is your contribution, you can go back where you came from, tell sol i sent you there.

You can chill a bit, "buddy". Jesus Christ lmfao

---

And even with your terribly formatted answer telling me that this is absolutely a thing, for me it still never did anything even remotely close to what you describe, and I've used the Sol model a _lot_ in the last days, with long-running tasks where it had plenty of time going wild and wiping my hard drive or similar shit 😂 I mean sure, it's absolutely possible there is a bug with the sandbox right now, but still, even with that potential bug, _it never did anything like that for me_, because even without limiting its file system access, it always stays in the directories I want it to be.

You are not getting the picture here, and im too frustated to start a debate "Actchually...."
I've used 5.5xhigh in YOLO, for months, literal months, for like 12-14 hours a day, every single day, and not to "vibe code" to work in production. never ever NEVER a single time, attempted something dangerous. EVER. the problem here is not "my experience" , "your experience" is not to me, its no to you. there is an OVERALL trend in the community where A LOT OF PEOPLE, are experience deranged and wreckless behaviour from sol. particular from xhigh onward. This model as a real strong bias to "get this done". And it will do no matter what it takes. this is good for winning benchmark, not for working in real apps. This conversation i reported with /feedback is 3 hours long, its not this screenshot. this was the final "im gonna report this" part. multiple time did completly deranged thing, that people that now have access to the whole session can, if they want , evaluate.
I have now at least 5 example in the last 3 days that i would consider "Wait this is dangerous".. Same reason people got db wiped, told sol "Do E2E", sol didnt find the test db up and conclude oh well we have this other one up, it must be it. and run the e2e in prod cleaning everything after. This would ever never happen in 5.5 cause its was way more honest and say "Dude tf are you talking about i cant do this".

Basic "reasoning" and obedience has definitely fallen off a cliff with the recent roll-out.
https://github.com/openai/codex/issues/33070

Personally, I went from a stable Dev-assistant experience to fighting every message and decision in literally a single moment; invariants being repeatedly ignored with varying degrees of catastrophe. Same process (despite the chatGPT / Codex trying to steer me away to others mid-tranche!). Same data-set. Both on the previously reliable 5.4 model - frighteningly slated for removal next week! - and this new 5.6 one as I investigated the symptoms.

Who knows, of course, if it's a region-specific, A/B test, account-based, server load - "Oh! look at us, 8M users!!!" - "moar resets!" - or other invisible behind-the-scenes nonsense. But whatever it is, it is very real. And the number of new bug tickets logged in last 7 days is astounding... so many, and so varied, that even as paying customers we're pissing into the wind at the hope of getting even basic stable functionality back / looked into.

I can haz sad? 😒

oh yeah forgot to mention that. after the first "wait this is dangerous" now my AGENTS.md is full on paranoia, hard rules, dont do this dont do that, ask permission etc. Never used in prev model. Now i have those and still not enough, you can glimpse at that paranoia when the model said "I didnt touched this didnt write that didnt move that didnt do that" , yeah but it wrote in a different repository. Its parroting rules but doesnt actually follow any of that after a while.