5 ms·

This is one of the reasons why native proprietary coding agent runners like claude-code, codex, grok-build etc are so dangerous for privacy… you just don’t know

by gitgud 2mo ago

This is one of the reasons why native proprietary coding agent runners like claude-code, codex, grok-build etc are so dangerous for privacy… you just don’t know what “secret sauce” they’ll add in the next update… It’s much safer to use something like opencode and use models via their API… however, the tradeoff is that it will never perform as well as it does in their native agent runners…

gruez 2mo ago
Give enough usage, you can reconstruct an entire codebase via tool calls alone, and it'll be entirely undetectable because it's all done server side. Whatever grok's doing is just more blatant, but using opencode or whatever doesn't create a meaningful security boundary. It's like the meme of using cheetos as a lock.
rohansood15 2mo ago
I agree with you, but Codex is open source.
- maxloh 2mo ago
  Yeah. Not the Desktop App though.
  - zuzululu 2mo ago
    its an electron app you an inspect it
- msdz 2mo ago
  Is the server side open-source too, as gruez brought up in the sibling comment? Technically they can still do potentially any- and everything undetected there; and for what it’s worth, even with a closed-source client bad behavior would get detected eventually through network inspection.
jimmydoe 2mo ago
last time I checked, codex is still open source w Apache-2.0 license
hansvm 2mo ago
> the next update That's a major problem in its own right. Yes, not updating an XP SP1 RCE immediately is dangerous, but in the last couple decades I've seen far more damage inflicted from automatic updates than what I think the lack of them would have caused.
_davide_ 2mo ago
I'm using my own agent, but i can't risk blocking the company account with it.....
HarHarVeryFunny 2mo ago
> however, the tradeoff is that it will never perform as well as it does in their native agent runners There's no reason to assume that. The recent Databricks benchmark in fact showed the exact opposite - that using Pi vs native agent both outperformed native agents in terms of task success, and did so cheaper due to using less tokens.

by gitgud 2mo ago

gruez 2mo ago

Give enough usage, you can reconstruct an entire codebase via tool calls alone, and it'll be entirely undetectable because it's all done server side. Whatever grok's doing is just more blatant, but using opencode or whatever doesn't create a meaningful security boundary. It's like the meme of using cheetos as a lock.

rohansood15 2mo ago

I agree with you, but Codex is open source.

maxloh 2mo ago
Yeah. Not the Desktop App though.
- zuzululu 2mo ago
  its an electron app you an inspect it
msdz 2mo ago
Is the server side open-source too, as gruez brought up in the sibling comment? Technically they can still do potentially any- and everything undetected there; and for what it’s worth, even with a closed-source client bad behavior would get detected eventually through network inspection.

jimmydoe 2mo ago

last time I checked, codex is still open source w Apache-2.0 license

hansvm 2mo ago

> the next update That's a major problem in its own right. Yes, not updating an XP SP1 RCE immediately is dangerous, but in the last couple decades I've seen far more damage inflicted from automatic updates than what I think the lack of them would have caused.

_davide_ 2mo ago

I'm using my own agent, but i can't risk blocking the company account with it.....

HarHarVeryFunny 2mo ago

> however, the tradeoff is that it will never perform as well as it does in their native agent runners There's no reason to assume that. The recent Databricks benchmark in fact showed the exact opposite - that using Pi vs native agent both outperformed native agents in terms of task success, and did so cheaper due to using less tokens.