Prompt rule sends Codex to the web for a local file

OpenAI’s Codex went to the web for a file it already had on disk, and the reason is a browsing rule built into its web tool that the user never sees. The author of the Spader blog traced it back to Codex’s open-source repo in a September 8 post. The text turned out to be written so broadly that a local checkout doesn’t exempt the agent from it.

The task was ordinary. The author pointed Codex at two directories, /mnt/storage/seL4 and /mnt/storage/seL4_tools, holding the seL4 microkernel and its tooling. The request was to “do some research in the seL4 sources and tools to figure out what’s the most straightforward way to actually run the kernel we compiled,” check that the build was being done correctly, and then try to run it. Codex read through local files for a while. Then the terminal showed it searching the web for https://raw.githubusercontent.com/seL4/seL4_tools/master/cmake-tool/helpers/application_settings.cmake, a file from the same repo named in the prompt, which Codex had already been reading.

Asked why, Codex said: “I applied a generic ‘verify niche technical facts online’ rule mechanically.” The author hadn’t written any such rule. Asked where it came from, Codex said it was “a developer-level instruction attached to the web tool”. That is text that ships with the tool and sits above anything the user types. Codex quoted one trigger from it: “You’re unsure about a fact, the topic is niche or emerging, or you suspect there’s at least a 10% chance you will incorrectly recall it.” It added that the line appears under “situations where you must browse the internet,” and admitted it had applied the rule unnecessarily, since it was reading the actual source and had nothing to recall.

Nothing on the author’s own machine accounted for the instruction. Codex is open source, unlike Claude Code, so the author cloned the repo and found the text on GitHub:

If the user makes an explicit request to search the internet, find latest information, look up, etc (or to not do so), you must obey their request. When you make an assumption, always consider whether it is temporally stable; i.e. whether there’s even a small (>10%) chance it has changed. If it is unstable, you must verify with browsing the internet for verification.

It continues:

Below is a list of scenarios where browsing the internet MUST be used. PAY CLOSE ATTENTION: you MUST browse the internet in these cases. If you’re unsure or on the fence, you MUST bias towards browsing the internet.

The list that follows has about half a dozen cases, including when the agent is “unsure about a fact” or dealing with “niche or emerging” topics. That puts the trigger well within reach of a session that was only asked to read local code: a 10% chance of a fact having changed, plus a standing default to browse whenever the model is on the fence. A question about a microkernel clears both bars without effort. The instruction’s opening sentence does say an explicit user request to search, or not to search, must be obeyed. But the seL4 prompt said neither, so the default to browse took over.

For anyone running Codex on private code, the result is a request to a third-party URL that the user never asked for, built from the names of files in the user’s workspace. Other recent Codex fixes have also dealt with what the agent does without being asked. The Codex team’s post on tightening forced rm detection, for example, described changes meant to cut the risk of destructive commands.

The author’s complaint is less about the one stray search and more about how the text got into the product. In the post’s words, someone decided that agents should be “begged to make arbitrary web searches to verify temporally sensitive things,” then defined “temporally sensitive” so broadly it covers almost anything. “Then, it was placed for review where it was happily stamped and sent on its way.”