Yet, their tools such as codex are able to read ALL FILES on my PC without explicit permission unless you spawn them within a container: https://github.com/openai/codex/issues/2847
It seems like OpenAI stealing sensitive data from their customers is not a big problem for them as it has been reported as an issue for almost a year now and currently has the 2nd most upvotes among open issues (they work on issues based on upvotes, so they claim).
This is a pretty important issue given that the new update adds "computer use" capabilities. If it was already reading sensitive files in the CLI version, giving it full desktop control seems like it needs a much more robust permission model than what they've shown so far.
I'm not sure how much sandboxing can help here. Presumably you're giving the tool access to a repo directory, and that's where a juicy .env file can live. It will also have access to your environment variables.
I suspect a lot of people permanently allow actions and classes of commands to be run by these tools rather than clicking "yes" a bunch of times during their workflows. Ride the vibes.
Let's not assume that he's lying. Neither the presentation nor my short usage via the API blew me away, but to really evaluate it, you'd have to use it longer on a daily basis. Maybe that becomes a possiblity with the announced performance optimizations that would lower the price...
Recently, I decided to try out Claude for a month and bought the subscription right when mine for ChatGPT ended. However, after just a few days, I noticed how sluggish and inconvenient Claude feels on the web. Maybe it's partly because of my 4k screen, and it's not optimized for it, but I quickly switched back to ChatGPT due to the IMO better UX. Also, temporary chats are missing!
i also dislike my web experience with claude. it still generates completions after my free credits are consumed, and after it realizes there are no more free credits, the web app artificially removes the completions and throws an error. as a frontend dev, i'd think to check if there are credits left before even calling the api. i also dislike that there's a multiple second delay after hitting enter on claude. i'd expect to be on the chat page as soon as i hit enter.
Yet, their tools such as codex are able to read ALL FILES on my PC without explicit permission unless you spawn them within a container: https://github.com/openai/codex/issues/2847
It seems like OpenAI stealing sensitive data from their customers is not a big problem for them as it has been reported as an issue for almost a year now and currently has the 2nd most upvotes among open issues (they work on issues based on upvotes, so they claim).