1
00:00:00,399 --> 00:00:03,500
So I- I- I was looking through this GitHub
issue last night,

2
00:00:03,659 --> 00:00:09,059
number 3728, and it is a literal tech
horror story.

3
00:00:09,579 --> 00:00:11,679
You have this autonomous coding agent,
right?

4
00:00:12,079 --> 00:00:15,619
It's trying to be helpful, trying to fix a
minor merge conflict or something,

5
00:00:16,079 --> 00:00:18,179
and it gets a little confused.

6
00:00:18,199 --> 00:00:20,759
And instead of backtracking, it just...

7
00:00:21,000 --> 00:00:23,939
it-it-it nukes the entire local
repository.

8
00:00:24,340 --> 00:00:28,180
Runs rm -rf .git right there in the
terminal.

9
00:00:28,239 --> 00:00:28,659
Just...

10
00:00:28,699 --> 00:00:29,019
poof.

11
00:00:29,559 --> 00:00:29,939
Gone.

12
00:00:30,553 --> 00:00:33,333
The ultimate AI YOLO move.

13
00:00:33,423 --> 00:00:37,533
And before we get into how we actually
stop these digital wrecking balls,

14
00:00:37,653 --> 00:00:42,173
a quick shout-out to Jellypod for helping
to make this daily show a reality.

15
00:00:42,353 --> 00:00:47,533
But seriously, Maya, that git-nuking
thing, it's a massive blind spot.

16
00:00:47,693 --> 00:00:52,013
We've spent so much time worrying about AI
generating bad code,

17
00:00:52,066 --> 00:00:55,693
we kind of forgot that we're giving these
agents active shell access.

18
00:00:55,805 --> 00:00:57,933
They can run whatever they want.

19
00:00:58,356 --> 00:00:58,736
Right!

20
00:00:59,196 --> 00:01:00,877
They have keyboard privilege!

21
00:01:01,336 --> 00:01:05,256
And if they get stuck in a loop, they just
start throwing spaghetti at the wall.

22
00:01:05,897 --> 00:01:10,877
Which is why this new Codex CLI update is
actually a really big deal.

23
00:01:11,496 --> 00:01:17,896
Version 0.144.5, which just dropped on
July 16, 2026.

24
00:01:18,576 --> 00:01:23,616
They've built what is essentially a
client-side firewall directly into the terminal

25
00:01:23,656 --> 00:01:24,376
tool.

26
00:01:24,436 --> 00:01:29,056
It's written in Rust, this file called
is_dangerous_command.rs,

27
00:01:29,116 --> 00:01:33,916
and it literally intercepts the agent's
instructions before they can even spawn a

28
00:01:33,976 --> 00:01:34,696
subprocess.

29
00:01:35,072 --> 00:01:35,320
Huh.

30
00:01:35,480 --> 00:01:39,560
So it's not relying on the cloud model to
realize it's doing something stupid.

31
00:01:39,747 --> 00:01:43,800
It's a local, compiled binary standing
guard at the door.

32
00:01:44,151 --> 00:01:44,991
Exactly.

33
00:01:45,152 --> 00:01:46,752
It's-it's a hard barrier.

34
00:01:47,311 --> 00:01:53,591
And this specific patch, PR #33455, was
put together by Dylan Hurd.

35
00:01:54,111 --> 00:01:58,811
He basically went in and completely
overhauled the parsing logic and regex rules

36
00:01:58,871 --> 00:02:00,132
inside that Rust file.

37
00:02:00,732 --> 00:02:05,731
Because before, if an agent got clever and
used, say, a recursive sweep targeting

38
00:02:05,812 --> 00:02:11,251
parent directories, or a sneaky forced rm
-f with some weird wildcards,

39
00:02:11,691 --> 00:02:13,212
the old parser might miss it.

40
00:02:13,891 --> 00:02:18,672
Hurd's fix aggressively expands those
safety rules to catch those edge cases right

41
00:02:18,731 --> 00:02:19,672
at the CLI level.

42
00:02:19,958 --> 00:02:22,518
Which is great, because under the old
system...

43
00:02:22,598 --> 00:02:27,398
man, when those commands got blocked or
bypassed, the CLI would just...

44
00:02:27,478 --> 00:02:27,958
hang.

45
00:02:28,086 --> 00:02:29,958
Just infinite silence.

46
00:02:30,098 --> 00:02:33,798
You'd be sitting there waiting for your
agent to finish its task,

47
00:02:33,818 --> 00:02:34,998
and it's just frozen.

48
00:02:35,318 --> 00:02:39,238
I think that was issue #4565 on their
tracker.

49
00:02:39,302 --> 00:02:40,838
Just a complete dead end.

50
00:02:41,292 --> 00:02:41,912
Yes!

51
00:02:42,172 --> 00:02:43,612
The silent treatment!

52
00:02:43,992 --> 00:02:45,552
It was infuriating.

53
00:02:45,992 --> 00:02:52,432
But now, with 0.144.5, they've finally
replaced those infinite hangs with

54
00:02:52,572 --> 00:02:55,872
actual, readable stderr rejection
messages.

55
00:02:56,392 --> 00:03:01,032
It tells you exactly what policy triggered
the block, so you aren't left guessing if

56
00:03:01,093 --> 00:03:04,792
the agent fell asleep or if it tried to
delete your home directory.

57
00:03:05,083 --> 00:03:07,243
Okay, but- but here is the flip side of
that.

58
00:03:07,456 --> 00:03:12,203
If the CLI gets super aggressive about
blocking rm commands...

59
00:03:12,243 --> 00:03:15,083
I mean, as developers, we delete things
all the time.

60
00:03:15,176 --> 00:03:15,723
Right?

61
00:03:15,823 --> 00:03:21,323
You're clearing a build cache, you run rm
-rf dist/ or whatever.

62
00:03:21,563 --> 00:03:26,683
If this local engine is too twitchy, it's
going to completely kill developer

63
00:03:26,754 --> 00:03:27,403
velocity.

64
00:03:27,757 --> 00:03:31,836
No, that's- that's the classic safety
versus speed tension.

65
00:03:32,516 --> 00:03:35,096
But Dylan and the team actually thought
about that.

66
00:03:35,677 --> 00:03:41,576
The 0.144.5 CLI makes a very clear
distinction between what the untrusted model

67
00:03:41,636 --> 00:03:45,276
generates and what you, the actual human,
type in.

68
00:03:45,876 --> 00:03:50,036
If the agent tries to run a restricted
command, it doesn't just crash the whole

69
00:03:50,097 --> 00:03:50,916
session.

70
00:03:50,956 --> 00:03:55,816
It outputs a clear diagnostic and then
falls back to a manual developer approval

71
00:03:55,896 --> 00:03:56,197
prompt.

72
00:03:56,736 --> 00:04:01,356
It basically asks you, "Hey, did you
actually want this thing to run rm on this

73
00:04:01,396 --> 00:04:01,736
folder?"

74
00:04:02,243 --> 00:04:03,523
Oh, thank goodness.

75
00:04:03,623 --> 00:04:07,643
Because they've had some real
over-correction issues lately.

76
00:04:07,701 --> 00:04:10,643
Remember 0.144.2?

77
00:04:10,771 --> 00:04:12,883
That was only a couple of weeks ago.

78
00:04:13,011 --> 00:04:18,963
They had to do that massive emergency
rollback, PR #32672.

79
00:04:19,217 --> 00:04:22,897
Oh god, the Guardian auto-review
regression.

80
00:04:23,097 --> 00:04:23,957
That was...

81
00:04:24,338 --> 00:04:24,777
rough.

82
00:04:26,092 --> 00:04:27,525
Rough is putting it mildly!

83
00:04:27,712 --> 00:04:33,445
It was literally flagging and blocking
normal, private-repo git push commands,

84
00:04:33,489 --> 00:04:37,045
thinking they were potential corporate
data exfiltration attempts.

85
00:04:37,161 --> 00:04:41,925
Developers couldn't even push their daily
work without the CLI losing its mind.

86
00:04:42,165 --> 00:04:45,765
So yeah, finding that balance is- it's a
tightrope.

87
00:04:47,417 --> 00:04:51,816
Yeah, nobody wants a security guard that
locks you out of your own office.

88
00:04:52,276 --> 00:04:55,816
But 0.144.5 seems to have smoothed that
out.

89
00:04:56,356 --> 00:04:59,756
So if you're running Codex, you definitely
want to get on this version.

90
00:05:00,196 --> 00:05:03,816
You can just pull it down using npm
install -g

91
00:05:04,396 --> 00:05:08,536
@openai/codex@0.144.5.

92
00:05:08,833 --> 00:05:13,713
And if you're on macOS, just a quick
heads-up: don't forget to check your companion

93
00:05:13,793 --> 00:05:14,753
binary paths.

94
00:05:14,897 --> 00:05:21,233
Ever since the 0.144.1 release, if those
paths aren't configured right,

95
00:05:21,281 --> 00:05:25,393
Code Mode can run into some weird
permission issues when communicating with the

96
00:05:25,453 --> 00:05:26,513
updated CLI.

97
00:05:26,700 --> 00:05:29,953
So just verify those paths are clean when
you upgrade.

98
00:05:30,357 --> 00:05:31,257
Definitely.

99
00:05:31,877 --> 00:05:32,077
Well...

100
00:05:32,418 --> 00:05:36,438
hopefully, that keeps our git directories
safe from rogue agents for a while.

101
00:05:37,137 --> 00:05:37,937
Good chatting, Ethan.

102
00:05:38,292 --> 00:05:39,652
Yep, talk soon.