1
00:00:00,100 --> 00:00:06,689
We've got some interesting security
hardening to unpack in today's Codex 0.142.2

2
00:00:06,700 --> 00:00:07,070
release...

3
00:00:08,100 --> 00:00:13,100
specifically around how it handles raw
code blocks and remote network requests

4
00:00:13,140 --> 00:00:15,380
before they even touch the model.

5
00:00:15,440 --> 00:00:18,990
Thanks to Jellypod for helping make this
daily show a reality.

6
00:00:19,763 --> 00:00:20,803
Yeah, this is...

7
00:00:20,863 --> 00:00:24,513
it's a massive shift in how we think about
agentic security,

8
00:00:24,643 --> 00:00:24,823
right?

9
00:00:25,203 --> 00:00:28,183
Because normally you just think, oh, the
model checks the code.

10
00:00:28,623 --> 00:00:32,703
But this is- this is happening at the
parser level, before the model even gets its

11
00:00:32,823 --> 00:00:33,463
hands on it.

12
00:00:34,083 --> 00:00:37,763
The big one for me is the PowerShell AST
safety check.

13
00:00:38,203 --> 00:00:38,803
AST...

14
00:00:38,843 --> 00:00:42,923
that's the Abstract Syntax Tree, for
anyone who hasn't had to write a compiler

15
00:00:42,963 --> 00:00:43,423
recently.

16
00:00:44,568 --> 00:00:45,428
Yeah, exactly.

17
00:00:45,968 --> 00:00:50,808
It's how the shell actually- actually
parses and understands the structure of your

18
00:00:50,888 --> 00:00:51,208
script.

19
00:00:51,748 --> 00:00:56,868
And what Codex is doing now is, if there's
an executable block in that PowerShell

20
00:00:56,908 --> 00:00:59,348
script that the AST classifier...

21
00:00:59,928 --> 00:01:01,468
well, if it can't inspect it.

22
00:01:02,008 --> 00:01:06,388
Say, because of heavy obfuscation or
complex, dynamic code generation...

23
00:01:07,088 --> 00:01:07,858
it just stops.

24
00:01:08,428 --> 00:01:10,548
It straight up refuses to run it silently.

25
00:01:11,208 --> 00:01:12,227
Wait, so...

26
00:01:12,288 --> 00:01:17,788
if it's too- if the script is too messy or
tries to do something clever like hiding

27
00:01:17,887 --> 00:01:21,947
commands in encoded strings, the terminal
just throws an error?

28
00:01:22,722 --> 00:01:25,002
It doesn't just error out and die, it...

29
00:01:25,062 --> 00:01:28,281
it actually halts and demands manual
approval.

30
00:01:28,322 --> 00:01:32,442
You get this clear prompt in the terminal
saying, "Hey, we couldn't verify this

31
00:01:32,482 --> 00:01:34,162
block, do you actually want to run this?"

32
00:01:34,882 --> 00:01:37,262
Which, as a developer, is a lifesaver.

33
00:01:37,822 --> 00:01:43,302
Because otherwise, you're one weird npm
package dependency away from a reverse shell

34
00:01:43,382 --> 00:01:44,222
running on your machine.

35
00:01:45,887 --> 00:01:50,857
Right, because an LLM can easily be
tricked into generating or executing some weird

36
00:01:50,997 --> 00:01:55,317
nested PowerShell command that looks
harmless but is actually...

37
00:01:55,357 --> 00:01:56,997
you know, downloading a payload.

38
00:01:57,737 --> 00:01:59,737
But wait, what about the other side of
this?

39
00:02:00,257 --> 00:02:02,597
The remote image ingress rejection.

40
00:02:03,197 --> 00:02:03,997
That sounds...

41
00:02:04,797 --> 00:02:06,017
a bit aggressive?

42
00:02:06,637 --> 00:02:10,157
No more remote HTTP or HTTPS images?

43
00:02:10,893 --> 00:02:13,253
It sounds aggressive until you think about
the plumbing.

44
00:02:13,893 --> 00:02:18,193
Think about Server-Side Request Forgery,
or SSRF.

45
00:02:19,013 --> 00:02:22,073
If a model tries to fetch a remote image
from

46
00:02:22,313 --> 00:02:29,832
http://malicious-site.com/image.png...

47
00:02:30,613 --> 00:02:36,082
that server now knows your IP, your user
agent, maybe even your internal network

48
00:02:36,193 --> 00:02:38,553
structure if it tries to hit a local
endpoint.

49
00:02:39,293 --> 00:02:39,673
Like

50
00:02:39,913 --> 00:02:50,793
http://localhost:8080/admin_pannel_screenshot.png.

51
00:02:52,353 --> 00:02:52,354
Oh.

52
00:02:52,443 --> 00:02:52,883
Oh, wow.

53
00:02:53,003 --> 00:02:56,363
Yeah, I didn't even think about local
network probing.

54
00:02:56,423 --> 00:03:00,383
It could use the image fetch to scan your
internal network.

55
00:03:01,153 --> 00:03:01,673
Exactly.

56
00:03:02,273 --> 00:03:09,133
So now, any remote HTTP or HTTPS image
request at ingress is just rejected.

57
00:03:09,733 --> 00:03:13,993
But- but here's the clever part: instead
of just failing the whole run,

58
00:03:14,533 --> 00:03:18,593
Codex replaces that image placeholder with
a very specific,

59
00:03:18,673 --> 00:03:21,273
clean, model-visible error text.

60
00:03:21,853 --> 00:03:26,893
So the model actually *knows* why it
didn't get the image, rather than just getting

61
00:03:26,953 --> 00:03:29,133
a generic socket error and trying again.

62
00:03:29,785 --> 00:03:32,505
Okay, so if I'm building an app that...

63
00:03:32,605 --> 00:03:36,515
I don't know, needs to show a user profile
pic, how does that work now?

64
00:03:36,745 --> 00:03:37,725
Am I just stuck?

65
00:03:38,605 --> 00:03:39,555
No, not at all.

66
00:03:40,185 --> 00:03:43,305
You can still use local file paths, and...

67
00:03:43,365 --> 00:03:44,985
and inline data URLs.

68
00:03:45,545 --> 00:03:48,564
Like, base64 encoded images.

69
00:03:48,645 --> 00:03:53,265
Those are processed entirely locally, so
there's zero outbound network request.

70
00:03:53,845 --> 00:03:59,105
It keeps the workflow intact without
opening up that massive SSRF security hole.

71
00:03:59,963 --> 00:04:01,393
That makes complete sense.

72
00:04:01,993 --> 00:04:04,253
Now, let's talk about the MCP stuff.

73
00:04:04,493 --> 00:04:06,683
That's the Model Context Protocol, right?

74
00:04:07,213 --> 00:04:09,073
They changed how it searches for tools?

75
00:04:10,053 --> 00:04:10,733
Yeah, they did.

76
00:04:11,053 --> 00:04:13,673
So, previously, if you had a ton of MCP
tools...

77
00:04:14,113 --> 00:04:18,753
and some developers have massive
toolboxes, like dozens of custom tools...

78
00:04:19,512 --> 00:04:22,072
searching through them could get really
laggy.

79
00:04:22,153 --> 00:04:27,083
Codex now defaults to using the native
tool search of the host system whenever it's

80
00:04:27,113 --> 00:04:27,593
supported.

81
00:04:28,173 --> 00:04:33,593
It's a much smarter, lower-overhead way to
locate the right tool without having to

82
00:04:33,673 --> 00:04:36,133
query the entire registry every single
time.

83
00:04:37,613 --> 00:04:40,923
And what happens if you're on an older
system that doesn't support that native

84
00:04:40,963 --> 00:04:41,243
search?

85
00:04:41,663 --> 00:04:42,673
Does it just break?

86
00:04:43,823 --> 00:04:45,992
No, it- it actually degrades gracefully.

87
00:04:46,583 --> 00:04:51,323
It falls back to the legacy registry
search if the native APIs aren't available.

88
00:04:51,943 --> 00:04:56,123
So it's completely backward compatible,
but for most modern setups,

89
00:04:56,282 --> 00:04:56,943
it's just...

90
00:04:57,694 --> 00:04:58,403
instant.

91
00:04:59,183 --> 00:04:59,592
Nice.

92
00:05:00,032 --> 00:05:06,481
That leads into the other big enterprise
feature in 0.142.2: the proxy support.

93
00:05:06,952 --> 00:05:11,672
This is a massive headache for anyone
working behind a corporate firewall.

94
00:05:11,792 --> 00:05:17,292
I remember days of trying to get
environment variables like HTTP_PROXY to play nice

95
00:05:17,312 --> 00:05:19,072
with Node and Python tools.

96
00:05:20,703 --> 00:05:21,903
Oh, the proxy wars.

97
00:05:22,203 --> 00:05:23,523
Yeah, it's a nightmare.

98
00:05:24,163 --> 00:05:29,763
But now, if you set respect_system_proxy
to true in your config,

99
00:05:30,303 --> 00:05:33,923
Codex will actually query the OS-native
proxy resolvers.

100
00:05:34,483 --> 00:05:36,123
We're talking PAC files...

101
00:05:36,543 --> 00:05:38,363
Proxy Auto-Config...

102
00:05:38,623 --> 00:05:43,943
WPAD, and static proxies, natively on both
Windows and macOS.

103
00:05:44,688 --> 00:05:45,428
Wait, so...

104
00:05:45,508 --> 00:05:47,928
it actually reads the PAC file?

105
00:05:48,318 --> 00:05:53,578
Like, it evaluates the JavaScript inside
the PAC file to find the right proxy route?

106
00:05:54,352 --> 00:05:54,773
Yes!

107
00:05:55,273 --> 00:05:58,982
It hooks directly into the system's
network configuration APIs.

108
00:05:59,542 --> 00:06:04,593
So if your IT department has some complex
routing rule where internal traffic

109
00:06:04,633 --> 00:06:09,093
bypasses the proxy but external traffic
goes through a specific gateway,

110
00:06:09,633 --> 00:06:10,472
Codex just...

111
00:06:11,273 --> 00:06:12,003
respects it.

112
00:06:12,613 --> 00:06:13,292
Automatically.

113
00:06:13,933 --> 00:06:19,653
No more hacking your .bashrc or system
registry settings just to get your agent to

114
00:06:19,662 --> 00:06:20,453
talk to the internet.

115
00:06:21,159 --> 00:06:26,029
That is going to save so many enterprise
developers from pulling their hair out.

116
00:06:26,599 --> 00:06:28,479
Oh, and speaking of keeping things
clean...

117
00:06:28,879 --> 00:06:30,999
did you see the change to the formatters?

118
00:06:31,793 --> 00:06:32,463
Ah, yes!

119
00:06:32,593 --> 00:06:33,793
The quiet formatters.

120
00:06:34,473 --> 00:06:35,723
It's a small thing, but...

121
00:06:36,273 --> 00:06:37,363
so satisfying.

122
00:06:37,973 --> 00:06:42,213
When a formatter run succeeds now, it is
completely silent.

123
00:06:42,333 --> 00:06:46,823
No "Successfully formatted file.py"
spamming your terminal.

124
00:06:47,533 --> 00:06:50,203
It only speaks up if something actually
goes wrong.

125
00:06:51,335 --> 00:06:51,895
Yes!

126
00:06:51,955 --> 00:06:53,175
Thank you.

127
00:06:53,235 --> 00:06:56,975
My terminal output was just a wall of
green success checks.

128
00:06:57,435 --> 00:06:59,475
This is much better.

129
00:06:59,535 --> 00:07:02,885
Well, that's a solid wrap on 0.142.2.

130
00:07:03,555 --> 00:07:05,475
Good chatting, talk soon.

131
00:07:05,598 --> 00:07:06,268
Absolutely.

132
00:07:06,658 --> 00:07:07,428
Catch you next time.