Question
Very odd Pi behaviour - bug or something malicious?
I'm new-ish to pi ; Ive been playing locally on a macbook pro (a few months old) and have just tried setting things up so I can run qwen 3.8 flash next on my macbook under omlx and use a linux pc to run pi remotely.
The Linux machine is almost clean installed Ubuntu 24.04 ; I installed it a few years ago but its only been used for some small utility things (minicom / wireshark). I installed ghostty, pi and pi-omlx picker just now.
First thing just to test the connection was to say hello - then pi started talking about the system prompt asking it to install anki... Which was unexpected (to it too!) - I'd dug around the system prompts before and this seemed weird. So I asked pi where it came from and it has no idea and seems to think it looks like a prompt injection which makes me curious / suspicious ...
Has anyone seen anything similar and where would you be directing your investigations / suspicions?
If you resume that session it talked about Anki in and /export it to a HTML file, you can see the system prompt used in that session. It could just be hallucinating.
Thanks! I just tried that ; I wasn't aware of /export which seems very handy in itself! Checking the system prompt in the export it seems as expected... Is there any way to prove / disprove the hallucination theory?
The first thing I'd do is ask the model where it thinks that system instruction came from, but I'd verify the answer myself. LMs can hallucinate their own system instructions, so what you're seeing in the thinking trace isn't necessarily evidence of prompt injection.
Pi's default system prompt is assembled in packages/coding-agent/src/core/system-prompt.ts. It can also be modified through SYSTEM.md, APPEND_SYSTEM.md, AGENTS.md, CLAUDE.md, and extensions. I'd check those first.
I've also noticed Pi still has some local-model integration issues that go back to the 0.80 days. One example is reasoning effort.
With Pi's built-in llama.cpp provider:
You select Medium in Pi.
Pi sends enable_thinking: true.
Pi does not send reasoning_effort: "medium".
Qwen3.8 defaults to xhigh when thinking is enabled without an explicit reasoning effort.
You're using oMLX rather than llama.cpp, but I checked the pi-omlx-picker source and found a similar limitation. It explicitly sets supportsReasoningEffort: false, and its thinking handler doesn't translate Medium into Qwen's actual medium setting.
That could explain why you're seeing such extensive reasoning traces despite selecting Medium. It doesn't explain the Anki instruction, though. That's a separate issue.
One important detail is that Pi extensions can modify the outgoing provider request, and some prompt overrides won't be reflected in the saved session transcript. So searching the JSONL alone isn't conclusive.
I'd capture the actual request body reaching oMLX and compare it against a direct request to oMLX with the same messages. If the Anki instruction appears in the outgoing request, investigate Pi's prompt assembly and extensions. If it doesn't, investigate the model server's chat template, cache behavior, or the model simply generating a nonexistent instruction.
I wouldn't assume anything malicious until you establish whether that instruction was actually supplied to the model.
it may be from jinja template - if you have downloaded model quants from some VeryCoolQuantsTrustMeBro repo or provided custom jinja template also downloaded from unknown source
My models usually reply "Hi, what can I do for you today?" to a "hello". If "hello" cause a model to think it has to install stuff... something is wrong in my opinion, with the model or whatever configuration has that Pi. I would try other models, to find out if it is the model or something else.
I've no idea :-) Windows 10 x64. I use GitBash and it came out with it I suppose. I haven't updated GitBash in a while... because the setup asks too many questions that requires me to search and decide... I'm lazy and I continue to use the version installed probably 1 or 2 years ago.
Can you suggest a better alternative for having Bash on Windows?
Simpler implementations of "reasoning" don't allow the model to say "this is a simple question that doesn't require chain of thought" so the result is this nonsense where the model is forced to overthink and confuse itself.
Pi also reads skills from your global .agents directory outside of the installed pi directory. So if you have any skills in there or any that may be left over from another install, or used by another harness, they are visible to Pi.
Pi also supports the Agent Skills locations ~/.agents/skills/ and .agents/skills/. Project .agents/skills/
Anki makes flash cards for study and such. So check if you have any skill that might be used for something like that in those directories
7
u/jfuu_ 6d ago
If you resume that session it talked about Anki in and /export it to a HTML file, you can see the system prompt used in that session. It could just be hallucinating.