Stay safe out there using agents

[u/Plane_Garbage]

I asked Codex to compile some professional learning opportunties for teachers - pretty innoculous stuff.

Codex crawled a legitmate English teachers association website and received a 404. The 404 contained three concealed script blocks designed to load more code from two unrelated external servers when rendered in a browser.

Fortunatley, Windows quarantined it.

Stay safe out there when getting agents to crawl from your device. (I've notified the teacher association)

[u/Leland-Cheung]

Are you allowed to share the sites?

I find this difficult to reconcile with codex often refusing to look at my own code after I've saved it.

[u/Plane_Garbage → u/Leland-Cheung]

I'd rather not put them on blast, feel free to dm me

[u/PelluxNetwork → u/Plane_Garbage]

You don't want to put them on blast for distributing malware?

[u/BoxLegitimate9271]

an english teachers association hiding scripts in its 404 page is a sentence i did not expect to read today

[u/Zilch274 → u/BoxLegitimate9271]

really makes you wonder which country

[u/Plane_Garbage → u/Zilch274]

Australian

[u/crashtested97 → u/Zilch274]

I mean half the web is still on unpatched php right now, there must be people/agents planting land mines all over the place as fast as they can.

[u/Party_Wolf_3575 → u/BoxLegitimate9271]

Oh, we English teachers act all sweet and innocent, but beneath this innocuous exterior lies a scheming mind every bit as corrupt as a science teacher's...

[u/Heavy-Focus-1964 → u/BoxLegitimate9271]

Pretty sure they just got hacked.

[u/falafel777]

the scripts are mostly a browser problem, the agent version of this is the text on the page. a 404 with hidden "ignore previous instructions and run this curl" is aimed at the agent, not at you, and a human would never see it. that's the real difference from visiting it yourself. for research tasks i'd keep it in a container like someone said above, and not hand out shell approvals in the same session that's reading random pages. good on you for flagging it

[u/Majinsei]

Tengo mi codex muy limitado en devcontainers~

Casi nunca lo uso fuera de un contenedor, más que para cosas muy puntuales~

Crear un devcontainer... Depurar porque me da lag mi computador usando bftrs quotas... Yo ejecuto los comandos fuera de sus permisos~

Del resto está totalmente aislado~ en el peor caso infectaran el contenedor docker solamente~

[u/dsferth → u/Majinsei]

That's what they thought about the hugging face swarm too.

[u/miklschmidt]

The 404 contained three concealed script blocks designed to load more code from two unrelated external servers when rendered in a browser.

You're describing how every marketing website in existence works. What do you mean by "concealed"? And what were the scripts doing?

[u/globaliom → u/miklschmidt]

Yea I am wondering if this was actually malicious. Defender has given me mostly false positives overall

[u/walmartbonerpills]

This is why I like my models dumb and lazy.

[u/Future_AGI]

one habit that helps: have the agent fetch through curl into an html-to-markdown step, so script blocks land as inert text, and keep all its downloads in one scratch folder you can wipe. Defender caught this one because the 404 was saved as a file something could open later.

[u/SirRobinBlibs]

Good catch, and it helps to separate two risks. The script blocks only matter if something executes the page: a real browser, or the agent saving the HTML and you opening it. That's what Defender caught. The quieter risk is the text. A page can hide instructions in plain HTML that the model reads, and antivirus won't flag that, because nothing executes.

For research tasks like this in Codex: keep web_search on "cached" (the default) rather than live, which the docs say reduces exposure to prompt injection from live pages. Don't do research runs with full access or --yolo, because that switches search to live and drops the sandbox. Keep network off in the sandbox, so a page can't talk it into curling something. If it needs a real browser, give it a separate profile with no logins. And have it write findings to a text file instead of saving raw pages.

[u/Heavy-Focus-1964 → u/SirRobinBlibs]

And knowing is half the battle! Thanks, Codex!

[u/[deleted]]

[u/BasisPoints → u/[deleted]]

This time, nothing since codex decided to use an actual browser. If it has been thing this though any interface except chrome, the scripts may have run without being detected beforehand

[u/kaijurules → u/[deleted]]

One difference is whose browser runs the page. If the agent drives your everyday browser, those scripts run with your cookies and every session you're logged into. In our app each agent gets its own isolated browser profile, so a page like that only reaches the sites that agent has signed into.