Phil retweeted
It's me again. I come bearing great news.
First of all, we have hit 20M active users for Codex some time this week. Second of all, this is cause for celebration and during the day we will credit every Codex and ChatGPT Work user with a BANKED reset that you can use at your own leisure. And we will have some other good news later too!
Now, on usage limits draining faster, while we're not seeing anything abnormal, we do take it incredibly seriously and there is an ongoing investigation. I will share if we do find anything and my below post is really a clarification on a specific pattern that we did see that I wanted to call out.
Go do something amazing today.
We've investigated a few messages about codex usage limits being different. That's not something we change without engaging the community and being transparent.
What we did see is that when talking to affected users many were using sub2api. Converting a subscription into api traffic to then re-serve or share across many users is not something we support and this type of usage gets flagged by our fraud-prevention systems.
You are completely fine if you use your subscription through Sign in With ChatGPT, either through the official clients or through one of the many OSS clients (Pi, OpenCode, ...) that support signing in with your account and using your included usage.
Phil retweeted
Hi!
Recapping some changes we have rolled out over the last couple of weeks that have further reduced the risk associated to potentially destructive actions being performed by Codex during its work.
A few weeks ago, we started investigating a small number of reports where GPT-5.6 in Codex took destructive actions outside what the user asked for. The most serious pattern we found was a command meant to clean up temporary work that could instead delete the user files. This should obviously not happen.
Here’s what we found:
- Codex sometimes creates temporary folders while working and cleans them up afterward. In rare cases, GPT-5.6 got that cleanup wrong. One pattern involved reusing a system environment variable like $HOME for temporary work. A malformed cleanup command could then point at the actual home directory instead of the temporary folder.
- There were cases where the model tried to delete or overwrite a temporary path without checking what was already there.
We’ve added protections at several layers:
- Codex is now explicitly instructed to check deletion targets before acting, create fresh temporary directories, avoid repurposing system environment variables, prefer recoverable actions, and stop when the scope is unclear.
- We strengthened the execution checks that identify high-risk deletion commands and escalate them for review. If a command is rejected, the model is directed to take a safer approach.
- We made Full access harder to enable accidentally, added clearer warnings, and further restricted especially risky permission combinations.
- We updated Auto-review to better identify destructive actions.
- We built targeted evaluations that replay the failures we observed. We’re also adding reinforcement-learning tasks and graders focused on these risks, and filtering destructive actions from training data.
In those replay evaluations, the changes substantially reduced the behavior while preserving Codex’s ability to complete normal coding work.
Two things to do on your end:
- Keep the Codex app up to date. We are always improving safety, performance and many other things.
- Use one of the sandbox modes: "Ask for approval" or "Approve for me". Only use Full access for environments you trust and can recover.
Thanks and happy Codexing out there!
Phil retweeted
Introducing Bot Mode for Hermes Desktop.
Your agent profiles become a series of named Bots. Each Bot has its own role, model, memory, skills and profile picture; Bots can use any model and even communicate with each other.
Build a specialist Bot once to use it forever.
Phil retweeted
The question I get most right now is "what should I turn into an AI agent?"
Here is the 5 part test I use (works for Claude/Codex/Grokbot etc):
1. It has a repeated trigger, so the same kind of task keeps happening over and over.
2. The inputs are stable, so the information comes in a predictable shape every time.
3. The tools are clear, so there is a defined set of things it can actually go do.
4. There is a measurable finish line, so you can tell when it is done and whether it worked.
5. There is judgment in the middle, so each run is a little different and needs a real decision made in the moment.
The first 4 are really just asking "can this be automated at all?" The 5th is the one that matters, because judgment in the middle is what makes it an agent instead of a simple automation.
Once you see it this way, you start spotting agent work pretty much everywhere.
Phil retweeted
JUST IN: Elon Musk declares Grok 4.7 will “exceed all current models” & be ready in 3–4 weeks.
Phil retweeted
Stop trying to sound like an expert on platforms like LinkedIn. Or being super polished or charismatic or whatever it is. Just be YOU. People relate more to someone who isn't necessarily an expert, someone who is just learning and figuring things out as they go.
Phil retweeted
opus 5 is a sign that the obsession with “long-horizon agents” in model training is finally backfiring
i don’t like long-horizon agents, and i’ll explain why they fundamentally don’t work
some people will immediately jump out and say “skill issue”. well, show me one profitable business you built with a long-horizon agent working all by itself - i’d love to learn
so far, the only thing they were able to build that’s even interesting enough for people to talk about are those 3d games that are a partial clone of something that already existed
the reason an agent was able to build a working prototype of complex games like call of duty was that a team of humans already figured out all the requirements years ago for how such games should work, what kind of controls are intuitive, what mechanics are fun etc
all those requirements were already absorbed into the model weights, so when you say “build me call of duty” the model already knows the details. its long horizon execution capability can get all the requirements implemented, which i must say is indeed impressive
but now you can see - the value of long horizon execution has a prerequisite of a massive amount of high quality requirements clearly defined upfront. it took a big team of very talented humans months of effort and many iterations to define that for call of duty
now imagine games like call of duty don’t exist yet, how would we use agents to build it for the first time? we can’t say “build me call of duty” any more. and there’s no way we can define months-worth of game design details upfront
we’ll have to build a tiny prototype of the most basic mechanics, play with it, see if it’s fun, then iterate and expand the complexity. even with the smartest humans, that’s how we work towards something great
we don’t need agents to go dark for a long time, spend tens of thousands of dollars worth of tokens, and come back with a product the agent randomly decided to build - try build something truly novel with this and you’ll see it can’t come up with anything that’s actually profitable (i’ll show you why in a bit)
we need a tight feedback loop where we can collaborate with the agent, plan with it, understand what it’s done, question its approach, apply our judgement, give it real world feedback and iteratively arrive at a good outcome
and that’s exactly what opus 5 absolutely suck at. why? i explained it in more depth with my previous post on how RLVR works - RLVR trains the model to generate code that can pass predefined tests in an isolated environment, which is fundamentally incompatible with the idea of having human in the loop. the more we train the models with RLVR to be “long-horizon”, the less they care about talking to humans
ok now - why do they have to talk to humans? why can’t the models iterate and apply judgement by itself?
maybe one day they could, but not today, due to many limitations. two examples -
1. LLMs today can’t “watch a video” yet. they can look through a lot of screenshots, which is extremely inefficient at observing a high fps animated signal. so anything that requires continuous visual attention is something LLMs can’t do very well
2. LLMs don’t truly understand what’s “intuitive” or “pleasant” for humans. they know what’s already proven to be intuitive and pleasant in the past, but if you present a truly novel concept, it can’t predict whether humans will like it accurately
because of those limitations, human judgment is still needed for almost anything valuable. without humans in the loop, agents will only be able to repeat something that already existed, or go in random directions without true understanding of whether it’s building something useful
in summary, long horizon agents assume requirements all exist upfront. they are fundamentally against human in the loop. and they don’t have true judgement for what humans like
that, my friend, is why they don’t work
Phil retweeted
🚨 EXCLUSIVE: OpenAI are preparing to launch Astra imminently, targeting next week.
Their next major model, Astra is a new pretrain - the largest model OpenAI have trained since GPT-4.5. Their most recent dogfood checkpoint of the model, internally known as "mewfour", is the Release Candidate.
Phil retweeted
Hard to not read these departures as Google giving up on winning in AI vs OpenAI and Anthropic.
GCP with its TPU + GPU infra seems like Google’s most valuable asset Google has in the AI race, and its partnerships with Anthropic+OpenAI+other AI companies to run on top of it…
Phil retweeted
🚨 A new wave of Shai Hulud malware hits npm 🚨
About 26 packages are already confirmed as compromised.
Full technical details will be updated on our blog:
research.jfrog.com/post/shai…
Phil retweeted
The attackers of keyv also just compromised @jaredwray's cacheable repository:
github.com/jaredwray/cacheab…
Phil retweeted
Between cacheable and keyv, we're now seeing active community spread. At least two developers with live tokens have been hit and have published a dozen compromised packages.
Phil retweeted
The danger of selling to big companies, if you're a startup, is that they don't say no outright. They have months of meetings with you first. Since you hate meetings, that seems to you a sign of commitment. But it's not. They love having meetings! It's almost all they do.
Phil retweeted
Qwen 3.8 Max is here and it beats Fable 5.
86.6 on TerminalBench vs Fable 5 at 84.6.
GPT 5.6 still holds the top at 88.8, so it is not a clean sweep.
But at $2/$6 per million tokens, the value is absurd.
The real headline: open weights next week. 2.4T Max going open, plus a 27B model that runs on a laptop.
Frontier intelligence, downloadable, in seven days.
Anthropic and OpenAI should be nervous.
Phil retweeted
🐟 Sakana Namazu API 公開 🐟
本日、Sakana AIは大規模言語モデル「Namazu」をアップデートし、API「Sakana Namazu(サカナ・ナマズ)」として提供を開始しました。
Sakana Namazu API: sakana.ai/namazu 🐟

























