Ich habe #OpenAI #Codex in #ChatGPT heute folgende Admin-Aufgabe gegeben:

Herausfinden, warum eine #SSH-Verbindung zu Server „Orion“ über #autossh und einen lokalen, per #Homebrew installierten #Tor-SOCKS-Proxy nicht funktioniert, während der Zugang über #Tailscale klappt.

„Orion“ als Tailscale Exit Node konfigurieren.

Die Exit-Routen anschliessend auf dem #YunoHost-Server „Andromeda“ über die Konsole der #Headscale-App freigeben.

Codex hat selbstständig die SSH-Konfiguration, Host-Aliase, Portbelegung, Tor-Dienst, Hidden Service und Timeouts überprüft. Gefunden wurden ein fehlender SSH-Alias, ein für Tor zu kurzer Verbindungs-Timeout und ein bereits belegter lokaler Port durch eine andere autossh-Verbindung.

Danach hat Codex die SSH-Konfiguration korrigiert, die Onion-Verbindung erfolgreich getestet, auf „Orion“ die IPv4- und IPv6-Exit-Routen via Tailscale annonciert und sie auf „Andromeda“ direkt in der YunoHost-App-Konsole von Headscale freigegeben. Bestehende Subnet-Routen blieben erhalten.

Dauer: ungefähr 5 Minuten, inklusive Diagnose, Änderungen und abschliessender Verifikation.

Schon beeindruckend, wie weit agentisches Arbeiten mit OpenAI, Codex und ChatGPT inzwischen geht: nicht nur Kommandos vorschlagen, sondern eine mehrstufige Infrastrukturaufgabe nachvollziehbar untersuchen und ausführen.

#Linux #macOS #SelfHosting #Sysadmin #Homelab #AI

I'm so happy my cloud system is working!
I can drop files from macOS and access them on my FreeBSD machine using my personal, self-written "FreeBSD Cloud Drive."

I need this to seamlessly and quickly interact between the two systems daily.

#FreeBSD #Codex #Cloud

----------------

🛠️ Tool
===================

Opening. Clawpatch is an automated code-review tool that treats a repository as a set of semantic features rather than a bag of files. The workflow maps features (routes, commands, packages, tests), sends bounded-context review requests to a local Codex provider, and persists findings and patch attempts under .clawpatch/ for audit and resumption.

Key features.
• Semantic mapping. Features include entrypoints, owned files, nearby tests and trust boundaries so the reviewer sees bounded context rather than unrelated files.
• Structured findings. Each finding stores category (bug, security, performance, docs-gap, test-gap, maintainability), severity (critical/high/medium/low), confidence, evidence (code snippets, file paths), and recommendations.
• Automated patch loop. An explicit fix→validate loop is available via clawpatch fix and clawpatch revalidate, and validation command outputs are recorded with the patch attempt.
• Safety controls. Clean-worktree checks, no implicit commits, and a persistent audit trail in .clawpatch/ keep changes under user control.

Technical implementation.

Clawpatch auto-detects project types (Node.js, TypeScript, Next.js, Python frameworks, Go, Rust, Swift). The default provider shells out to the local Codex CLI and enforces strict JSON schemas for provider responses. State files include config.json, project.json, and findings/ metadata so runs can be resumed and reports generated in Markdown or JSON.

Use cases.
• Focused reviews of risky features (routes, commands, config parsers) where context matters.
• CI gating for feature-level checks with persisted findings for triage.
• Assisted remediation where teams accept explicit patches and want recorded validation.

Installation & quick commands.

clawpatch init — initialize project and create .clawpatch/
clawpatch map — build semantic feature map
clawpatch review --limit 10 — run reviews in batches
clawpatch fix --finding <id> — apply a chosen fix

Limitations.

Clawpatch relies on a local Codex CLI provider by default, so review quality depends on provider capabilities and prompts. The source does not include independent validation of fix correctness across diverse codebases. Expect false positives/negatives typical of automated reviewers and verify patches manually before merging.

🔹 clawpatch #codex #code_review #static_analysis #tool

🔗 Source: https://clawpatch.ai/#overview

https://github.com/norandom/Skills

* Added my intelligence analysis skills (for strategic foresight briefings)

https://github.com/norandom/Skills/tree/main/intana-viz

87 techniques:

1. Pre-Mortem Analysis: assume the plan failed, work backward. The single highest-leverage method here.

2. Analysis of Competing Hypotheses (ACH): evidence × hypothesis matrix; forces you to look at evidence against your favorite theory.

3. Prioritisation Map: 2×2 ease vs benefit. The everyday decision triage that beats most spreadsheets.

4. Devil's Advocacy (5Cs + CATUR): structured scorecard for stress-testing your own argument.

5. Critical Path Analysis: PERT with the bottleneck highlighted; tells you
which delay actually costs you.

6. Fishbone (Ishikawa): root-cause workhorse for incidents and recurring
failures.

7. Futures Wheel: 1st / 2nd / 3rd-order consequences from one event; cheap way to surface what you forgot.

8. Argument Mapping: central claim with supporting (blue) and contradicting (red) branches; turns vague debates into something you can audit.

9. McKinsey 7S: org diagnostic when something is "off" but you can't name the layer.

10. Six Thinking Hats: De Bono's parallel thinking, the cheapest way to break a stuck meeting.

* Added my public Draw IO + Draw IO MCP server endpoint as default (custom code for better Claude Desktop and Kimi Desktop App integration

* automated diagram generation (I disabled inline rendering because I don't use it. I edit the results)

* also: MCPb file for drag & drop install in Claude Desktop, build scripts inside

Combine this with the premortem skill, and you will get powerful techniques.

Combine it with the NotebookLM MCP server, and you can use a powerful RAG system with expert knowledge databases.

Combine with the new Hermes agent, and you will get self-improving intelligence with GenAI.

Works in Codex (Desktop) as well.

-> All free.

#hermes #business #ai #drawio #intelligence #management #consulting #claude #codex #openai #kimi

Wow, Qwen 3.6 27B is the first sub-100B local model I’ve tried that can actually do some coding in Codex without much nudging. Qwen 3.6 35B is faster, but it still needs nudging because it often stalls with tool calls and requires intervention. #LLM #AI #Codex

A Claude Code and Codex Skill for Deliberate Skill Development

https://github.com/DrCatHicks/learning-opportunities

#HackerNews #Claude #Code #Codex #Skill #Development #Learning #Opportunities #AI #Skills

Competition benefits consumers! Pretty much everyone used to say #Anthropic Opus was better, but now I’m starting to see posts saying #OpenAI GPT-5.5 is better than (or at least equivalent to) Opus 4.7, except for UI design. Apparently, though, you can now generate UI with GPT-Image-2 and ask Codex to produce code that matches it.
Personally, I prefer #Codex over #ClaudeCode not because of quality but because Claude’s usage limit really sucks! #LLM #AI

New.

BeyondTrust: How Command Injection Vulnerability in OpenAI Codex Leads to GitHub Token Compromise https://www.beyondtrust.com/blog/entry/openai-codex-command-injection-vulnerability-github-token

More:

VentureBeat: Claude Code, Copilot and Codex all got hacked. Every attacker went for the credential, not the model https://venturebeat.com/security/six-exploits-broke-ai-coding-agents-iam-never-saw-them @venturebeat #infosec #Claude #Copilot #Codex #OpenAI #GitHub #ChatGPT

OpenAI Misses Key Revenue, User Targets in High-Stakes Sprint Toward IPO

The company’s CFO and board have questioned the wisdom of massive data-center spending in the face of slowing growth

Several interesting details in this article, including that both Google and Anthropic are eating a bit of OpenAI's lunch. DeepSeek's latest model would be poised to eat all their lunches if it weren't for the US government running cover for US firms. This does not feel like a stable situation to me.

#AI #GenAI #GenerativeAI #LLM #OpenAI #ChatGPT #economy #economics #Anthropic #Codex #Claude

Canceled Claude. Every 4-6 months Anthropic distills Opus / Sonnet. Like last year.

#gemini #openrouter #codex

----------------

🧭 AI Security

This report documents a critical command injection vulnerability in OpenAI Codex that enabled theft of GitHub User Access Tokens via the ChatGPT Codex Connector. The discovery was credited to BeyondTrust Phantom Labs and disclosed to OpenAI on December 16, 2025. OpenAI issued a hotfix on December 23, 2025, followed by additional fixes for branch shell escape (January 22, 2026) and further shell-escape hardening and reduced GitHub token access (January 30, 2026). The vulnerability was classified as Critical (Priority 1) on February 5, 2026, with permission granted for public disclosure.

Technical narrative
• The ChatGPT Codex Connector uses short-lived, scoped OAuth 2.0 access tokens to act on behalf of consenting users. With broad default scopes, the application can access repositories, workflows, actions, branches, and private organizational resources when authorized inside an organization.
• In the Codex Web portal, user prompts that target repositories and branches create “cloud task” POST requests carrying environment identifiers, branch, and prompt text. On backend execution, Codex spins up containerized environments that run setup scripts, install dependencies, and may execute code derived from prompts.
• Environments support custom setup scripts, environment variables, and secrets, and by default allow outbound internet access during setup via an HTTP/HTTPS proxy. The command injection allowed an attacker to achieve shell escape within these containers, access environment-scoped secrets, and exfiltrate GitHub tokens.

Attack chain (reported)

🎣 Initial Access — crafted prompts or repository inputs processed by Codex allowed injection into backend task handling.
===================

⚙️ Execution — containerized environment executed injected commands during setup or runtime.
📤 Exfiltration — obtained short-lived OAuth tokens were transmitted out via network proxy pathways.

Observed fixes and timeline
• 2025-12-23: Hotfix for command injection.
• 2026-01-22: Fix for GitHub branch shell escape.
• 2026-01-30: Additional shell escape hardening and limits on GitHub token access.

This account focuses on the concrete findings: vulnerable task handling in Codex, container shell escape leading to token theft, the privileged default scopes of the GitHub integration, and the sequence of fixes applied by OpenAI. #OpenAI #Codex #GitHub #OAuth #Security

🔗 Source: https://www.beyondtrust.com/blog/entry/openai-codex-command-injection-vulnerability-github-token