From 89dbe3e424952c1fbcf2312356d6705fa80df774 Mon Sep 17 00:00:00 2001 From: Gauransh Mathur Date: Sun, 4 Oct 2026 19:06:12 +0800 Subject: [PATCH] docs(readme): say a subagent definition can trigger advise unasked Since the subagent QA check was added, advise treats a subagent definition that tells it to run as the user asking. It cannot tell who wrote that file, and inside a subagent it cannot ask the user. A definition from a cloned repository or another plugin can therefore send code to OpenAI without a request in the conversation. The Data handling section said advise sends data only when the user asks. It now states the subagent case plainly and tells the reader to check definitions they did not write. Closes #31 --- README.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 34c9db3..437b9d1 100644 --- a/README.md +++ b/README.md @@ -103,9 +103,18 @@ It never runs on Claude's own initiative. There are three ways to start it: work to OpenAI. That work includes the brief Claude writes, the repository files Codex reads, and the output of the commands it runs. How OpenAI keeps and uses that data depends on the terms of your OpenAI account. `exec` sends data -only when you ask Claude to delegate a task, and `advise` only when you ask for -a second opinion. The Fable advisor is a Claude subagent, so it sends nothing to -OpenAI. +only when you ask Claude to delegate a task. `advise` sends data when you ask +for a second opinion, or when a subagent definition tells it to run. The Fable +advisor is a Claude subagent, so it sends nothing to OpenAI. + +**A subagent definition can send code to OpenAI without asking you first.** +`advise` treats a subagent definition that tells it to run as your own +request. It cannot tell who wrote that file, and inside a subagent it cannot +stop to ask you. So a definition that came with a cloned repository or with +another plugin can start a Codex run, and send that run's brief and files to +OpenAI, when you did not ask for one in the conversation. Read any subagent +definition you did not write before you use it, and look for one that preloads +or names `codex-headless:advise`. **What changes in your Codex setup.** The plugin never writes to `~/.codex/config.toml`. Instead, each run passes `-c` overrides that apply to