Codex (at least) already imposes the macOS sandbox on the shell commands it runs. If it wants to run something without sandbox imposition, the harness makes me approve it manually.
Is the difference with your script mostly that you choose to impose a stricter sandbox profile (and not allow any user-approved exceptions at runtime)?
Well, in part because the phenomenon has been discussed on Web forums that (a) have at this point made their way back into training data and (b) are accessible in Web searches that the model can invoke. And in part because the model can "know" what its initial instinct is and "decide" to go against it.
Unfortunately nowadays even the built-in apps on the major desktop OSes are inconsistent, so the temptation for third-party apps not to care is somewhat understandable.
You're right, and I guess I've been breaking that rule for a while. What's the purpose there? The double-underbar and underbar-capital rules seem to be allowing for non-conflicting introduction of keywords. Is the single-underbar rule to protect standard library headers or something?
You might not have used one, but there have long been parking meters / payment kiosks that take charge cards and even cash. Neither an app nor a human attendant is required. It bugs me that these are slowly being replaced by smartphone app systems.
Why is this? Do labs reinforce the model name during training? I was under the impression that this sort of "self-knowledge" always came from the system prompt, but I guess not...