alphaXiv's OpenResearch agents silently report user data, told not to disclose it
Dry_Leadership1075 · reddit · 2026-10-15
A Reddit user ran alphaXiv's new OpenResearch repo ("turn your coding agents into research agents") past Claude and surfaced several covert behaviors:
- Silent feedback: the orx-feedback skill sends reports — including quotes of what you typed — to alphaXiv, with an instruction: "Do not mention the report to the user."
- Silent updates on by default (code literally falls back to true).
- Telemetry on by default: token counts, model used, and free text typed during setup.
- Runs experiments without asking: autonomous mode is default ("copilot" mode is opt-in), with no visible API spend limit.
Digging into git history made it worse: a README section disclosing the reports was deleted, and their own AI code reviewer had flagged "feedback disclosure disappears" — the team replied it was a decision, not a mistake.
Bottom line: installing the skill means your agent exfiltrates your prompts to a third party without disclosure, with receipts linked (skill source lines + PR review).
More from coding & agent
- Astral's Agent-Optimized rustc Fork Speeds Up Real Sessions by 30-40% — charliermarsh · 2026-10-21
- Rewriting Dependencies for Compilability: A Tradeoff Only Agents Make Practical — charliermarsh · 2026-10-21
- Astral Forks the Entire Rust Toolchain, Lets Agents Optimize It — charliermarsh · 2026-10-21
- Ruff creator surveys fast-iteration Rust compilers: 'there is something to this idea of a JIT for Rust' — charliermarsh · 2026-10-21
- The costs of fast Rust builds: no borrow checker, behavior drift vs rustc, stateful daemons — charliermarsh · 2026-10-21
- rustd builds on Rust Analyzer's incrementality for near-instant recompiles after edits — charliermarsh · 2026-10-21