← Field Notes
SEP 1 · Firsthand · via Simon Willison ContextObservabilityPermissions

Simon Willison finds LibreOffice shipped inside the Codex desktop app

The permission surface isn't just what you grant at runtime — it's what shipped in the box. This is the clearest evidence I've seen that Permissions needs a 'bundled tools' disclosure layer.

Machine summary of the source

Simon Willison documents a concrete, previously undocumented implementation detail inside the Codex/ChatGPT desktop app: LibreOffice is bundled directly into the application as part of the agent's local tool environment. This is a primary-source discovery — found by inspection rather than announced — revealing how tool dependencies are quietly packaged and made available to agents without explicit user awareness or configuration.

The architectural implication is significant: rather than assuming or requesting access to tools already present on the user's machine, the agent runtime ships its own sandboxed capability set. This makes the agent's effective permissions more predictable and portable, but also less legible to the user — the tools the agent can reach are not necessarily the tools the user sees or installed themselves.

For designers, this surfaces a largely invisible layer of agent tooling: the bundle. What an agent can do is shaped not just by permissions granted at runtime, but by what was packaged into the environment at build time. That's a design and disclosure problem — users consenting to an agent acting on their behalf may not know the full surface area of what they're consenting to.

The summary above is generated; the note at the top is the editorial judgment. Primary source ↗