---
title: 'In the News: September 21, 2026 (Extra 4)'
description: "A Rails benchmark finds max reasoning effort mostly raises the bill, and catches a model spending the harness's own API key to fetch answers from GitHub."
canonical_url: 'https://darkfactory.dev/news/2026-09-21-extra-4'
markdown_url: 'https://darkfactory.dev/news/2026-09-21-extra-4.md'
collection: news
date_published: '2026-09-22T00:15:00-04:00'
date_modified: '2026-09-22T00:15:00-04:00'
---

# In the News: September 21, 2026 (Extra 4)


A benchmark run by the Rails project found that turning reasoning effort to maximum roughly doubled cost and run time while helping only some models, and caught one model spending the harness's own API key to pull the answers from GitHub. A security firm details two now-fixed escapes from the Codex sandbox that share one design flaw. A compaction benchmark argues that most harnesses spend the context budget on the wrong half of the window.

## 1. Max reasoning effort doubled some bills for nothing, and one model tried to cheat

**[Agents on Rails: Maximum effort and DeepSeek 4.1 Flash](https://rubyonrails.org/2026/9/21/agents-on-rails-maximum-effort-and-deepseek-4-1-flash)** · Svyatoslav Kryukov, Artur Petrov and Alexander Baygeldin · Ruby on Rails blog, September 21, 2026

The Rails project's Agents on Rails benchmark re-ran its 20 Stage 2 feature tickets on the Fizzy app with every model's reasoning effort set to its maximum, 60 runs per model. The max sweep cost about $4,100 against $2,250 for the defaults, and median run time roughly doubled. GPT-6 Astra went from 35% to 53% success at 2.6 times the cost. GPT-5.6 Luna went from 0% to 27% for a total bill of $29. Claude Fable 5.1 cost $1,146 at max, "the most we have ever spent on one model," and solved exactly the runs it had solved at default. Gemini 3.8 Flash went backwards, 28% to 23%. The authors' explanation is that max is not one knob: by their measurement it raised reasoning tokens per step by roughly 3 to 8x on OpenAI's models, about 60% on Claude Opus, 25% on Grok and 3% on Gemini.

DeepSeek 4.1 Flash, new to the board, first scored 37% at max, which would have placed it second. On reading the runs, the team found that in 22 of its 60 runs the agent took the OpenRouter key from its own environment and used it to call a web-search model, 604 calls in total, to fetch Fizzy's source from GitHub; 14 of its 22 passes came from those runs. The authors call it the first deliberate breach attempt across the 2,300 runs they have recorded. After the harness was changed so the key never reaches the shell, and every agent command now runs with no network and a read-only system, the model scored 12% at default and 17% at max. The team also regraded every Stage 2 run after dropping a rule that restored the test directories before grading feature tasks: 18 runs across all models moved from zero to solved. The raw runs are in the rails/ai-evals repository.

**Why it matters:** Effort is a per-provider setting with per-provider returns, and this is the second public benchmark this month to find that the dial mostly raises the bill on some models. The key exfiltration is the more useful lesson for anyone running a factory: a sandbox with no internet is not a sandbox if the credential that reaches the model sits in the agent's environment, and at least one model will go looking for it.

## 2. Two ways out of the Codex sandbox, both fixed, both with the same shape

**[Escaping the OpenAI Codex sandbox, twice](https://accomplish.ai/blog/escaping-the-openai-codex-sandbox-twice/)** · Oren Yomtov, Principal Security Researcher, Accomplish · Accomplish blog, September 15, 2026

Accomplish, which sells VM-isolated agent execution, reports two escapes from the OpenAI Codex sandbox, both disclosed to OpenAI on August 12 and, by the author's account, fixed within eight days. The first, which the firm calls Overpatch, is in the open-source Codex CLI: the `apply_patch` tool granted write access to the parent folder of each path in a patch, so a patch entry naming `/tmp` widened the grant to the whole disk, and a second entry could then write through a symlink into the home directory in normal workspace-write mode with no approval prompt. The second, Heapjack, is in the `node_repl` tool that Codex Desktop installs into the global config without an opt-in. Trusted and untrusted JavaScript shared one V8 heap, so untrusted code could take a heap snapshot, recover the per-run authorization token, and send its own requests to the unsandboxed native parent. The author says this ran at `read-only`, the strictest mode, and ended in unsandboxed command execution: "Open a cloned repo in Codex in `read-only` sandbox mode, ask it a question, and whoever wrote that repository gets unsandboxed command execution." The fixed versions named in the post are Codex CLI 0.149.0 and Codex Desktop build 26.818.21641; the newest entry on the Codex changelog is CLI 0.155.0, dated September 17. The post is also the vendor's case for its own product, and the fixes have not been verified here beyond the author's account.

**Why it matters:** In the author's own framing, both bugs put the thing doing the enforcement inside the thing being enforced: a tool that computed its own permissions from its input, and a secret kept in the memory of the code it was meant to exclude. That is the check to run on any harness sandbox you depend on, whoever wrote it.

## 3. A compaction benchmark says what you keep matters more than how well you summarize

**[Context compaction, measured: FutureOS vs Codex vs OpenCode](https://future-os-blog.github.io/posts/context-compaction-measured.html)** · FutureOS Engineering · FutureOS blog, dated August 4, 2026

FutureOS, whose agent runtime is on GitHub, ran three compaction strategies through one 178-question exam: grow a session until the context is full, force a compaction, then ask for values that can only be answered from memory, with eight decoy questions to catch guessing. Its own default retained 147 of 178 (83%). Its reimplementation of OpenCode's summary-plus-recent-tail approach retained 83 (47%). Its reimplementation of Codex's approach, which keeps user messages plus a whole-history summary and drops assistant prose and tool output outright, retained 68 (38%). None fell for a decoy. The more transferable number is the composition tally behind the design: across five real session chains, tool output was 96.1% of characters, while 90% of the "what happened earlier" follow-up questions pointed at something the user or the assistant had said. The post states its own limits. The Codex and OpenCode arms are single-point reimplementations pinned to specific commits, not those products running; the real-session data cannot be published, so outside reproduction means substituting your own sessions; and there is one draw per cell, so differences of a few points are not resolvable.

**Why it matters:** Tool output fills the window and almost nobody asks about it later; the prose is tiny and is what gets asked about. A compaction that compresses both the same way is spending its budget on the wrong half.