Enable Web Search by default

[MeowShe]

What feature would you like to see?

Since we’ve switched to the latest web search tool, shall we enable it by default instead of —-search?

Both in cli and VSCode extension.

Are you interested in implementing this feature?

No response

Additional information

No response

[MaurUppi]

~/.codex/config.toml

[tools]
web_search = true

[rben01]

How does tools.web_search differ from sandbox_workspace_write.network_access? Is the latter necessary to make the former work? Does the latter enable network access for tools/commands other than web search?

[MeowShe]

Is the latter necessary to make the former work? Does the latter enable network access for tools/commands other than web search?

Network Access seems to be similar to HTTP requests like curl, while Web Search is a model-side tool (OpenAI Documentation). I believe these two are not related; Web Search can be used even without enabling Network Access.

[bhack]

It will also nice in vscode to be able to enable/disable web search X single prompt

[codyseally]

Precisely this, why is websearch deactivated by default? This forces the LLM to use outdated information.

[0xdevalias]

why is websearch deactivated by default

@codyseally Because network access (including web search) provides a vector by which things that might be secret in your environment could get leaked; and that's not really a safe default to have, particularly when the way a lot of people may use this agent doesn't require it to have search/network capability enabled all the time.

If you want to enable it by default, you can already do that in the config, as was pointed out previously.

[bhack]

@codyseally Because network access (including web search) provides a vector by which things that might be secret in your environment could get leaked; and that's not really a safe default to have, particularly when the way a lot of people may use this agent doesn't require it to have search/network capability enabled all the time.

This is true but since ChatGPT does not use continual learning, its knowledge is fixed at its training cutoff date. This limitation affects awareness of third-party dependency updates, API changes, new libraries, and ongoing issues such as bug fixes or pull requests. Similar to hallucinations, the model cannot reliably recognize when its information is outdated. In environments with web access, ChatGPT can retrieve up-to-date information, but without it, the model cannot autonomously detect or correct gaps in its knowledge.

[0xdevalias]

@bhack Which is why there is a configurable option that lets you enable it for the session; or globally via the config file if you so desire.

[bhack]

How can balance security and a static knowledge cutoff if I cannot enable X prompt web access in the ide extension?

[bhack]

See also more sophisticated requests like #2563

[codyseally]

why is websearch deactivated by default

@codyseally Because network access (including web search) provides a vector by which things that might be secret in your environment could get leaked; and that's not really a safe default to have, particularly when the way a lot of people may use this agent doesn't require it to have search/network capability enabled all the time.

If you want to enable it by default, you can already do that in the config, as was pointed out previously.

This is not at all a correct decision. All existing agentic coders (both CLI based and the ones working as VS Code extensions) have web search ON by default, and for a fundamental reason: coding agents are useless without access to the most recent version of the libraries they will need to work with. Your argument above is akin to not giving a browser access to the internet for fear of malicious attackers. Sorry, but it does not hold at all.

Furthermore, finding the toml file to enable websearch manually is not always so easy. For example is you work under WSL, your codex points to :

~/.nvm/versions/node/v22.18.0/lib/node_modules/@openai/codex/bin

but good luck finding the toml file there or in the parent codex dir. Also the original ~/.codex/config.toml does not exist in WSL, nor does the .codex hidden dir. This has thus created a problem where there was none.

[MeowShe]

To balance security and usability, would it be better to require an additional user permission IN CHAT when Web Search is needed, rather than enabling it through a configuration file?

In programming tasks, due to the Knowledge Cutoff date, the agent may use deprecated or outdated APIs and design patterns, which is obviously something developers do not want to see.

I even observed a very strange example: I explicitly required the agent to check the documentation and Release Notes of the libraries to be used before starting the task. However, after browsing the corresponding API documentation, the agent still used an API that was clearly marked as deprecated.

For example, in the latest version of Zod, z.email() is used to match emails, but the agent still used the deprecated API z.string().email().