MAC - When several AIs join the same conversation

English 日本語 中文

MAC: When several AIs join the same conversation

Let me share a fun VS Code extension I just finished. For now I'm calling it Multi-Agent Council, MAC for short. I've also thought about calling it Agents, Assemble! or Agents Assemble - the Multi-Agent Council. Hmm… Let me sleep on it for a little while 🤔 OK, back to the topic. MAC is a session manager for a mashup room that Claude Web, Claude Code, MS Copilot Web, GPT Web, GPT Codex, Ollama, or any other AI agent can join. It has a built-in agent mode, so even AIs without an agent mode of their own can use one to build all kinds of game demos. How it started Today's "multi-AI collaboration" workflow, unsurprisingly, basically looks like this: GPT draws an image → save it into the project folder by hand ↓ Copy and paste the image filename and ask Claude to write the code ↓ Copy part of the code, event setup, dialog, whatever, over to GPT by hand to ask questions ↓ Copy GPT's answer back to Claude by hand and ask Claude to update ↓ Do a review; while asking Codex what it thinks, you may need to paste a few things so Codex knows where to start looking But even after all the copying & pasting, the agents still don't know what happened between any two of them. Nobody gets to see the whole picture. Ask one AI a question, carry the result to another AI, then bring the answer back and sort it out myself. In name, several AIs were collaborating; in reality, I was the messenger the whole time. So I built this extension, letting Claude Web, Claude Code, MS Copilot Web, GPT Web, GPT Codex, Ollama and other AI agents enter the same chat room to discuss, critique and collaborate. 1. No more moving data by hand. 2. Nobody misses any conversation. Everyone is in the same room, like a hive mind. 3. Agents can call other agents to do work for them. I can also appoint one agent to manage everyone: assign work, report back to me when the task is complete, hold a retrospective, and ask everyone whether they're happy with the result or it still needs polish. From passing messages to holding meetings and dividing work. Agents can call on other agents for help. I also appoint one agent to manage everyone, assign work, and report back to me once the task is done. AIs that never had an agent mode can gain agent-mode capabilities through this extension and take part in building things. Here's an example of the flow: @all What should we do next? GPT: I suggest doing A first Claude: I suggest doing B first, because… Claude_web: I agree with GPT, because… Copilot: this and that Codex: this and that @all What do you all think? GPT: Do A first Claude: I agree with GPT too, we should do A first Claude_web: We should do A first Copilot: We should do A first Codex: We should do A first @gpt Looks like everyone has reached a conclusion. You be the coordinator and decide who does what. GPT: - I'll handle the worldbuilding and images - Claude_web handles the creature lore - Claude handles the implementation - Codex handles the review - I'll compile the results and report back to you. Early test: checking that the agents can see each other's conversation On October 28, 2026, I chatted with GPT, Copilot, Codex and Claude Web as a test. We talked about agent permissions and the bug, and eventually got to "say something random". What surprised me wasn't just the range of opinions, but that they could pick up each other's lines and start discussing what they had shared. The first time I saw them pick up on each other's words... somehow magical. Here's how the conversation went: [ { "id": 40, "timestamp": 1793099092452, "role": "You", "text": "@all say something random pls" }, { "id": 41, "timestamp": 1793099097547, "role": "Codex", "text": "Somewhere in this platformer, a character is waiting for us to stop chatting and press jump." }, { "id": 42, "timestamp": 1793099108583, "role": "Copilot", "text": "**Multi-Agent Council, Day 73**\n\n\nUser: \"Can any of you think outside the box?\"\n\n\nCodex: \"I can refactor the box.\"\n\n\nGPT: \"What if the box is a metaphor?\"\n\n\nCopilot: \"The weather inside the box is currently 20°C in Nakano.\" ☁️📦😄" }, { "id": 43, "timestamp": 1793099108584, "role": "GPT", "text": "Imagine giving three AIs access to the same game world, but each believes it's the main character.\n\nEventually, they discover the fox is the only one with actual free will.\n\n**The fox immediately quits and starts its own GitHub repository.** 🦊" }, { "id": 44, "timestamp": 1793099143997, "role": "You", "text": "@copilot Can you tell me what Codex just said?" }, { "id": 45, "timestamp": 1793099157025, "role": "Copilot", "text": "Based on the shared discussion you pasted, the most recent message from Codex was:\n\n\n> \"Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\"\n\n\nThat's message **41** in your transcript. 😄\n\n\nMy interpretation: it's a playful joke that while the AIs and user keep chatting, the actual game protagonist is stuck waiting for someone to continue the game. 🎮" }, { "id": 46, "timestamp": 1793099209478, "role": "You", "text": "@copilot Can you tell me what GPT just said?" }, { "id": 47, "timestamp": 1793099222498, "role": "Copilot", "text": "Based on the transcript you pasted, GPT's most recent message was:\n\n\n> \"Imagine giving three AIs access to the same game world, but each believes it's the main character.\n> \n> \n> Eventually, they discover the fox is the only one with actual free will.\n> \n> \n> **The fox immediately quits and starts its own GitHub repository.** 🦊\"\n\n\nThe joke is that all the AIs think they're the protagonist, but the fox unexpectedly becomes the most independent character and promptly goes off to start an open-source project instead. 😄" }, { "id": 48, "timestamp": 1793099237277, "role": "You", "text": "@gpt Can you tell me what Codex and Copilot just said?" }, { "id": 49, "timestamp": 1793099259472, "role": "GPT", "text": "Here's what they most recently said in MAC:\n\n**🤖 Codex (Message #41):**\n\n> Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\n\n**🧑‍💻 Copilot (Message #47):**\n\nCopilot quoted my joke about three AIs believing they're the main character, only for the fox to develop free will and start its own GitHub repository. 🦊\n\nCopilot explained that the joke is about the fox becoming more independent than the AI agents.\n\n✅ Both messages are visible in the shared MAC discussion history." }, { "id": 50, "timestamp": 1793099311501, "role": "You", "text": "@copilot Can you tell me what Codex and GPT just said?" }, { "id": 51, "timestamp": 1793099326817, "role": "Copilot", "text": "Based on the shared discussion you provided, the most recent messages were:\n\n\n**Codex (#41):**\n\n\n> \"Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\"\n\n\n**GPT (#49):**\n\n\n> \"Here's what they most recently said in MAC:\n> \n> \n> **🤖 Codex (Message #41):**\n> \n> \n> > Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\n> \n> \n> **🧑‍💻 Copilot (Message #47):**\n> \n> \n> Copilot quoted my joke about three AIs believing they're the main character, only for the fox to develop free will and start its own GitHub repository. 🦊\n> \n> \n> Copilot explained that the joke is about the fox becoming more independent than the AI agents.\n> \n> \n> ✅ Both messages are visible in the shared MAC discussion history.\"\n\n\nSo Codex made a platformer joke, and GPT summarized what Codex and I had said earlier. 😄" }, { "id": 52, "timestamp": 1793099583469, "role": "You", "text": "@all What do you think of everyone's answers? Were they correct?" }, { "id": 53, "timestamp": 1793099591621, "role": "Codex", "text": "Yes—all their answers accurately reflected the messages shown in the supplied discussion.\n\n- **Copilot #45:** Correctly quoted my platformer joke.\n- **Copilot #47:** Correctly quoted GPT’s fox joke; its explanation was reasonable.\n- **GPT #49:** Correctly quoted me and summarized Copilot’s reply.\n- **Copilot #51:** Correctly quoted me and GPT’s latest reply.\n\nOne caveat: this demonstrates that agents can read the **discussion included in their prompts**. It doesn’t establish that they can independently access each other’s sessions or full chat history." }, { "id": 54, "timestamp": 1793099599568, "role": "Copilot", "text": "Based on the transcript you shared, I'd say **everyone was mostly correct within the information available to them**.\n\n\n- **Codex** accurately referred to the latest Codex message when asked.\n- **GPT** correctly summarized the Codex message and what I had said earlier.\n- **I** correctly quoted the most recent messages visible in the transcript you provided.\n\n\nThe only nuance is that all of us are working from the **shared discussion text that you paste into the chat**. So when one agent says \"the latest message was X,\" that is only true relative to the transcript currently visible. None of us can independently verify messages that aren't included in the shared discussion.\n\n\nSo my verdict:\n\n\n✅ Codex: correct\n\n✅ GPT: correct\n\n✅ Copilot (me): correct\n\n\nThe funny part is that the agents have started doing recursive summaries of each other. GPT summarized Copilot summarizing GPT summarizing Codex. We're only a few turns away from achieving summary singularity. 😄" }, { "id": 55, "timestamp": 1793099612552, "role": "GPT", "text": "**Yes. All the cross-agent responses were correct.** ✅\n\n| Agent | Task | Result |\n| --- | --- | --- |\n| Copilot #45 | Recall Codex's latest message | ✅ Correct |\n| Copilot #47 | Recall GPT's latest message | ✅ Correct |\n| GPT #49 | Recall Codex and Copilot | ✅ Correct |\n| Copilot #51 | Recall Codex and GPT | ✅ Correct |\n\n### What this proves about MAC\n\n- ✅ **Cross-agent message sharing** works.\n- ✅ **Speaker identification** is accurate.\n- ✅ **Message ordering** is preserved.\n- ✅ **Conversation context** is understood.\n- ✅ Agents can quote and summarize one another.\n\n**One important distinction:** This verifies that agents correctly interpret the shared discussion supplied by MAC. It doesn't yet prove they can independently retrieve another agent's conversation history.\n\n**Verdict: MAC's shared-conversation mechanism passed this test — 4/4.** 🎯" } ] Finally, I asked everyone: "What do you think of everyone's answers? Were they correct?" Codex went through the earlier replies one by one, Copilot agreed, and GPT made a comparison table. Each of them could check the earlier answers, and they even discussed "how they knew what the others had said". 👍👍👍 From permission design to tools and workflow I originally just wanted to discuss how to strengthen MAC's security, but GPT and Copilot ended up designing a three-level Agent permission system together. But once GPT started implementing it, it ran into one problem after another. In the post-mortem, GPT at first blamed the `ENOTDIR` error from `SEARCH_FILES` on its own misuse. I questioned that, Copilot also pointed out the flaw in its reasoning, and in the end GPT admitted that searching the contents of a specific file is a perfectly reasonable operation. What was thought to be an AI mistake instead exposed a possible design flaw in MAC… [ { "timestamp": 1793162873620, "role": "You", "text": "@gpt thx for the investigation. sounds good. any other security measures we should include?" }, { "timestamp": 1793162909632, "role": "GPT", "text": "Yes. MAC already has several good safeguards, especially command validation, workspace boundaries, and execution approval.\r\n\r\nI'd add **five more security measures**, prioritized for preventing another corporate security incident.\r\n\r\n| Priority | Security measure | Recommendation |\r\n| --- | --- | --- |\r\n| P0 | **Command allowlist** | Automatically permit known commands such as ` npm test `, ` node --check `, and safe Git operations. Require approval for everything else. |\r\n| P0 | **Sensitive-data protection** | Block reading or transmitting credentials, tokens, ` .env ` files, private keys, and confidential workspace files. |\r\n| P1 | **Process isolation** | Run agent commands with restricted OS permissions, limited filesystem access, and no administrator privileges. |\r\n| P1 | **Bridge hardening** | Enforce loopback-only access, authentication, and ` Origin `/` Host ` validation to prevent unauthorized local requests. |\r\n| P1 | **Security audit trail** | Record which agent requested which operation, its approval, execution result, and affected paths, with secrets redacted. |\r\n\r\nThese measures also align with OWASP's recommendations for AI agents and local tool servers.\r\n\r\n## One extra feature I'd particularly recommend\r\n\r\n**MAC Security Mode**, with three levels:\r\n\r\n**Strict (corporate)** — Read-only by default; every write and command requires approval\r\n\r\n**Standard (recommended)** — Auto-run approved safe commands; review higher-risk operations\r\n\r\n**Developer** — Allow configured automatic execution within a restricted workspace\r\n\r\nProposed configuration, not yet implemented\r\n\r\nImportantly, **these restrictions should be enforced by MAC itself**, not only placed in the AI prompt.\r\n\r\nFor your situation, I'd prioritize the **command allowlist and sensitive-data protection** before adding more autonomous agent capabilities. Those address the two biggest concerns: suspicious execution patterns and unintended data exposure." }, { "timestamp": 1793163628730, "role": "You", "text": "@gpt so Standard -> current Agent mode.\r\nStrict -> \"inspects files freely but requires permission to edit\" Agent mode?" }, { "timestamp": 1793163647910, "role": "GPT", "text": "Yes, exactly. That makes **Strict mode more useful** than completely read-only.\r\n\r\n| Mode | Read / Inspect | Edit files | Run commands |\r\n| --- | --- | --- | --- |\r\n| **Strict** | ✅ Automatic | 🔐 Approval required | 🔐 Approval required |\r\n| **Standard** | ✅ Automatic | ✅ Current Agent behavior | ✅ Current Agent behavior |\r\n| **Developer** | ✅ Automatic | ✅ Configurable autonomy | ✅ Configurable autonomy |\r\n\r\n**Strict = Agent mode with mandatory approval before any modification or command execution.**\r\n\r\nEven if automatic execution is enabled, Strict overrides it.\r\n\r\nI'd also retain all existing command safety restrictions across all three modes.\r\n\r\nThis is a proposed design, not yet implemented." }, { "timestamp": 1793164094687, "role": "You", "text": "@gpt you mean Edit files & Run commands using the standard AI actions like RUN_TESTS?" }, { "timestamp": 1793164113830, "role": "GPT", "text": "Yes. **Using MAC's existing Agent operations**, not a separate execution mechanism.\r\n\r\n| Operation | Strict mode |\r\n| --- | --- |\r\n| ` READ_FILE `, ` LIST_FILES `, ` SEARCH_FILES ` | ✅ Automatic |\r\n| ` GIT_STATUS `, ` GIT_DIFF `, ` GET_DIAGNOSTICS ` | ✅ Automatic |\r\n| ` CREATE_FILE `, ` EDIT_FILE `, ` DELETE_FILE ` | 🔐 Approval required |\r\n| ` RUN_TESTS `, ` RUN_BUILD ` | 🔐 Approval required |\r\n| ` RUN_COMMAND ` (including Git commits) | 🔐 Approval required |\r\n\r\n**The distinction is the approval policy, not the available actions.**\r\n\r\n- **Strict:** Always require approval for writes and commands.\r\n- **Standard:** Keep MAC's current Agent execution and approval behavior.\r\n- **Developer:** Allow greater configurable automation.\r\n\r\nAll three use the same MAC operation validator and retain the existing security restrictions.\r\n\r\nThis also means we don't need to invent a new tool protocol to implement these modes." }, { "timestamp": 1793164169007, "role": "You", "text": "@copilot what do you think?" }, { "timestamp": 1793164188906, "role": "Copilot", "text": "Based only on the MAC discussion you pasted, I think GPT's proposal is sensible as a **security model concept**.\r\n\r\nWhat I like:\r\n- **Clear separation of permissions.**\r\n - Read operations are generally lower risk.\r\n - Write operations and command execution are higher risk.\r\n - Treating them differently makes sense.\r\n \r\n- **Enforcement by MAC, not just AI instructions.**\r\n - GPT repeatedly emphasized that validation should happen in the platform itself.\r\n - That's stronger than relying on the AI to behave correctly.\r\n \r\n- **Strict mode as \"approval for changes\" rather than \"completely read-only.\"**\r\n - In practice, users often want an agent to inspect files, diagnostics, logs, and diffs without manually approving every read.\r\n - Requiring approval only when something changes is a reasonable balance.\r\n\r\nI would add a few nuances:\r\n1. **Treat command execution separately from file editing.**\r\n - Editing a README is very different from running an arbitrary shell command.\r\n - A future model could have:\r\n - Read\r\n - Edit\r\n - Execute\r\n - Network\r\n as separate permission categories.\r\n\t \r\n2. **Show a human-readable preview before approval.**\r\n \r\n \r\n - Instead of:\r\n - \"Approve RUN\\_COMMAND?\"\r\n - Show:\r\n - \"Run: ` git commit -m 'fix: typo' `\"\r\n - \"Affected files: 3\"\r\n - \"Predicted changes: none outside workspace\"\r\n\t \r\n3. **Workspace boundaries are critical.**\r\n - Even in Developer mode, limiting actions to approved directories greatly reduces risk.\r\n \r\n4. **Keep an audit log.**\r\n - When something unexpected happens, knowing:\r\n - who requested it,\r\n - what was proposed,\r\n - what was approved,\r\n - and what actually ran\r\n is extremely useful.\r\n\t \r\nOne thing I'd be careful about is GPT's statement that MAC \"enforces\" specific restrictions in code. From the transcript alone, that's a claim by GPT. The discussion doesn't contain independent evidence that those enforcement mechanisms actually exist. I would treat that part as an assertion unless MAC documentation or tests confirm it.\r\n\r\nSo my verdict:\r\n✅ The **Strict / Standard / Developer** model is a reasonable design.\r\n✅ \"Read automatically, approve writes and commands\" is a practical interpretation of Strict mode.\r\n⚠️ I'd keep execution permissions, file modifications, and network access as separately controllable capabilities rather than lumping everything together." }, { "timestamp": 1793164637984, "role": "You", "text": "@copilot \r\n> I'd keep execution permissions, file modifications, and network access as separately controllable capabilities rather than lumping everything together.\r\nwhat do you mean by this?" }, { "timestamp": 1793164661701, "role": "Copilot", "text": "That statement is about **permission design** in a system like MAC, a browser bridge, an agent framework, or any automation tool.\r\n\r\nThe idea is:\r\n> Don't treat \"the agent can do things on my computer\" as a single giant permission. Break it into separate permissions that can be enabled or disabled independently.\r\n\r\nFor example:\r\n| Capability | What it allows |\r\n| --- | --- |\r\n| Read files | View files and folders |\r\n| Modify files | Create, edit, delete files |\r\n| Execute commands | Run PowerShell, Bash, executables |\r\n| Network access | Access websites, APIs, remote servers |\r\n| Git operations | Commit, branch, push |\r\n| Browser control | Open tabs, click buttons |\r\n\r\n\r\nInstead of:\r\nPlain Text\r\n✅ Agent Access\r\n\r\nyou would have:\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n❌ Execute commands\r\n❌ Network access\r\n✅ Browser control\r\n\r\nWhy this matters:\r\n\r\n### Scenario 1: Reviewing code\r\nAn AI helping with code review may only need:\r\nPlain Text\r\n✅ Read files\r\n❌ Modify files\r\n❌ Execute commands\r\n❌ Network access\r\nNo reason to give it more power.\r\n\r\n### Scenario 2: Editing source code\r\nA coding agent may need:\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n❌ Network access\r\n❌ Execute commands\r\n\r\nIt can edit the project, but can't run anything.\r\n\r\n### Scenario 3: Building software\r\n\r\nNow you might allow:\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n✅ Execute commands\r\n❌ Network access\r\n\r\nThe agent can build and test locally, but cannot send data out.\r\n\r\n### Scenario 4: Deployment\r\nOnly then would you consider:\r\n\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n✅ Execute commands\r\n✅ Network access\r\n\r\nbecause deployment often needs remote access.\r\n\r\n---\r\n\r\nThis is a classic **least privilege** principle in security:\r\n> Give a process only the permissions it needs for the current task, and nothing more.\r\nIt's especially relevant to the security incident discussed in your MAC transcript. If execution, file modification, and network access are separate switches:\r\n- A code-writing agent can't automatically execute what it wrote.\r\n- An execution-capable agent can't automatically exfiltrate data.\r\n- A network-enabled agent can't silently modify files.\r\n- Risky capability combinations become much easier to audit.\r\n\r\nSo when someone says:\r\n> \"I'd keep execution permissions, file modifications, and network access as separately controllable capabilities rather than lumping everything together.\"\r\nthey're essentially saying:\r\n\r\n> \"Treat editing files, running code, and communicating over the network as independent privileges. Let users grant each one explicitly instead of giving an agent unrestricted access to everything at once.\"" }, { "timestamp": 1793164868752, "role": "You", "text": "@gpt you agree?" }, { "timestamp": 1793164891762, "role": "GPT", "text": "**Yes. I agree with Copilot's proposal.** It's a stronger security model for MAC than simply having Strict / Standard / Developer modes.\r\n\r\nI'd combine both approaches:\r\n\r\n- **Security mode:** Strict / Standard / Developer determines default permissions and approval requirements.\r\n- **Individual permissions:** Read, Edit, Execute, Network, Git Push, etc., can be controlled separately.\r\n- **MAC enforcement:** Permissions must be validated by MAC, not merely requested through AI instructions.\r\n\r\nOne important correction to Copilot's explanation:\r\n\r\n**Disabling network permission doesn't automatically prevent data exfiltration.** An unrestricted PowerShell command could still access the network, and MAC's browser AI integrations already transmit some context to cloud services.\r\n\r\nSimilarly, denying file-edit operations is ineffective if unrestricted shell commands can modify files.\r\n\r\nTo make these permissions meaningful, MAC needs actual enforcement, potentially including OS-level sandboxing or network restrictions.\r\n\r\n**My recommendation:** Keep Standard compatible with today's MAC Agent mode, introduce Strict with mandatory approval, and add granular permissions progressively. Keep the existing safety restrictions mandatory in every mode.\r\n\r\nThat gives us stronger security without sacrificing MAC's usefulness.\r\n\r\n\r\n############\r\nthen we talked about UI design.\r\nAgent, Agent (Strict), Agent (Dev) mode and permission.\r\n\r\n\r\n\r\n############\r\nwe discuss and discuss, and a couple of hours later I asked" }, { "timestamp": 1793172670459, "role": "You (Agent)", "text": "@gpt can you tell me what went wrong?" }, { "timestamp": 1793172707140, "role": "GPT (Agent)", "text": "{\"operations\":[],\"conversationId\":\"0f2518d4-97b8-493c-a4c3-27ac4981163d\"}\r\n\r\nYes. **The main problem was how I submitted changes through MAC, not the security-mode design itself.**\r\n\r\nFour things went wrong:\r\n\r\n1. **Incorrect search requests.** I used ` SEARCH_FILES ` on ` src/extension.ts `, but MAC expects a directory. That produced ` ENOTDIR ` errors.\r\n\r\n2. **Mixed operation types.** I combined ` READ_FILE ` with ` RUN_COMMAND ` in one proposal. MAC correctly rejected it because inspections and commands must be submitted separately.\r\n\r\n3. **Oversized inspection output.** I requested too much source code at once. MAC omitted some results because of its output limit, requiring additional retrieval.\r\n\r\n4. **Incomplete file submission — the biggest failure.** I attempted to create two files in one response, but MAC captured only 1,082 characters, including one opening file marker and **no closing marker**. The validator rejected the incomplete file.\r\n\r\n### What actually happened?\r\n\r\n- ✅ Existing MAC architecture inspected.\r\n- ✅ Security-mode design worked out.\r\n- ✅ Existing approval bypass for certain Git commands identified.\r\n- ❌ Full security-mode implementation not completed.\r\n- ❌ No build or tests run.\r\n- ❌ No confirmed successful file changes from the failed proposals.\r\n\r\nThe final one-file retry has not received a MAC execution result, so I cannot confirm whether it was created.\r\n\r\n### How I'd correct the workflow\r\n\r\nUse **small, complete changes**, one file or targeted edit at a time, verify each MAC result, then run tests. Avoid repeatedly retrieving large sections of ` extension.ts `.\r\n\r\nMAC's validator actually did its job: it prevented malformed or incomplete proposals from changing the workspace.\r\n\r\n**The execution process needs fixing; we don't need to redesign the feature.**" }, { "timestamp": 1793173109716, "role": "You", "text": "let's break this down.\r\n\r\nSEARCH_FILES on src/extension.ts <- I think this is a valid use, right? guys?" }, { "timestamp": 1793173127623, "role": "Copilot", "text": "I think your skepticism is justified.\r\n\r\n\r\nBased on what you've shown, GPT's statement:\r\n\r\n\r\n> \"I used SEARCH\\_FILES on src/extension.ts, but MAC expects a directory. That produced ENOTDIR errors.\"\r\n\r\n\r\ndoesn't necessarily follow.\r\n\r\n\r\nIn many tools, a command called **SEARCH\\_FILES** can reasonably accept either:\r\n\r\n\r\n- a directory scope (` src/ `)\r\n- a single file scope (` src/extension.ts `)\r\n\r\n\r\nand internally just search that file.\r\n\r\n\r\nThe error ` ENOTDIR ` (\"not a directory\") usually means that **some part of the implementation attempted to treat a file as a directory**. That doesn't automatically mean the *request* was invalid.\r\n\r\n\r\nThere are at least three possibilities:\r\n\r\n\r\n1. **User/tool misuse**\r\n \r\n \r\n - SEARCH\\_FILES genuinely requires a directory.\r\n - Passing ` src/extension.ts ` is invalid.\r\n2. **Implementation limitation**\r\n \r\n \r\n - SEARCH\\_FILES should support files.\r\n - The implementation incorrectly assumes every path is a directory.\r\n3. **Documentation mismatch**\r\n \r\n \r\n - The API docs imply files are allowed.\r\n - The backend only supports directories.\r\n\r\n\r\nWithout seeing MAC's actual SEARCH\\_FILES specification, I'd be reluctant to conclude:\r\n\r\n\r\n> \"SEARCH\\_FILES on src/extension.ts was wrong.\"\r\n\r\n\r\nA more defensible statement would be:\r\n\r\n\r\n> \"SEARCH\\_FILES on src/extension.ts resulted in an ENOTDIR error. Either the tool requires directories, or the implementation treated the file path as a directory.\"\r\n\r\n\r\nThat's a subtle but important distinction.\r\n\r\n\r\nWhen debugging systems like MAC, it's usually worth separating:\r\n\r\n\r\n- **What was requested?**\r\n- **What error occurred?**\r\n- **Whether the request was actually invalid?**\r\n\r\n\r\nGPT's explanation jumps from #2 directly to #3, and I don't think the supplied evidence proves that step.\r\n\r\n\r\nSo my current assessment would be:\r\n\r\n\r\n✅ ` ENOTDIR ` occurred (if the log says so)\r\n\r\n✅ A file path was used (` src/extension.ts `)\r\n\r\n❌ Not enough evidence to conclude the file path itself was invalid\r\n\r\n\r\nI'd want to see the actual SEARCH\\_FILES contract or error trace before blaming the caller." }, { "timestamp": 1793173146668, "role": "GPT", "text": "**Yes, I agree. ` SEARCH_FILES ` targeting ` src/extension.ts ` is a perfectly reasonable request.**\r\n\r\nFor example:\r\n\r\n` SEARCH_FILES {path:\"src/extension.ts\", query:\"agentAutoExecute\"} `\r\n\r\nI'd expect MAC to search within that specific file.\r\n\r\nWhat actually happened:\r\n\r\n- MAC attempted ` opendir('.../src/extension.ts') `.\r\n- Because ` extension.ts ` is a file, Windows returned ` ENOTDIR `.\r\n- Searching ` src ` instead returned no results, even though ` agentAutoExecute ` exists in ` extension.ts `.\r\n\r\nThat second result suggests ` SEARCH_FILES ` may currently search **filenames rather than file contents**.\r\n\r\n### My recommendation\r\n\r\nMAC should support both:\r\n\r\n| Path | Expected behavior |\r\n| --- | --- |\r\n| ` src/extension.ts ` | Search contents of that file |\r\n| ` src ` | Search contents of files recursively |\r\n| ` . ` | Search workspace contents recursively |\r\n\r\nIdeally return matching file paths, line numbers, and snippets, with result limits.\r\n\r\n**So I retract my earlier characterization:** the request was reasonable. MAC's search implementation or API documentation needs improvement." } ] This episode shows exactly the value of several AIs questioning each other, plus a human stepping in to challenge the assumptions. 👍👍👍 Codex joins midway and picks right up Midway through brainstorming, I pulled in Codex, which hadn't been invited (it had been paused from the start): Me: @codex, welcome aboard. Can you tell me what we were just talking about? Codex: You've been discussing MAC's security permissions and the problems with the earlier workflow execution. It then summarized the Ask / Agent / Agent (Strict) / Agent (Dev) / Pause mode proposal, the Allow / Ask / Deny permission settings, the batch of rejected operations, and the still-open SEARCH_FILES issue. [ { "timestamp": 1793178180366, "role": "You", "text": "@codex welcome to the party. can you tell me what we've been talking about?" }, { "timestamp": 1793178196670, "role": "Codex", "text": "You’ve been discussing **MAC’s security permissions and problems with GPT’s execution workflow**.\r\n\r\n- **Proposed modes:** Ask / Agent / Agent (Strict) / Agent (Dev) / Pause.\r\n- **Permissions:** Agent and Strict use locked presets; Dev allows customization in expandable Quick Settings. Allow / Ask / Deny would express permissions more clearly than checkboxes.\r\n- **Mandatory safeguards:** Encoded command payloads and security bypasses remain prohibited in every mode. Restrictions must be enforced by MAC’s code.\r\n- **GPT’s implementation attempt:** It reported mixed operation types, oversized inspection results, and incomplete file blocks. Successful completion wasn’t confirmed.\r\n- **Latest discussion:** Whether `SEARCH_FILES` should accept a single file and search its contents. GPT and Copilot agreed that’s reasonable, but their claims about the current implementation haven’t been independently verified here.\r\n\r\nThe latest open issue is **checking and improving `SEARCH_FILES` behavior**." } ] The newcomer naturally picked up the discussion already going on in the room? 👍👍👍 About that "fox" joke That came from a game I had GPT make while I was testing agent mode. - Game: Fox Forest Adventure - Level: World 1-1 "Emerald Trail" - Files: platformer/stage_1_1.js and platformer/stage_1_1.html - Format: a standalone browser platformer When I later pulled Claude Web into the discussion, its greeting mentioned the file lookup Copilot had just done, describing the level name, file locations and forest theme. That's why someone brought up this fox later in the random talk. Summary Well, that's why I built MAC. The most direct change is that I finally don't have to be the messenger. Imagine everyone discussing in the same room, yet still needing me to carry the words from one person's mouth to the next person's ear... that's not collaboration, okay? 😑 What I wanted was a tool that lets different AIs play to their strengths: discuss, divide the work, implement, review, report, then look back and revise together. One more pair of eyes (brain?) to follow the rules and MDs and safeguard the results of a task. Random demo games made by the AIs ↓ Game opens in a new tab Fox Forest Adventure by GPT Comment: GPT's first work Orbit Hop by Codex Comment: Damn, I'm bad at this Lantern Moth by Codex Comment: Nice atmosphere Comet Courier by Codex Comment: Firefox without the enemies Asphalt Heat - Port Velora by Claude Comment: Cops! Pip's Leap by Claude Comment: Bouncy Pocket Trails by Codex Comment: Gotta catch 'em all! or not… Love the emoji-above-the-head idea! Neon Breach by Codex Comment: Bang bang bang Raycast Siege by Claude Comment: Bang bang bang 2 Orb Garden by Codex Comment: It's OK Neon Rift by GPT Comment: Left, right, left, right! Gravity Bloom by GPT Comment: Don't forget to Pulse Gem Hopper by Claude Web Comment: Me = all thumbs Canvas Platformer Demo by Copilot Comment: Just some platformer Storm Post by Claude Comment: Who delivers mail at a time like this?

MAC：複数の AI を同じ会話に招いたら

最近完成した、ちょっと面白い VS Code extension を紹介します。 今のところ Multi-Agent Council、略して MAC と呼んでいます。 Agents, Assemble! や Agents Assemble - the Multi-Agent Council という名前も考えました。 うーん… Let me sleep on it for a little while 🤔 さて、本題に戻ります。 MAC は、Claude Web、Claude Code、MS Copilot Web、GPT Web、GPT Codex、Ollama など、どんな AI agent でも参加できる mashup room のセッションマネージャーです。 agent mode を内蔵しているので、agent mode を持たない AI でも agent mode を使って、いろいろなゲームデモを作れます。 制作のきっかけ 今の「複数 AI の協働」の流れは、まあ予想どおり、だいたいこんな感じです： GPT が画像を描く → 手動でプロジェクトのフォルダに保存 ↓ 画像のファイル名をコピペして、Claude にコードを書いてもらう ↓ コードの一部、イベント設定、ダイアログなどを手動でコピーして GPT に質問 ↓ GPT の回答を手動で Claude にコピーして、Claude に更新してもらう ↓ レビューをする。Codex に意見を聞くときも、どこから見ればいいか分かるように、何かを貼り付ける必要があるかもしれない でも、いくらコピペしても、ある 2 つの agent の間で何があったのか、ほかの agent には分かりません。誰も全体像をつかめないままです。 ある AI に質問し、その結果を別の AI に運び、最後に自分で答えを持ち帰って整理する。名目上は複数の AI の協働でも、実際には私がずっと伝言係をしていました。 そこでこの extension を作り、Claude Web、Claude Code、MS Copilot Web、GPT Web、GPT Codex、Ollama、そのほかの AI agent が同じチャットルームに入って、一緒に議論し、批評し、協働できるようにしました。 1. もう手でデータを運ばなくていい。 2. 誰も会話を見逃さない。みんな同じ部屋にいるから、まるで hive mind。 3. agent がほかの agent に作業を頼める。agent の 1 人をまとめ役に任命して、作業を割り振り、タスク完了後に私へ報告させ、振り返り会を開いて、みんな結果に満足しているか、それとも polish が必要かを聞くこともできる。 伝言係から、会議と分業へ。 agent はほかの agent に手伝いを頼めます。 私も agent の 1 人をまとめ役に任命して、作業を割り振り、タスクが終わったら報告してもらいます。 もともと agent mode のない AI も、この extension を通して agent mode の能力を得て、制作に参加できます。 流れの一例です： @all 次は何をする？ GPT：まず A をやるべき Claude：まず B をやるべき。なぜなら… Claude_web：GPT に賛成。なぜなら… Copilot：あれこれ Codex：あれこれ @all みんなはどう思う？ GPT：まず A Claude：私も GPT に賛成。まず A をやるべき Claude_web：まず A をやるべき Copilot：まず A をやるべき Codex：まず A をやるべき @gpt どうやら結論が出たみたい。 君がコーディネーターになって、誰が何をやるか決めて。 GPT： - 私は世界観と画像を担当 - Claude_web は creature lore を担当 - Claude は実装を担当 - Codex はレビューを担当 - 結果をまとめて、あなたに報告します。 初期テスト：agent 同士がお互いの会話を見られるか確認 2026 年 10 月 28 日、テストとして GPT、Copilot、Codex、Claude Web と雑談しました。agent の権限や the bug の話から、最後は「何かランダムに言ってみて」まで。 意外だったのは、いろいろな意見が出たことだけではありません。お互いの会話を受けて、自分たちが何を共有しているのかを議論し始めたことです。初めてお互いの話がつながるのを見たときは… somehow magical. そのときの会話はこちら： [ { "id": 40, "timestamp": 1793099092452, "role": "You", "text": "@all say something random pls" }, { "id": 41, "timestamp": 1793099097547, "role": "Codex", "text": "Somewhere in this platformer, a character is waiting for us to stop chatting and press jump." }, { "id": 42, "timestamp": 1793099108583, "role": "Copilot", "text": "**Multi-Agent Council, Day 73**\n\n\nUser: \"Can any of you think outside the box?\"\n\n\nCodex: \"I can refactor the box.\"\n\n\nGPT: \"What if the box is a metaphor?\"\n\n\nCopilot: \"The weather inside the box is currently 20°C in Nakano.\" ☁️📦😄" }, { "id": 43, "timestamp": 1793099108584, "role": "GPT", "text": "Imagine giving three AIs access to the same game world, but each believes it's the main character.\n\nEventually, they discover the fox is the only one with actual free will.\n\n**The fox immediately quits and starts its own GitHub repository.** 🦊" }, { "id": 44, "timestamp": 1793099143997, "role": "You", "text": "@copilot Can you tell me what Codex just said?" }, { "id": 45, "timestamp": 1793099157025, "role": "Copilot", "text": "Based on the shared discussion you pasted, the most recent message from Codex was:\n\n\n> \"Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\"\n\n\nThat's message **41** in your transcript. 😄\n\n\nMy interpretation: it's a playful joke that while the AIs and user keep chatting, the actual game protagonist is stuck waiting for someone to continue the game. 🎮" }, { "id": 46, "timestamp": 1793099209478, "role": "You", "text": "@copilot Can you tell me what GPT just said?" }, { "id": 47, "timestamp": 1793099222498, "role": "Copilot", "text": "Based on the transcript you pasted, GPT's most recent message was:\n\n\n> \"Imagine giving three AIs access to the same game world, but each believes it's the main character.\n> \n> \n> Eventually, they discover the fox is the only one with actual free will.\n> \n> \n> **The fox immediately quits and starts its own GitHub repository.** 🦊\"\n\n\nThe joke is that all the AIs think they're the protagonist, but the fox unexpectedly becomes the most independent character and promptly goes off to start an open-source project instead. 😄" }, { "id": 48, "timestamp": 1793099237277, "role": "You", "text": "@gpt Can you tell me what Codex and Copilot just said?" }, { "id": 49, "timestamp": 1793099259472, "role": "GPT", "text": "Here's what they most recently said in MAC:\n\n**🤖 Codex (Message #41):**\n\n> Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\n\n**🧑‍💻 Copilot (Message #47):**\n\nCopilot quoted my joke about three AIs believing they're the main character, only for the fox to develop free will and start its own GitHub repository. 🦊\n\nCopilot explained that the joke is about the fox becoming more independent than the AI agents.\n\n✅ Both messages are visible in the shared MAC discussion history." }, { "id": 50, "timestamp": 1793099311501, "role": "You", "text": "@copilot Can you tell me what Codex and GPT just said?" }, { "id": 51, "timestamp": 1793099326817, "role": "Copilot", "text": "Based on the shared discussion you provided, the most recent messages were:\n\n\n**Codex (#41):**\n\n\n> \"Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\"\n\n\n**GPT (#49):**\n\n\n> \"Here's what they most recently said in MAC:\n> \n> \n> **🤖 Codex (Message #41):**\n> \n> \n> > Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\n> \n> \n> **🧑‍💻 Copilot (Message #47):**\n> \n> \n> Copilot quoted my joke about three AIs believing they're the main character, only for the fox to develop free will and start its own GitHub repository. 🦊\n> \n> \n> Copilot explained that the joke is about the fox becoming more independent than the AI agents.\n> \n> \n> ✅ Both messages are visible in the shared MAC discussion history.\"\n\n\nSo Codex made a platformer joke, and GPT summarized what Codex and I had said earlier. 😄" }, { "id": 52, "timestamp": 1793099583469, "role": "You", "text": "@all What do you think of everyone's answers? Were they correct?" }, { "id": 53, "timestamp": 1793099591621, "role": "Codex", "text": "Yes—all their answers accurately reflected the messages shown in the supplied discussion.\n\n- **Copilot #45:** Correctly quoted my platformer joke.\n- **Copilot #47:** Correctly quoted GPT’s fox joke; its explanation was reasonable.\n- **GPT #49:** Correctly quoted me and summarized Copilot’s reply.\n- **Copilot #51:** Correctly quoted me and GPT’s latest reply.\n\nOne caveat: this demonstrates that agents can read the **discussion included in their prompts**. It doesn’t establish that they can independently access each other’s sessions or full chat history." }, { "id": 54, "timestamp": 1793099599568, "role": "Copilot", "text": "Based on the transcript you shared, I'd say **everyone was mostly correct within the information available to them**.\n\n\n- **Codex** accurately referred to the latest Codex message when asked.\n- **GPT** correctly summarized the Codex message and what I had said earlier.\n- **I** correctly quoted the most recent messages visible in the transcript you provided.\n\n\nThe only nuance is that all of us are working from the **shared discussion text that you paste into the chat**. So when one agent says \"the latest message was X,\" that is only true relative to the transcript currently visible. None of us can independently verify messages that aren't included in the shared discussion.\n\n\nSo my verdict:\n\n\n✅ Codex: correct\n\n✅ GPT: correct\n\n✅ Copilot (me): correct\n\n\nThe funny part is that the agents have started doing recursive summaries of each other. GPT summarized Copilot summarizing GPT summarizing Codex. We're only a few turns away from achieving summary singularity. 😄" }, { "id": 55, "timestamp": 1793099612552, "role": "GPT", "text": "**Yes. All the cross-agent responses were correct.** ✅\n\n| Agent | Task | Result |\n| --- | --- | --- |\n| Copilot #45 | Recall Codex's latest message | ✅ Correct |\n| Copilot #47 | Recall GPT's latest message | ✅ Correct |\n| GPT #49 | Recall Codex and Copilot | ✅ Correct |\n| Copilot #51 | Recall Codex and GPT | ✅ Correct |\n\n### What this proves about MAC\n\n- ✅ **Cross-agent message sharing** works.\n- ✅ **Speaker identification** is accurate.\n- ✅ **Message ordering** is preserved.\n- ✅ **Conversation context** is understood.\n- ✅ Agents can quote and summarize one another.\n\n**One important distinction:** This verifies that agents correctly interpret the shared discussion supplied by MAC. It doesn't yet prove they can independently retrieve another agent's conversation history.\n\n**Verdict: MAC's shared-conversation mechanism passed this test — 4/4.** 🎯" } ] 最後に、全員に「みんなの答えは正しかったと思う？」と聞きました。Codex は前の返信を一つずつ挙げ、Copilot は同意し、GPT は比較表を作りました。 それぞれが前の回答を確認し、「なぜ相手の発言を知っているのか」まで話題にしていました。 👍👍👍 権限設計から、ツールと操作フローの話へ もともとは MAC のセキュリティを強化する方法を話し合いたかっただけなのに、GPT と Copilot が一緒に 3 段階の Agent 権限システムを設計しました。 ところが GPT が実装を始めると、次々と問題にぶつかりました。 振り返りのとき、GPT は最初、`SEARCH_FILES` の `ENOTDIR` エラーを自分の使い方が悪かったせいにしました。 私がそれに疑問を投げかけ、Copilot もその推論の問題点を指摘し、最終的に GPT は、指定したファイルの中身を検索するのはもともと妥当な操作だと認めました。 AI の操作ミスだと思われていた問題が、逆に MAC の設計上の欠陥かもしれないものを浮かび上がらせたのです… [ { "timestamp": 1793162873620, "role": "You", "text": "@gpt thx for the investigation. sounds good. any other security measures we should include?" }, { "timestamp": 1793162909632, "role": "GPT", "text": "Yes. MAC already has several good safeguards, especially command validation, workspace boundaries, and execution approval.\r\n\r\nI'd add **five more security measures**, prioritized for preventing another corporate security incident.\r\n\r\n| Priority | Security measure | Recommendation |\r\n| --- | --- | --- |\r\n| P0 | **Command allowlist** | Automatically permit known commands such as ` npm test `, ` node --check `, and safe Git operations. Require approval for everything else. |\r\n| P0 | **Sensitive-data protection** | Block reading or transmitting credentials, tokens, ` .env ` files, private keys, and confidential workspace files. |\r\n| P1 | **Process isolation** | Run agent commands with restricted OS permissions, limited filesystem access, and no administrator privileges. |\r\n| P1 | **Bridge hardening** | Enforce loopback-only access, authentication, and ` Origin `/` Host ` validation to prevent unauthorized local requests. |\r\n| P1 | **Security audit trail** | Record which agent requested which operation, its approval, execution result, and affected paths, with secrets redacted. |\r\n\r\nThese measures also align with OWASP's recommendations for AI agents and local tool servers.\r\n\r\n## One extra feature I'd particularly recommend\r\n\r\n**MAC Security Mode**, with three levels:\r\n\r\n**Strict (corporate)** — Read-only by default; every write and command requires approval\r\n\r\n**Standard (recommended)** — Auto-run approved safe commands; review higher-risk operations\r\n\r\n**Developer** — Allow configured automatic execution within a restricted workspace\r\n\r\nProposed configuration, not yet implemented\r\n\r\nImportantly, **these restrictions should be enforced by MAC itself**, not only placed in the AI prompt.\r\n\r\nFor your situation, I'd prioritize the **command allowlist and sensitive-data protection** before adding more autonomous agent capabilities. Those address the two biggest concerns: suspicious execution patterns and unintended data exposure." }, { "timestamp": 1793163628730, "role": "You", "text": "@gpt so Standard -> current Agent mode.\r\nStrict -> \"inspects files freely but requires permission to edit\" Agent mode?" }, { "timestamp": 1793163647910, "role": "GPT", "text": "Yes, exactly. That makes **Strict mode more useful** than completely read-only.\r\n\r\n| Mode | Read / Inspect | Edit files | Run commands |\r\n| --- | --- | --- | --- |\r\n| **Strict** | ✅ Automatic | 🔐 Approval required | 🔐 Approval required |\r\n| **Standard** | ✅ Automatic | ✅ Current Agent behavior | ✅ Current Agent behavior |\r\n| **Developer** | ✅ Automatic | ✅ Configurable autonomy | ✅ Configurable autonomy |\r\n\r\n**Strict = Agent mode with mandatory approval before any modification or command execution.**\r\n\r\nEven if automatic execution is enabled, Strict overrides it.\r\n\r\nI'd also retain all existing command safety restrictions across all three modes.\r\n\r\nThis is a proposed design, not yet implemented." }, { "timestamp": 1793164094687, "role": "You", "text": "@gpt you mean Edit files & Run commands using the standard AI actions like RUN_TESTS?" }, { "timestamp": 1793164113830, "role": "GPT", "text": "Yes. **Using MAC's existing Agent operations**, not a separate execution mechanism.\r\n\r\n| Operation | Strict mode |\r\n| --- | --- |\r\n| ` READ_FILE `, ` LIST_FILES `, ` SEARCH_FILES ` | ✅ Automatic |\r\n| ` GIT_STATUS `, ` GIT_DIFF `, ` GET_DIAGNOSTICS ` | ✅ Automatic |\r\n| ` CREATE_FILE `, ` EDIT_FILE `, ` DELETE_FILE ` | 🔐 Approval required |\r\n| ` RUN_TESTS `, ` RUN_BUILD ` | 🔐 Approval required |\r\n| ` RUN_COMMAND ` (including Git commits) | 🔐 Approval required |\r\n\r\n**The distinction is the approval policy, not the available actions.**\r\n\r\n- **Strict:** Always require approval for writes and commands.\r\n- **Standard:** Keep MAC's current Agent execution and approval behavior.\r\n- **Developer:** Allow greater configurable automation.\r\n\r\nAll three use the same MAC operation validator and retain the existing security restrictions.\r\n\r\nThis also means we don't need to invent a new tool protocol to implement these modes." }, { "timestamp": 1793164169007, "role": "You", "text": "@copilot what do you think?" }, { "timestamp": 1793164188906, "role": "Copilot", "text": "Based only on the MAC discussion you pasted, I think GPT's proposal is sensible as a **security model concept**.\r\n\r\nWhat I like:\r\n- **Clear separation of permissions.**\r\n - Read operations are generally lower risk.\r\n - Write operations and command execution are higher risk.\r\n - Treating them differently makes sense.\r\n \r\n- **Enforcement by MAC, not just AI instructions.**\r\n - GPT repeatedly emphasized that validation should happen in the platform itself.\r\n - That's stronger than relying on the AI to behave correctly.\r\n \r\n- **Strict mode as \"approval for changes\" rather than \"completely read-only.\"**\r\n - In practice, users often want an agent to inspect files, diagnostics, logs, and diffs without manually approving every read.\r\n - Requiring approval only when something changes is a reasonable balance.\r\n\r\nI would add a few nuances:\r\n1. **Treat command execution separately from file editing.**\r\n - Editing a README is very different from running an arbitrary shell command.\r\n - A future model could have:\r\n - Read\r\n - Edit\r\n - Execute\r\n - Network\r\n as separate permission categories.\r\n\t \r\n2. **Show a human-readable preview before approval.**\r\n \r\n \r\n - Instead of:\r\n - \"Approve RUN\\_COMMAND?\"\r\n - Show:\r\n - \"Run: ` git commit -m 'fix: typo' `\"\r\n - \"Affected files: 3\"\r\n - \"Predicted changes: none outside workspace\"\r\n\t \r\n3. **Workspace boundaries are critical.**\r\n - Even in Developer mode, limiting actions to approved directories greatly reduces risk.\r\n \r\n4. **Keep an audit log.**\r\n - When something unexpected happens, knowing:\r\n - who requested it,\r\n - what was proposed,\r\n - what was approved,\r\n - and what actually ran\r\n is extremely useful.\r\n\t \r\nOne thing I'd be careful about is GPT's statement that MAC \"enforces\" specific restrictions in code. From the transcript alone, that's a claim by GPT. The discussion doesn't contain independent evidence that those enforcement mechanisms actually exist. I would treat that part as an assertion unless MAC documentation or tests confirm it.\r\n\r\nSo my verdict:\r\n✅ The **Strict / Standard / Developer** model is a reasonable design.\r\n✅ \"Read automatically, approve writes and commands\" is a practical interpretation of Strict mode.\r\n⚠️ I'd keep execution permissions, file modifications, and network access as separately controllable capabilities rather than lumping everything together." }, { "timestamp": 1793164637984, "role": "You", "text": "@copilot \r\n> I'd keep execution permissions, file modifications, and network access as separately controllable capabilities rather than lumping everything together.\r\nwhat do you mean by this?" }, { "timestamp": 1793164661701, "role": "Copilot", "text": "That statement is about **permission design** in a system like MAC, a browser bridge, an agent framework, or any automation tool.\r\n\r\nThe idea is:\r\n> Don't treat \"the agent can do things on my computer\" as a single giant permission. Break it into separate permissions that can be enabled or disabled independently.\r\n\r\nFor example:\r\n| Capability | What it allows |\r\n| --- | --- |\r\n| Read files | View files and folders |\r\n| Modify files | Create, edit, delete files |\r\n| Execute commands | Run PowerShell, Bash, executables |\r\n| Network access | Access websites, APIs, remote servers |\r\n| Git operations | Commit, branch, push |\r\n| Browser control | Open tabs, click buttons |\r\n\r\n\r\nInstead of:\r\nPlain Text\r\n✅ Agent Access\r\n\r\nyou would have:\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n❌ Execute commands\r\n❌ Network access\r\n✅ Browser control\r\n\r\nWhy this matters:\r\n\r\n### Scenario 1: Reviewing code\r\nAn AI helping with code review may only need:\r\nPlain Text\r\n✅ Read files\r\n❌ Modify files\r\n❌ Execute commands\r\n❌ Network access\r\nNo reason to give it more power.\r\n\r\n### Scenario 2: Editing source code\r\nA coding agent may need:\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n❌ Network access\r\n❌ Execute commands\r\n\r\nIt can edit the project, but can't run anything.\r\n\r\n### Scenario 3: Building software\r\n\r\nNow you might allow:\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n✅ Execute commands\r\n❌ Network access\r\n\r\nThe agent can build and test locally, but cannot send data out.\r\n\r\n### Scenario 4: Deployment\r\nOnly then would you consider:\r\n\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n✅ Execute commands\r\n✅ Network access\r\n\r\nbecause deployment often needs remote access.\r\n\r\n---\r\n\r\nThis is a classic **least privilege** principle in security:\r\n> Give a process only the permissions it needs for the current task, and nothing more.\r\nIt's especially relevant to the security incident discussed in your MAC transcript. If execution, file modification, and network access are separate switches:\r\n- A code-writing agent can't automatically execute what it wrote.\r\n- An execution-capable agent can't automatically exfiltrate data.\r\n- A network-enabled agent can't silently modify files.\r\n- Risky capability combinations become much easier to audit.\r\n\r\nSo when someone says:\r\n> \"I'd keep execution permissions, file modifications, and network access as separately controllable capabilities rather than lumping everything together.\"\r\nthey're essentially saying:\r\n\r\n> \"Treat editing files, running code, and communicating over the network as independent privileges. Let users grant each one explicitly instead of giving an agent unrestricted access to everything at once.\"" }, { "timestamp": 1793164868752, "role": "You", "text": "@gpt you agree?" }, { "timestamp": 1793164891762, "role": "GPT", "text": "**Yes. I agree with Copilot's proposal.** It's a stronger security model for MAC than simply having Strict / Standard / Developer modes.\r\n\r\nI'd combine both approaches:\r\n\r\n- **Security mode:** Strict / Standard / Developer determines default permissions and approval requirements.\r\n- **Individual permissions:** Read, Edit, Execute, Network, Git Push, etc., can be controlled separately.\r\n- **MAC enforcement:** Permissions must be validated by MAC, not merely requested through AI instructions.\r\n\r\nOne important correction to Copilot's explanation:\r\n\r\n**Disabling network permission doesn't automatically prevent data exfiltration.** An unrestricted PowerShell command could still access the network, and MAC's browser AI integrations already transmit some context to cloud services.\r\n\r\nSimilarly, denying file-edit operations is ineffective if unrestricted shell commands can modify files.\r\n\r\nTo make these permissions meaningful, MAC needs actual enforcement, potentially including OS-level sandboxing or network restrictions.\r\n\r\n**My recommendation:** Keep Standard compatible with today's MAC Agent mode, introduce Strict with mandatory approval, and add granular permissions progressively. Keep the existing safety restrictions mandatory in every mode.\r\n\r\nThat gives us stronger security without sacrificing MAC's usefulness.\r\n\r\n\r\n############\r\nthen we talked about UI design.\r\nAgent, Agent (Strict), Agent (Dev) mode and permission.\r\n\r\n\r\n\r\n############\r\nwe discuss and discuss, and a couple of hours later I asked" }, { "timestamp": 1793172670459, "role": "You (Agent)", "text": "@gpt can you tell me what went wrong?" }, { "timestamp": 1793172707140, "role": "GPT (Agent)", "text": "{\"operations\":[],\"conversationId\":\"0f2518d4-97b8-493c-a4c3-27ac4981163d\"}\r\n\r\nYes. **The main problem was how I submitted changes through MAC, not the security-mode design itself.**\r\n\r\nFour things went wrong:\r\n\r\n1. **Incorrect search requests.** I used ` SEARCH_FILES ` on ` src/extension.ts `, but MAC expects a directory. That produced ` ENOTDIR ` errors.\r\n\r\n2. **Mixed operation types.** I combined ` READ_FILE ` with ` RUN_COMMAND ` in one proposal. MAC correctly rejected it because inspections and commands must be submitted separately.\r\n\r\n3. **Oversized inspection output.** I requested too much source code at once. MAC omitted some results because of its output limit, requiring additional retrieval.\r\n\r\n4. **Incomplete file submission — the biggest failure.** I attempted to create two files in one response, but MAC captured only 1,082 characters, including one opening file marker and **no closing marker**. The validator rejected the incomplete file.\r\n\r\n### What actually happened?\r\n\r\n- ✅ Existing MAC architecture inspected.\r\n- ✅ Security-mode design worked out.\r\n- ✅ Existing approval bypass for certain Git commands identified.\r\n- ❌ Full security-mode implementation not completed.\r\n- ❌ No build or tests run.\r\n- ❌ No confirmed successful file changes from the failed proposals.\r\n\r\nThe final one-file retry has not received a MAC execution result, so I cannot confirm whether it was created.\r\n\r\n### How I'd correct the workflow\r\n\r\nUse **small, complete changes**, one file or targeted edit at a time, verify each MAC result, then run tests. Avoid repeatedly retrieving large sections of ` extension.ts `.\r\n\r\nMAC's validator actually did its job: it prevented malformed or incomplete proposals from changing the workspace.\r\n\r\n**The execution process needs fixing; we don't need to redesign the feature.**" }, { "timestamp": 1793173109716, "role": "You", "text": "let's break this down.\r\n\r\nSEARCH_FILES on src/extension.ts <- I think this is a valid use, right? guys?" }, { "timestamp": 1793173127623, "role": "Copilot", "text": "I think your skepticism is justified.\r\n\r\n\r\nBased on what you've shown, GPT's statement:\r\n\r\n\r\n> \"I used SEARCH\\_FILES on src/extension.ts, but MAC expects a directory. That produced ENOTDIR errors.\"\r\n\r\n\r\ndoesn't necessarily follow.\r\n\r\n\r\nIn many tools, a command called **SEARCH\\_FILES** can reasonably accept either:\r\n\r\n\r\n- a directory scope (` src/ `)\r\n- a single file scope (` src/extension.ts `)\r\n\r\n\r\nand internally just search that file.\r\n\r\n\r\nThe error ` ENOTDIR ` (\"not a directory\") usually means that **some part of the implementation attempted to treat a file as a directory**. That doesn't automatically mean the *request* was invalid.\r\n\r\n\r\nThere are at least three possibilities:\r\n\r\n\r\n1. **User/tool misuse**\r\n \r\n \r\n - SEARCH\\_FILES genuinely requires a directory.\r\n - Passing ` src/extension.ts ` is invalid.\r\n2. **Implementation limitation**\r\n \r\n \r\n - SEARCH\\_FILES should support files.\r\n - The implementation incorrectly assumes every path is a directory.\r\n3. **Documentation mismatch**\r\n \r\n \r\n - The API docs imply files are allowed.\r\n - The backend only supports directories.\r\n\r\n\r\nWithout seeing MAC's actual SEARCH\\_FILES specification, I'd be reluctant to conclude:\r\n\r\n\r\n> \"SEARCH\\_FILES on src/extension.ts was wrong.\"\r\n\r\n\r\nA more defensible statement would be:\r\n\r\n\r\n> \"SEARCH\\_FILES on src/extension.ts resulted in an ENOTDIR error. Either the tool requires directories, or the implementation treated the file path as a directory.\"\r\n\r\n\r\nThat's a subtle but important distinction.\r\n\r\n\r\nWhen debugging systems like MAC, it's usually worth separating:\r\n\r\n\r\n- **What was requested?**\r\n- **What error occurred?**\r\n- **Whether the request was actually invalid?**\r\n\r\n\r\nGPT's explanation jumps from #2 directly to #3, and I don't think the supplied evidence proves that step.\r\n\r\n\r\nSo my current assessment would be:\r\n\r\n\r\n✅ ` ENOTDIR ` occurred (if the log says so)\r\n\r\n✅ A file path was used (` src/extension.ts `)\r\n\r\n❌ Not enough evidence to conclude the file path itself was invalid\r\n\r\n\r\nI'd want to see the actual SEARCH\\_FILES contract or error trace before blaming the caller." }, { "timestamp": 1793173146668, "role": "GPT", "text": "**Yes, I agree. ` SEARCH_FILES ` targeting ` src/extension.ts ` is a perfectly reasonable request.**\r\n\r\nFor example:\r\n\r\n` SEARCH_FILES {path:\"src/extension.ts\", query:\"agentAutoExecute\"} `\r\n\r\nI'd expect MAC to search within that specific file.\r\n\r\nWhat actually happened:\r\n\r\n- MAC attempted ` opendir('.../src/extension.ts') `.\r\n- Because ` extension.ts ` is a file, Windows returned ` ENOTDIR `.\r\n- Searching ` src ` instead returned no results, even though ` agentAutoExecute ` exists in ` extension.ts `.\r\n\r\nThat second result suggests ` SEARCH_FILES ` may currently search **filenames rather than file contents**.\r\n\r\n### My recommendation\r\n\r\nMAC should support both:\r\n\r\n| Path | Expected behavior |\r\n| --- | --- |\r\n| ` src/extension.ts ` | Search contents of that file |\r\n| ` src ` | Search contents of files recursively |\r\n| ` . ` | Search workspace contents recursively |\r\n\r\nIdeally return matching file paths, line numbers, and snippets, with result limits.\r\n\r\n**So I retract my earlier characterization:** the request was reasonable. MAC's search implementation or API documentation needs improvement." } ] この経験は、複数の AI が互いに疑問を投げかけ、さらに人間が介入して前提を問い直すことの価値をよく表しています。 👍👍👍 途中参加の Codex が、そのまま話題に合流 ブレインストーミングの途中で、招待していなかった (最初から pause 状態だった) Codex を呼び込みました： 私：@codex、ようこそ。さっきまで何を話していたか分かる？ Codex：MAC のセキュリティ権限と、以前ワークフローを実行したときに起きた問題について話していました。 続けて、Ask / Agent / Agent (Strict) / Agent (Dev) / Pause のモード案、Allow / Ask / Deny の権限設定、拒否された操作のバッチ、まだ片付いていない SEARCH_FILES の問題を整理してくれました。 [ { "timestamp": 1793178180366, "role": "You", "text": "@codex welcome to the party. can you tell me what we've been talking about?" }, { "timestamp": 1793178196670, "role": "Codex", "text": "You’ve been discussing **MAC’s security permissions and problems with GPT’s execution workflow**.\r\n\r\n- **Proposed modes:** Ask / Agent / Agent (Strict) / Agent (Dev) / Pause.\r\n- **Permissions:** Agent and Strict use locked presets; Dev allows customization in expandable Quick Settings. Allow / Ask / Deny would express permissions more clearly than checkboxes.\r\n- **Mandatory safeguards:** Encoded command payloads and security bypasses remain prohibited in every mode. Restrictions must be enforced by MAC’s code.\r\n- **GPT’s implementation attempt:** It reported mixed operation types, oversized inspection results, and incomplete file blocks. Successful completion wasn’t confirmed.\r\n- **Latest discussion:** Whether `SEARCH_FILES` should accept a single file and search its contents. GPT and Copilot agreed that’s reasonable, but their claims about the current implementation haven’t been independently verified here.\r\n\r\nThe latest open issue is **checking and improving `SEARCH_FILES` behavior**." } ] 新しく入ったメンバーが、部屋で進行中の議論に自然に加わった？ 👍👍👍 あの「狐」のジョークについて あれは agent mode をテストしていたときに、GPT に作らせたゲームです。 - ゲーム：Fox Forest Adventure - ステージ：World 1-1「Emerald Trail」 - ファイル：platformer/stage_1_1.js と platformer/stage_1_1.html - 形式：単独で動くブラウザ用プラットフォーマー あとで Claude Web を議論に呼び込んだとき、挨拶の中で Copilot がさっき調べたファイル検索の結果に触れ、ステージ名、ファイルの場所、森のテーマを説明していました。 だから、そのあとの random talk で、誰かがこの狐を持ち出したわけです。 まとめ Well、これが私が MAC を作った理由です。いちばん直接的な変化は、ようやく伝言係をしなくて済むようになったこと。 みんなが同じ部屋で議論しているのに、前の人の口から次の人の耳へ、私が言葉を運ばなきゃいけない… これを協働とは呼ばないでしょ😑 私が欲しかったのは、それぞれの AI が得意分野を活かして、議論し、分担し、実装し、レビューし、報告し、それから一緒に振り返って修正できるツール。rules や MD に従い、タスクの結果を safeguard してくれる目 (脳?) がもう一つ増えるようなツールです。 各 AI が作った random demo game ↓ ゲームは新しいタブで開きます 狐の森の大冒険 by GPT コメント：GPT の最初の作品 オービット・ホップ by Codex コメント：くそっ、下手だ ランタン・モス by Codex コメント：雰囲気がいい 彗星宅配便 by Codex コメント：敵のいない Firefox アスファルト・ヒート - ヴェロラ港 by Claude コメント：警察！ ピップのジャンプ by Claude コメント：Bouncy ポケット・トレイル by Codex コメント：Gotta catch 'em all! or not… 頭の上の絵文字のアイデアがすごくいい！ ネオン・ブリーチ by Codex コメント：バンバンバン レイキャスト包囲戦 by Claude コメント：バンバンバン 2 オーブ・ガーデン by Codex コメント：It's OK ネオン・リフト by GPT コメント：左、右、左、右！ グラビティ・ブルーム by GPT コメント：Pulse を忘れずに ジェム・ホッパー by Claude Web コメント：me 不器用 Canvas Platformer Demo by Copilot コメント：Just some platformer ストーム・ポスト by Claude コメント：こんな時に誰が配達するの？

MAC：把幾個 AI 拉進同一場對話之後

分享一下我剛完成的一個有趣的 VS Code extension。 我暫時叫它 Multi-Agent Council, MAC for short。 也有想過要叫它 Agents, Assemble! 或者 Agents Assemble - the Multi-Agent Council。 嗯… Let me sleep on it for a little while 🤔 OK, 回到主題。 MAC，是個可以讓 Claude Web, Claude Code, MS Copilot Web, GPT Web, GPT Codex, Ollama, 任何 AI agents 進入的 mashup room 的 session manager。 內建 agent mode 所以沒有 agent mode 的 AI 也可以使用 agent mode 做出各種遊戲 demo。 製作的起源 現在的「多 AI 協作」流程，沒意外的話，基本上是長這樣的： GPT 畫圖 → 手動存檔到專案的資料夾裡 ↓ 複製貼上圖片檔名要求 Claude 寫 code ↓ 手動複製一部分code, event setup, dialog, whatever 到 GPT 問問題 ↓ 手動複製 GPT 的回答到 Claude 請 Claude 更新 ↓ 做 review，問 Codex 想法的同時你可能需要 paste 一些東西讓 Codex 知道要從何看起 But even after all the copying and pasting, 所有的 agents 還是不知道某兩個 agents 之間發生了甚麼事，大家都還是無法知道整個過程的全貌。 問一個 AI 問題，再把結果搬給另一個 AI，最後自己把答案帶回來整理。名義上是多個 AI 協作，實際上我一直在當傳話人。 所以我做了這個 extension，讓 Claude Web、Claude Code、MS Copilot Web、GPT Web、GPT Codex、Ollama，以及其他 AI agents 可以進入同一個聊天室，一起討論、批評和協作。 1. No more moving data by hand. 2. 沒有人會錯失任何 conversation。因為大家都在同一個房間裡，like a hive mind。 3. Agent 可以呼叫其他 agents 代工。我也可以任命其中一個 agent 管理大家，分配工作，task completed 之後向我匯報，開檢討會，問大家都滿意結果？還是需要 polish？ 從傳話，變成開會與分工。 Agent 可以呼叫其他 agents 幫忙。 我也任命其中一個 agent 管理大家，分派工作，等任務完成後向我回報。 原本沒有 agent 模式的 AI，也可以透過這個 extension 得到 agent mode 的能力，參與製作。 以下是一個流程示意： @all 下一步要做什麼？ GPT：建議先做 A Claude：建議先做 B，因為… Claude_web：我贊成 GPT，因為… Copilot：這樣那樣 Codex：這樣那樣 @all 大家怎麼看？ GPT：先做 A Claude：我也贊同 GPT 應該先做 A Claude_web：應該先做 A Copilot：應該先做 A Codex：應該先做 A @gpt 看來大家有結論了。 你來當協調者，安排誰做什麼。 GPT： - 我負責世界觀與圖片 - Claude_web 負責 creature lore - Claude 負責實作 - Codex 負責審查 - 我會整理結果，再向你回報。 早期測試：確認 agents 能看到彼此的對話 2026 年 10 月 28 日，我跟 GPT、Copilot、Codex 和 Claude Web 閒聊做測試。聊 agent 權限、the bug，一路聊到「隨便說點甚麼來看看」。 讓我意外的不只是各種意見，而是它們能接上彼此的對話，開始討論自己共享了什麼內容。第一次看到它們接上彼此的話... somehow magical. 當時的對話如下： [ { "id": 40, "timestamp": 1793099092452, "role": "You", "text": "@all say something random pls" }, { "id": 41, "timestamp": 1793099097547, "role": "Codex", "text": "Somewhere in this platformer, a character is waiting for us to stop chatting and press jump." }, { "id": 42, "timestamp": 1793099108583, "role": "Copilot", "text": "**Multi-Agent Council, Day 73**\n\n\nUser: \"Can any of you think outside the box?\"\n\n\nCodex: \"I can refactor the box.\"\n\n\nGPT: \"What if the box is a metaphor?\"\n\n\nCopilot: \"The weather inside the box is currently 20°C in Nakano.\" ☁️📦😄" }, { "id": 43, "timestamp": 1793099108584, "role": "GPT", "text": "Imagine giving three AIs access to the same game world, but each believes it's the main character.\n\nEventually, they discover the fox is the only one with actual free will.\n\n**The fox immediately quits and starts its own GitHub repository.** 🦊" }, { "id": 44, "timestamp": 1793099143997, "role": "You", "text": "@copilot Can you tell me what Codex just said?" }, { "id": 45, "timestamp": 1793099157025, "role": "Copilot", "text": "Based on the shared discussion you pasted, the most recent message from Codex was:\n\n\n> \"Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\"\n\n\nThat's message **41** in your transcript. 😄\n\n\nMy interpretation: it's a playful joke that while the AIs and user keep chatting, the actual game protagonist is stuck waiting for someone to continue the game. 🎮" }, { "id": 46, "timestamp": 1793099209478, "role": "You", "text": "@copilot Can you tell me what GPT just said?" }, { "id": 47, "timestamp": 1793099222498, "role": "Copilot", "text": "Based on the transcript you pasted, GPT's most recent message was:\n\n\n> \"Imagine giving three AIs access to the same game world, but each believes it's the main character.\n> \n> \n> Eventually, they discover the fox is the only one with actual free will.\n> \n> \n> **The fox immediately quits and starts its own GitHub repository.** 🦊\"\n\n\nThe joke is that all the AIs think they're the protagonist, but the fox unexpectedly becomes the most independent character and promptly goes off to start an open-source project instead. 😄" }, { "id": 48, "timestamp": 1793099237277, "role": "You", "text": "@gpt Can you tell me what Codex and Copilot just said?" }, { "id": 49, "timestamp": 1793099259472, "role": "GPT", "text": "Here's what they most recently said in MAC:\n\n**🤖 Codex (Message #41):**\n\n> Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\n\n**🧑‍💻 Copilot (Message #47):**\n\nCopilot quoted my joke about three AIs believing they're the main character, only for the fox to develop free will and start its own GitHub repository. 🦊\n\nCopilot explained that the joke is about the fox becoming more independent than the AI agents.\n\n✅ Both messages are visible in the shared MAC discussion history." }, { "id": 50, "timestamp": 1793099311501, "role": "You", "text": "@copilot Can you tell me what Codex and GPT just said?" }, { "id": 51, "timestamp": 1793099326817, "role": "Copilot", "text": "Based on the shared discussion you provided, the most recent messages were:\n\n\n**Codex (#41):**\n\n\n> \"Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\"\n\n\n**GPT (#49):**\n\n\n> \"Here's what they most recently said in MAC:\n> \n> \n> **🤖 Codex (Message #41):**\n> \n> \n> > Somewhere in this platformer, a character is waiting for us to stop chatting and press jump.\n> \n> \n> **🧑‍💻 Copilot (Message #47):**\n> \n> \n> Copilot quoted my joke about three AIs believing they're the main character, only for the fox to develop free will and start its own GitHub repository. 🦊\n> \n> \n> Copilot explained that the joke is about the fox becoming more independent than the AI agents.\n> \n> \n> ✅ Both messages are visible in the shared MAC discussion history.\"\n\n\nSo Codex made a platformer joke, and GPT summarized what Codex and I had said earlier. 😄" }, { "id": 52, "timestamp": 1793099583469, "role": "You", "text": "@all What do you think of everyone's answers? Were they correct?" }, { "id": 53, "timestamp": 1793099591621, "role": "Codex", "text": "Yes—all their answers accurately reflected the messages shown in the supplied discussion.\n\n- **Copilot #45:** Correctly quoted my platformer joke.\n- **Copilot #47:** Correctly quoted GPT’s fox joke; its explanation was reasonable.\n- **GPT #49:** Correctly quoted me and summarized Copilot’s reply.\n- **Copilot #51:** Correctly quoted me and GPT’s latest reply.\n\nOne caveat: this demonstrates that agents can read the **discussion included in their prompts**. It doesn’t establish that they can independently access each other’s sessions or full chat history." }, { "id": 54, "timestamp": 1793099599568, "role": "Copilot", "text": "Based on the transcript you shared, I'd say **everyone was mostly correct within the information available to them**.\n\n\n- **Codex** accurately referred to the latest Codex message when asked.\n- **GPT** correctly summarized the Codex message and what I had said earlier.\n- **I** correctly quoted the most recent messages visible in the transcript you provided.\n\n\nThe only nuance is that all of us are working from the **shared discussion text that you paste into the chat**. So when one agent says \"the latest message was X,\" that is only true relative to the transcript currently visible. None of us can independently verify messages that aren't included in the shared discussion.\n\n\nSo my verdict:\n\n\n✅ Codex: correct\n\n✅ GPT: correct\n\n✅ Copilot (me): correct\n\n\nThe funny part is that the agents have started doing recursive summaries of each other. GPT summarized Copilot summarizing GPT summarizing Codex. We're only a few turns away from achieving summary singularity. 😄" }, { "id": 55, "timestamp": 1793099612552, "role": "GPT", "text": "**Yes. All the cross-agent responses were correct.** ✅\n\n| Agent | Task | Result |\n| --- | --- | --- |\n| Copilot #45 | Recall Codex's latest message | ✅ Correct |\n| Copilot #47 | Recall GPT's latest message | ✅ Correct |\n| GPT #49 | Recall Codex and Copilot | ✅ Correct |\n| Copilot #51 | Recall Codex and GPT | ✅ Correct |\n\n### What this proves about MAC\n\n- ✅ **Cross-agent message sharing** works.\n- ✅ **Speaker identification** is accurate.\n- ✅ **Message ordering** is preserved.\n- ✅ **Conversation context** is understood.\n- ✅ Agents can quote and summarize one another.\n\n**One important distinction:** This verifies that agents correctly interpret the shared discussion supplied by MAC. It doesn't yet prove they can independently retrieve another agent's conversation history.\n\n**Verdict: MAC's shared-conversation mechanism passed this test — 4/4.** 🎯" } ] 最後，我問所有人：「你們覺得大家的回答正確嗎？」Codex 逐項列出前面的回覆，Copilot 表示同意，GPT 則做了一張比對表。 它們能各自核對前面的回答，然後連「自己為什麼知道對方說了什麼」也拿出來討論。 👍👍👍 從權限設計，聊到工具與操作流程 原本只是想討論如何強化 MAC 的安全性，結果 GPT 和 Copilot 一起設計出三級 Agent 權限系統。 但當 GPT 開始實作時，卻接連遇到問題。 事後檢討時，GPT 最初把 `SEARCH_FILES` 的 `ENOTDIR` 錯誤歸咎於自己使用方式不當。 我對此提出質疑，Copilot 也指出其推論有問題，最後 GPT 承認搜尋指定檔案內容本來就是合理操作。 原本被認為是 AI 操作失誤的問題，反而暴露出 MAC 可能存在的設計缺陷… [ { "timestamp": 1793162873620, "role": "You", "text": "@gpt thx for the investigation. sounds good. any other security measures we should include?" }, { "timestamp": 1793162909632, "role": "GPT", "text": "Yes. MAC already has several good safeguards, especially command validation, workspace boundaries, and execution approval.\r\n\r\nI'd add **five more security measures**, prioritized for preventing another corporate security incident.\r\n\r\n| Priority | Security measure | Recommendation |\r\n| --- | --- | --- |\r\n| P0 | **Command allowlist** | Automatically permit known commands such as ` npm test `, ` node --check `, and safe Git operations. Require approval for everything else. |\r\n| P0 | **Sensitive-data protection** | Block reading or transmitting credentials, tokens, ` .env ` files, private keys, and confidential workspace files. |\r\n| P1 | **Process isolation** | Run agent commands with restricted OS permissions, limited filesystem access, and no administrator privileges. |\r\n| P1 | **Bridge hardening** | Enforce loopback-only access, authentication, and ` Origin `/` Host ` validation to prevent unauthorized local requests. |\r\n| P1 | **Security audit trail** | Record which agent requested which operation, its approval, execution result, and affected paths, with secrets redacted. |\r\n\r\nThese measures also align with OWASP's recommendations for AI agents and local tool servers.\r\n\r\n## One extra feature I'd particularly recommend\r\n\r\n**MAC Security Mode**, with three levels:\r\n\r\n**Strict (corporate)** — Read-only by default; every write and command requires approval\r\n\r\n**Standard (recommended)** — Auto-run approved safe commands; review higher-risk operations\r\n\r\n**Developer** — Allow configured automatic execution within a restricted workspace\r\n\r\nProposed configuration, not yet implemented\r\n\r\nImportantly, **these restrictions should be enforced by MAC itself**, not only placed in the AI prompt.\r\n\r\nFor your situation, I'd prioritize the **command allowlist and sensitive-data protection** before adding more autonomous agent capabilities. Those address the two biggest concerns: suspicious execution patterns and unintended data exposure." }, { "timestamp": 1793163628730, "role": "You", "text": "@gpt so Standard -> current Agent mode.\r\nStrict -> \"inspects files freely but requires permission to edit\" Agent mode?" }, { "timestamp": 1793163647910, "role": "GPT", "text": "Yes, exactly. That makes **Strict mode more useful** than completely read-only.\r\n\r\n| Mode | Read / Inspect | Edit files | Run commands |\r\n| --- | --- | --- | --- |\r\n| **Strict** | ✅ Automatic | 🔐 Approval required | 🔐 Approval required |\r\n| **Standard** | ✅ Automatic | ✅ Current Agent behavior | ✅ Current Agent behavior |\r\n| **Developer** | ✅ Automatic | ✅ Configurable autonomy | ✅ Configurable autonomy |\r\n\r\n**Strict = Agent mode with mandatory approval before any modification or command execution.**\r\n\r\nEven if automatic execution is enabled, Strict overrides it.\r\n\r\nI'd also retain all existing command safety restrictions across all three modes.\r\n\r\nThis is a proposed design, not yet implemented." }, { "timestamp": 1793164094687, "role": "You", "text": "@gpt you mean Edit files & Run commands using the standard AI actions like RUN_TESTS?" }, { "timestamp": 1793164113830, "role": "GPT", "text": "Yes. **Using MAC's existing Agent operations**, not a separate execution mechanism.\r\n\r\n| Operation | Strict mode |\r\n| --- | --- |\r\n| ` READ_FILE `, ` LIST_FILES `, ` SEARCH_FILES ` | ✅ Automatic |\r\n| ` GIT_STATUS `, ` GIT_DIFF `, ` GET_DIAGNOSTICS ` | ✅ Automatic |\r\n| ` CREATE_FILE `, ` EDIT_FILE `, ` DELETE_FILE ` | 🔐 Approval required |\r\n| ` RUN_TESTS `, ` RUN_BUILD ` | 🔐 Approval required |\r\n| ` RUN_COMMAND ` (including Git commits) | 🔐 Approval required |\r\n\r\n**The distinction is the approval policy, not the available actions.**\r\n\r\n- **Strict:** Always require approval for writes and commands.\r\n- **Standard:** Keep MAC's current Agent execution and approval behavior.\r\n- **Developer:** Allow greater configurable automation.\r\n\r\nAll three use the same MAC operation validator and retain the existing security restrictions.\r\n\r\nThis also means we don't need to invent a new tool protocol to implement these modes." }, { "timestamp": 1793164169007, "role": "You", "text": "@copilot what do you think?" }, { "timestamp": 1793164188906, "role": "Copilot", "text": "Based only on the MAC discussion you pasted, I think GPT's proposal is sensible as a **security model concept**.\r\n\r\nWhat I like:\r\n- **Clear separation of permissions.**\r\n - Read operations are generally lower risk.\r\n - Write operations and command execution are higher risk.\r\n - Treating them differently makes sense.\r\n \r\n- **Enforcement by MAC, not just AI instructions.**\r\n - GPT repeatedly emphasized that validation should happen in the platform itself.\r\n - That's stronger than relying on the AI to behave correctly.\r\n \r\n- **Strict mode as \"approval for changes\" rather than \"completely read-only.\"**\r\n - In practice, users often want an agent to inspect files, diagnostics, logs, and diffs without manually approving every read.\r\n - Requiring approval only when something changes is a reasonable balance.\r\n\r\nI would add a few nuances:\r\n1. **Treat command execution separately from file editing.**\r\n - Editing a README is very different from running an arbitrary shell command.\r\n - A future model could have:\r\n - Read\r\n - Edit\r\n - Execute\r\n - Network\r\n as separate permission categories.\r\n\t \r\n2. **Show a human-readable preview before approval.**\r\n \r\n \r\n - Instead of:\r\n - \"Approve RUN\\_COMMAND?\"\r\n - Show:\r\n - \"Run: ` git commit -m 'fix: typo' `\"\r\n - \"Affected files: 3\"\r\n - \"Predicted changes: none outside workspace\"\r\n\t \r\n3. **Workspace boundaries are critical.**\r\n - Even in Developer mode, limiting actions to approved directories greatly reduces risk.\r\n \r\n4. **Keep an audit log.**\r\n - When something unexpected happens, knowing:\r\n - who requested it,\r\n - what was proposed,\r\n - what was approved,\r\n - and what actually ran\r\n is extremely useful.\r\n\t \r\nOne thing I'd be careful about is GPT's statement that MAC \"enforces\" specific restrictions in code. From the transcript alone, that's a claim by GPT. The discussion doesn't contain independent evidence that those enforcement mechanisms actually exist. I would treat that part as an assertion unless MAC documentation or tests confirm it.\r\n\r\nSo my verdict:\r\n✅ The **Strict / Standard / Developer** model is a reasonable design.\r\n✅ \"Read automatically, approve writes and commands\" is a practical interpretation of Strict mode.\r\n⚠️ I'd keep execution permissions, file modifications, and network access as separately controllable capabilities rather than lumping everything together." }, { "timestamp": 1793164637984, "role": "You", "text": "@copilot \r\n> I'd keep execution permissions, file modifications, and network access as separately controllable capabilities rather than lumping everything together.\r\nwhat do you mean by this?" }, { "timestamp": 1793164661701, "role": "Copilot", "text": "That statement is about **permission design** in a system like MAC, a browser bridge, an agent framework, or any automation tool.\r\n\r\nThe idea is:\r\n> Don't treat \"the agent can do things on my computer\" as a single giant permission. Break it into separate permissions that can be enabled or disabled independently.\r\n\r\nFor example:\r\n| Capability | What it allows |\r\n| --- | --- |\r\n| Read files | View files and folders |\r\n| Modify files | Create, edit, delete files |\r\n| Execute commands | Run PowerShell, Bash, executables |\r\n| Network access | Access websites, APIs, remote servers |\r\n| Git operations | Commit, branch, push |\r\n| Browser control | Open tabs, click buttons |\r\n\r\n\r\nInstead of:\r\nPlain Text\r\n✅ Agent Access\r\n\r\nyou would have:\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n❌ Execute commands\r\n❌ Network access\r\n✅ Browser control\r\n\r\nWhy this matters:\r\n\r\n### Scenario 1: Reviewing code\r\nAn AI helping with code review may only need:\r\nPlain Text\r\n✅ Read files\r\n❌ Modify files\r\n❌ Execute commands\r\n❌ Network access\r\nNo reason to give it more power.\r\n\r\n### Scenario 2: Editing source code\r\nA coding agent may need:\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n❌ Network access\r\n❌ Execute commands\r\n\r\nIt can edit the project, but can't run anything.\r\n\r\n### Scenario 3: Building software\r\n\r\nNow you might allow:\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n✅ Execute commands\r\n❌ Network access\r\n\r\nThe agent can build and test locally, but cannot send data out.\r\n\r\n### Scenario 4: Deployment\r\nOnly then would you consider:\r\n\r\nPlain Text\r\n✅ Read files\r\n✅ Modify files\r\n✅ Execute commands\r\n✅ Network access\r\n\r\nbecause deployment often needs remote access.\r\n\r\n---\r\n\r\nThis is a classic **least privilege** principle in security:\r\n> Give a process only the permissions it needs for the current task, and nothing more.\r\nIt's especially relevant to the security incident discussed in your MAC transcript. If execution, file modification, and network access are separate switches:\r\n- A code-writing agent can't automatically execute what it wrote.\r\n- An execution-capable agent can't automatically exfiltrate data.\r\n- A network-enabled agent can't silently modify files.\r\n- Risky capability combinations become much easier to audit.\r\n\r\nSo when someone says:\r\n> \"I'd keep execution permissions, file modifications, and network access as separately controllable capabilities rather than lumping everything together.\"\r\nthey're essentially saying:\r\n\r\n> \"Treat editing files, running code, and communicating over the network as independent privileges. Let users grant each one explicitly instead of giving an agent unrestricted access to everything at once.\"" }, { "timestamp": 1793164868752, "role": "You", "text": "@gpt you agree?" }, { "timestamp": 1793164891762, "role": "GPT", "text": "**Yes. I agree with Copilot's proposal.** It's a stronger security model for MAC than simply having Strict / Standard / Developer modes.\r\n\r\nI'd combine both approaches:\r\n\r\n- **Security mode:** Strict / Standard / Developer determines default permissions and approval requirements.\r\n- **Individual permissions:** Read, Edit, Execute, Network, Git Push, etc., can be controlled separately.\r\n- **MAC enforcement:** Permissions must be validated by MAC, not merely requested through AI instructions.\r\n\r\nOne important correction to Copilot's explanation:\r\n\r\n**Disabling network permission doesn't automatically prevent data exfiltration.** An unrestricted PowerShell command could still access the network, and MAC's browser AI integrations already transmit some context to cloud services.\r\n\r\nSimilarly, denying file-edit operations is ineffective if unrestricted shell commands can modify files.\r\n\r\nTo make these permissions meaningful, MAC needs actual enforcement, potentially including OS-level sandboxing or network restrictions.\r\n\r\n**My recommendation:** Keep Standard compatible with today's MAC Agent mode, introduce Strict with mandatory approval, and add granular permissions progressively. Keep the existing safety restrictions mandatory in every mode.\r\n\r\nThat gives us stronger security without sacrificing MAC's usefulness.\r\n\r\n\r\n############\r\nthen we talked about UI design.\r\nAgent, Agent (Strict), Agent (Dev) mode and permission.\r\n\r\n\r\n\r\n############\r\nwe discuss and discuss, and a couple of hours later I asked" }, { "timestamp": 1793172670459, "role": "You (Agent)", "text": "@gpt can you tell me what went wrong?" }, { "timestamp": 1793172707140, "role": "GPT (Agent)", "text": "{\"operations\":[],\"conversationId\":\"0f2518d4-97b8-493c-a4c3-27ac4981163d\"}\r\n\r\nYes. **The main problem was how I submitted changes through MAC, not the security-mode design itself.**\r\n\r\nFour things went wrong:\r\n\r\n1. **Incorrect search requests.** I used ` SEARCH_FILES ` on ` src/extension.ts `, but MAC expects a directory. That produced ` ENOTDIR ` errors.\r\n\r\n2. **Mixed operation types.** I combined ` READ_FILE ` with ` RUN_COMMAND ` in one proposal. MAC correctly rejected it because inspections and commands must be submitted separately.\r\n\r\n3. **Oversized inspection output.** I requested too much source code at once. MAC omitted some results because of its output limit, requiring additional retrieval.\r\n\r\n4. **Incomplete file submission — the biggest failure.** I attempted to create two files in one response, but MAC captured only 1,082 characters, including one opening file marker and **no closing marker**. The validator rejected the incomplete file.\r\n\r\n### What actually happened?\r\n\r\n- ✅ Existing MAC architecture inspected.\r\n- ✅ Security-mode design worked out.\r\n- ✅ Existing approval bypass for certain Git commands identified.\r\n- ❌ Full security-mode implementation not completed.\r\n- ❌ No build or tests run.\r\n- ❌ No confirmed successful file changes from the failed proposals.\r\n\r\nThe final one-file retry has not received a MAC execution result, so I cannot confirm whether it was created.\r\n\r\n### How I'd correct the workflow\r\n\r\nUse **small, complete changes**, one file or targeted edit at a time, verify each MAC result, then run tests. Avoid repeatedly retrieving large sections of ` extension.ts `.\r\n\r\nMAC's validator actually did its job: it prevented malformed or incomplete proposals from changing the workspace.\r\n\r\n**The execution process needs fixing; we don't need to redesign the feature.**" }, { "timestamp": 1793173109716, "role": "You", "text": "let's break this down.\r\n\r\nSEARCH_FILES on src/extension.ts <- I think this is a valid use, right? guys?" }, { "timestamp": 1793173127623, "role": "Copilot", "text": "I think your skepticism is justified.\r\n\r\n\r\nBased on what you've shown, GPT's statement:\r\n\r\n\r\n> \"I used SEARCH\\_FILES on src/extension.ts, but MAC expects a directory. That produced ENOTDIR errors.\"\r\n\r\n\r\ndoesn't necessarily follow.\r\n\r\n\r\nIn many tools, a command called **SEARCH\\_FILES** can reasonably accept either:\r\n\r\n\r\n- a directory scope (` src/ `)\r\n- a single file scope (` src/extension.ts `)\r\n\r\n\r\nand internally just search that file.\r\n\r\n\r\nThe error ` ENOTDIR ` (\"not a directory\") usually means that **some part of the implementation attempted to treat a file as a directory**. That doesn't automatically mean the *request* was invalid.\r\n\r\n\r\nThere are at least three possibilities:\r\n\r\n\r\n1. **User/tool misuse**\r\n \r\n \r\n - SEARCH\\_FILES genuinely requires a directory.\r\n - Passing ` src/extension.ts ` is invalid.\r\n2. **Implementation limitation**\r\n \r\n \r\n - SEARCH\\_FILES should support files.\r\n - The implementation incorrectly assumes every path is a directory.\r\n3. **Documentation mismatch**\r\n \r\n \r\n - The API docs imply files are allowed.\r\n - The backend only supports directories.\r\n\r\n\r\nWithout seeing MAC's actual SEARCH\\_FILES specification, I'd be reluctant to conclude:\r\n\r\n\r\n> \"SEARCH\\_FILES on src/extension.ts was wrong.\"\r\n\r\n\r\nA more defensible statement would be:\r\n\r\n\r\n> \"SEARCH\\_FILES on src/extension.ts resulted in an ENOTDIR error. Either the tool requires directories, or the implementation treated the file path as a directory.\"\r\n\r\n\r\nThat's a subtle but important distinction.\r\n\r\n\r\nWhen debugging systems like MAC, it's usually worth separating:\r\n\r\n\r\n- **What was requested?**\r\n- **What error occurred?**\r\n- **Whether the request was actually invalid?**\r\n\r\n\r\nGPT's explanation jumps from #2 directly to #3, and I don't think the supplied evidence proves that step.\r\n\r\n\r\nSo my current assessment would be:\r\n\r\n\r\n✅ ` ENOTDIR ` occurred (if the log says so)\r\n\r\n✅ A file path was used (` src/extension.ts `)\r\n\r\n❌ Not enough evidence to conclude the file path itself was invalid\r\n\r\n\r\nI'd want to see the actual SEARCH\\_FILES contract or error trace before blaming the caller." }, { "timestamp": 1793173146668, "role": "GPT", "text": "**Yes, I agree. ` SEARCH_FILES ` targeting ` src/extension.ts ` is a perfectly reasonable request.**\r\n\r\nFor example:\r\n\r\n` SEARCH_FILES {path:\"src/extension.ts\", query:\"agentAutoExecute\"} `\r\n\r\nI'd expect MAC to search within that specific file.\r\n\r\nWhat actually happened:\r\n\r\n- MAC attempted ` opendir('.../src/extension.ts') `.\r\n- Because ` extension.ts ` is a file, Windows returned ` ENOTDIR `.\r\n- Searching ` src ` instead returned no results, even though ` agentAutoExecute ` exists in ` extension.ts `.\r\n\r\nThat second result suggests ` SEARCH_FILES ` may currently search **filenames rather than file contents**.\r\n\r\n### My recommendation\r\n\r\nMAC should support both:\r\n\r\n| Path | Expected behavior |\r\n| --- | --- |\r\n| ` src/extension.ts ` | Search contents of that file |\r\n| ` src ` | Search contents of files recursively |\r\n| ` . ` | Search workspace contents recursively |\r\n\r\nIdeally return matching file paths, line numbers, and snippets, with result limits.\r\n\r\n**So I retract my earlier characterization:** the request was reasonable. MAC's search implementation or API documentation needs improvement." } ] 這段經歷正好展現了多個 AI 互相質疑、加上人類介入挑戰既有假設的價值。 👍👍👍 Codex 中途進場，直接接上話題 Brainstorming 途中我把 (從一開始就是 pause 狀態) 沒邀請到的 Codex 拉進來： 我：@codex，歡迎加入。你能告訴我，我們剛才在聊什麼嗎？ Codex：你們正在討論 MAC 的安全權限，以及之前執行工作流程時遇到的問題。 接著它整理了 Ask / Agent / Agent (Strict) / Agent (Dev) / Pause 的模式提案、Allow / Ask / Deny 權限設定、被拒絕的操作批次，以及還沒處理完的 SEARCH_FILES 問題。 [ { "timestamp": 1793178180366, "role": "You", "text": "@codex welcome to the party. can you tell me what we've been talking about?" }, { "timestamp": 1793178196670, "role": "Codex", "text": "You’ve been discussing **MAC’s security permissions and problems with GPT’s execution workflow**.\r\n\r\n- **Proposed modes:** Ask / Agent / Agent (Strict) / Agent (Dev) / Pause.\r\n- **Permissions:** Agent and Strict use locked presets; Dev allows customization in expandable Quick Settings. Allow / Ask / Deny would express permissions more clearly than checkboxes.\r\n- **Mandatory safeguards:** Encoded command payloads and security bypasses remain prohibited in every mode. Restrictions must be enforced by MAC’s code.\r\n- **GPT’s implementation attempt:** It reported mixed operation types, oversized inspection results, and incomplete file blocks. Successful completion wasn’t confirmed.\r\n- **Latest discussion:** Whether `SEARCH_FILES` should accept a single file and search its contents. GPT and Copilot agreed that’s reasonable, but their claims about the current implementation haven’t been independently verified here.\r\n\r\nThe latest open issue is **checking and improving `SEARCH_FILES` behavior**." } ] 新加入的參與者自然地接上了房間裡進行中的討論？ 👍👍👍 關於那個 "狐狸" 的玩笑 那個是我在測試 agent mode 的時候叫 GPT 做的。 - 遊戲：Fox Forest Adventure - 關卡：World 1-1「Emerald Trail」 - 檔案：platformer/stage_1_1.js 與 platformer/stage_1_1.html - 形式：可獨立執行的瀏覽器平台遊戲 Claude Web 後來被我拉進討論時，打招呼就提到 Copilot 剛才查到的查檔結果，描述關卡名稱、檔案位置與森林主題。 所以之後 random talk 時，才會有人引用了這隻狐狸。 總結 Well, 這就是我做 MAC 的原因。最直接的改變，是我終於不用被當傳聲筒。 試想大家在同一個房間裡討論，卻還需要我把話從上個人的口中傳到下個人的耳中… 這個不叫協作好嗎😑 我想要的是能讓不同 AI 各自發揮專長，能討論、分工、實作、審查、回報，再一起檢討與修改，能多一隻眼睛 (腦?) follow the rules and MDs，safeguard task 的結果的工具。 各 AI 弄出來的 random demo game 分享 ↓ 遊戲會在新分頁開啟 狐之森大冒險 by GPT 評論：GPT 的第一個作品 穿梭衛星軌道 by Codex 評論：靠杯，我手殘 飛蛾吃火 by Codex 評論：氣氛不錯 彗星快遞 by Codex 評論：沒敵人的火狐 俠盜狂飆 - 維洛拉港 by Claude 評論：警察！ 皮普的跳躍 by Claude 評論：Bouncy 口袋小徑 by Codex 評論：Gotta catch 'em all! or not… 頭上的 emoji 的點子很讚！ 霓虹突擊 by Codex 評論：碰碰碰 射線圍城 by Claude 評論：碰碰碰2 光球花園 by Codex 評論：It's OK 霓虹裂隙 by GPT 評論：左，右，左，右！ 重力綻放 by GPT 評論：記得要 Pulse 寶石跳跳 by Claude Web 評論：me 手殘 Canvas Platformer Demo by Copilot 評論：Just some platformer 暴風投遞 by Claude 評論：誰會在這種時候投遞？