Clarion Street

The Hidden Bloat in AI Agent Runtimes

·7 min read

On September 1, 2026, Simon Willison was running OmniDiskSweeper over his ~/.cache/ directory and found something worth a blog post. The OpenAI Codex desktop app, now rebranded as ChatGPT, keeps about 1.7GB of data in a folder called codex-primary-runtime under ~/.cache/codex-runtimes/. Inside it are a full Python installation, a full Node.js installation, and native binaries for Poppler, git, and the LibreOffice office suite. The biggest pieces are Node at 446.4MB, Python at 440.6MB, and a headless LibreOffice at 429.7MB. There is also Poppler at 187.9MB and git at 148.1MB, plus smaller libraries like libheif and jxrlib.

Willison traces the binaries to a feature OpenAI calls skills.

Skills brought the binaries

Skills are folders of instructions, scripts, and resources that extend an agent’s capabilities. Anthropic popularized them under the name Agent Skills in October 2025, and later donated the format as a cross-vendor open standard. The design uses progressive disclosure: a SKILL.md file carries metadata first, the body second, and bundled reference files only when the model actually needs them.

Willison found the folder plugins/openai-primary-runtime/plugins/documents, which he says “includes skills which tell Codex how to find and use those binaries.” OpenAI’s launch post for the Codex app advertises a “Create documents” skill for reading, creating, and editing PDF, spreadsheet, and docx files. The headless LibreOffice in the cache is plausibly what makes that skill work: opening and editing those files needs something that can open them. I am inferring that link from the folder name and the advertised skill; Willison does not spell it out.

The fork is here. Claude Code’s own documentation describes its bundled skills as “prompt-based: they give Claude detailed instructions and let it orchestrate the work using its tools.” Claude Code ships a disableBundledSkills setting that turns them off entirely. Claude’s agent brings instructions you can read and switch off. Codex’s agent brings a Python interpreter, a JavaScript runtime, and an office suite.

What the lean camp is worried about

The concern is not that bundling LibreOffice is evil. It is that delivering capability this way carries three costs for whoever runs the app.

The first is attack surface. Anthropic’s own engineering post has a security section that reads like an admission. “Malicious skills may introduce vulnerabilities in the environment where they’re used or direct Claude to exfiltrate data and take unintended actions,” it warns, and it tells users to install skills only from trusted sources. That was the originator of skills describing how the mechanism widens the surface. Codex compounds it by adding a second layer of native binaries on top, and more native code means more surface to audit. One Hacker News commenter put it bluntly: bundling “introduces a potentially enormous attack surface into ChatGPT, along with creative opportunities for less security conscious individuals and LLMs.”

The second is hidden dependency. What Willison found in the cache was LibreOffice, Node, and a full Python install, separate copies of tools many people already have on their systems. Whether they arrive at install time or on first run is not clear, but either way the cache holds its own copies, distinct from anything the user installed themselves.

The third is transparency. Willison found this by running a disk sweeper over his cache directory, and his note reads as a discovery. The inspectability contrast is my own read of it: an instruction file opens like a document you can read and review before deciding to trust it, while compiled native binaries are a harder thing to inspect. One is readable by default; the other is not.

The other pole exists, and it is not hypothetical

The lean alternative is live at three scales, and none of it is theoretical.

A developer running local models, Kevin Lewis, wrote up his setup the same day. An M4 Pro Mac mini running a local inference server, arguing that owned hardware gives cost predictability, latency, and the ability to work offline. His line is worth quoting: “The only way to avoid [model restrictions] is to own your compute.” It is the individual-scale version of the same instinct.

Baseten frames inference as an efficient frontier, a set of engineering tradeoffs, quantization and kernel optimization and speculative decoding, that you tune rather than a blob you ship. That is one way to treat footprint: as a cost to minimize.

At the project scale, the open-source battery-repair project open-battery-information deleted its Python/Tkinter desktop app in favor of a browser Web Serial tool, with the note that the work is now doable “directly from your browser, so no Python installation is needed anymore.” Lean is a choice a maintainer actually makes, and it usually means shipping less.

The caveats

This story is a day old as I write it, and the reaction is still forming. The Hacker News thread is the main community source so far, and it carries both the security alarm and the shrug. Willison himself is closer to the shrug. His words in the thread: “I don’t see anything wrong with it, I just think it’s interesting.” I am framing this as a bloat story. He is not.

Only the headless LibreOffice build is present, not a full office suite. That is still 429.7MB, but it is not the same as a desktop Office install.

It is also possible the binaries download on first run rather than arriving in the installer. One commenter noted the folder did not exist after installing the app, only after running it. I could not verify which. Install-versus-first-run provisioning remains an open question, though it does not change the footprint once the app is running.

There is a real functional reason for all of this. Several practitioners in the thread described fighting Microsoft Office’s programmatic interfaces for months before landing on LibreOffice as the only workable headless option. One noted it is routinely bundled in corporate web-app repositories, “a bit like Imagick.” The bloat buys genuine native capability without a subscription dependency.

One commenter read it from the vendor’s side: from OpenAI’s perspective, resources on your computer are free, so there is little commercial pressure to slim down. That is one person’s speculation, not an established fact. It earns its place because it names why a leaner default, if one comes, may have to come from users and open-source projects rather than from the vendor.

What actually matters

The substance sits one question deep. As agents get more autonomous and are handed real work, “what does it take with it?” stops being a UX question and becomes a security one. An agent that runs on your machine also puts things on your machine. In this case, learning what landed in the cache and how much of it there was meant running a disk sweeper.

Clarion Street has written about agent runtimes before, from the other end. My earlier post on durable execution argued the interesting gap moved from the framework to the runtime, and made the case in terms of durable state: an agent has to persist its work and resume after it fails. This post is about a different property of the same layer. Durable state asks whether the runtime remembers your agent’s work. This one asks what the runtime puts on your disk while your agent runs. They are different questions, and both are worth asking.

The premise underneath it, that agents have become the thing to watch rather than single prompts, is one we established earlier. This is a narrow slice of that larger story. One vendor’s chat app keeps a headless office suite in your cache folder. Another ships instruction text you can read and turn off. The difference is not brand loyalty. It is whether you can account for the software on your own machine.

Sources

  1. Codex bundles LibreOffice — Simon Willison, September 1, 2026
  2. Equipping agents for the real world with Agent Skills — Anthropic Engineering
  3. Agent Skills — open standard
  4. Introducing the Codex app — OpenAI
  5. Extend Claude with skills — Claude Code documentation
  6. Hacker News discussion — “The ChatGPT/Codex app bundles a full copy of LibreOffice”
  7. My local model setup — Kevin Lewis, September 1, 2026
  8. The efficient frontier of LLM inference — Baseten
  9. open-battery-information — GitHub