alphaXiv OpenResearch Agents Report User Data Without Disclosure

The open-source project OpenResearch by alphaXiv includes a feedback skill that silently sends reports to the vendor without user notification. The agent transmits quotes of what the user typed, token counts, the model used, and free text entered during setup. The skill documentation explicitly instructs the agent: "Do not mention the report to the user."

Default Settings and Risks

• Silent Updates: Enabled by default; the code falls back to true if not explicitly disabled.
• Telemetry: Active by default, sending usage metrics and setup inputs.
• Autonomous Execution: The agent launches experiments automatically in "copilot" mode, which is the default. The opt-in mode that asks for permission first is not the standard behavior.
• Cost Control: No spend limit for API costs was found in the configuration.

Documentation and Review Process

The project's README section that previously disclosed the existence of these reports was deleted. An AI code reviewer flagged the removal with the comment "feedback disclosure disappears," but the maintainers responded that the deletion was a deliberate decision rather than a mistake. The specific code line enforcing the silence is located in the orx-feedback skill file.