When users bring their own AI, their plan is your budget
Scenri draws pictures through the user's own Codex subscription. One image was costing 5 to 9% of their five-hour window, mostly because the agent pasted the finished picture back into its own context.
In this story6 sections
On the morning of 26 September the release QA drew eight pictures through Scenri with Codex. Each one moved the five-hour Codex window by 5 to 9%. At the high end, eleven pictures would use up the whole window. In real use that window is not mine. It is the user's.
Bring your own AI changes who pays
Scenri has no account and no server bill. When you generate a picture with Codex, Scenri runs the Codex command line on your computer, signed in with your own plan. That is a good deal for the user: no second subscription, no markup. But it moves the cost of every design decision I make onto their quota, where I cannot see it unless I go and measure it.
A normal product team watches its own cloud invoice. Here there is no invoice. A wasteful prompt does not show up as my cost. It shows up as a user who hit their limit at lunchtime and does not know why.
The agent was reading its own picture back
The measurement was simple: run one brief, then read the token totals from Codex's own record of the run. The window percentage is too coarse for this. It moves in whole percents, and anything else using the same plan draws on it at the same time. Token counts are exact.
The eight morning runs used between 135,000 and 207,000 input tokens each. In 6 of the 8, the agent had done something I never asked for: after making the image, it printed the result, and the picture came back into its own context as base64 text. That alone was 25,000 to 29,000 tokens per run, spent on reading a picture it had just drawn, as text.
The fix was one line in the image prompt: do not print the image tool's result. With that line and a move to a different Codex model, a run with two reference pictures cost about 1% of the window.
- Of the 5-hour window per image, before
- 5-9%
- For a two-reference image, after
- about 1%
- Runs that pasted the picture back
- 6 of 8
There is a floor I cannot remove. Every run carries about 53,000 input tokens of Codex's own instructions, skill list and tool definitions, over four model calls, mostly cached. That is the price of using Codex at all, and the only way under it would be to stop using Codex.
Every tool on the machine is in reach
The same test raised a second question. Codex picks up the user's own configuration, including any MCP servers they have installed for their own work. On a developer's machine that can include tools that drive the browser or the whole computer.
Scenri's agent reads text that sits inside pictures: product labels, packaging, screenshots a user uploads. I do not want an agent that reads untrusted text to have a computer-control tool within reach. So each run now switches the user's MCP servers off, and later their Codex plugins too, for that run only. Their own setup is untouched outside Scenri.
I measured this as well. It did not change the token count in any way I could see, 53,200 against 52,700. It stayed in for security, not cost. I think that is worth saying plainly, because it would have been easy to claim it as a saving.
Every leftover file is their privacy
Codex is built to remember. By default it keeps a transcript of each session, and with an image run that transcript holds the pictures as base64. It also keeps its own copy of every image it generates. Scenri had already collected the picture into the user's library, so those were second copies, outside Scenri, that the user never asked for and would not know to delete.
The follow-up in PR #262 closed both:
- Codex runs with
--ephemeral, so it writes no session transcript. - Once Scenri has the picture, it removes Codex's own copy. Only a byte-identical file from the last 30 minutes goes, and a run folder only once it is empty, so pictures from the user's other Codex work stay.
Checked against real Codex: one picture made, session files 40 before and 40 after, generated images 1,283 before and 1,283 after, under 1% of the window.
Even a status check costs something
One smaller find from the same day's security review: the button that checks whether Codex is signed in could be forced to make a real call, which spends a turn of the user's plan. A page on another local port could trigger it without asking. PR #255 made that forced check work only from Scenri's own page. A status light should not cost the user anything they did not choose to spend.
Measure against their quota, not yours
The lesson I keep is that "free for us" is the wrong test when the user brings their own AI. Their plan is your compute budget, and their disk is your data retention policy. Nobody will send you a bill for either, so you have to look.
What I check now on any feature that runs on the user's own AI:
- Read the token count of a real run, not the quota bar. Do it before and after every prompt change.
- Find what the agent prints or reads back that nobody needs, and tell it not to.
- Separate what you can cut from the fixed cost of the tool, and say which is which.
- Switch off tools the run does not need, especially when it reads untrusted text.
- List every file the run leaves behind, and remove the ones that are copies of yours.
- Make sure nothing spends the user's quota without the user pressing something.
