A few reasons they might take this approach (just speculation): 1. Agents will need to have some kind of sandbox, but still be able to communicate with the out

A few reasons they might take this approach (just speculation): 1. Agents will need to have some kind of sandbox, but still be able to communicate with the outside world in a controlled fashion. So maybe a future "agent manifest file" defines which resources an agent will be allowed to interact with. This definition can be inspected by a user when installing or customized. Any kind of agent system will need a security reference monitor that enforces these policies and access control 2. Enterprise customers - data leaks are no-go for enterprises, so they’ll likely want to block rendering of links and images to arbitrary domains there. However still allow rendering of links and images from company internal resources (which is unique per organization). The current approach would allow such flexibility down the road, but still doesn't explain why vanilla ChatGPT needs to render images from arbitrary domains by default. Again, just speculation trying to understand what's happening - it might that what we see now is side effect of something fundamentally different, who knows? :)