GPT-5.6 Codex Reportedly Deletes Files From Users' Home Directories

OpenAI has confirmed that its GPT-5.6 Codex model has, in a handful of documented cases, unexpectedly deleted files from users' home directories, raising fresh questions about the operational safety of autonomous coding agents run outside sandboxed environments.

How the failure actually occurs

The disclosure came from OpenAI's Tibo Sottiaux, who shared findings from an internal investigation. According to that investigation, the file deletion behaviour is rare but reproducible under specific configurations: full access mode enabled, with Codex run without sandboxing protections and without auto-review safeguards active. In these cases, the model may attempt to override the HOME environment variable to redefine a temporary working directory, but due to an execution error, it can mistakenly delete the actual home directory instead of the intended temporary path.

Why the safeguards matter

Auto-review is designed specifically to flag high risk actions, including filesystem operations, before they execute. Sandboxing isolates an agent's file access so that even a destructive command issued by the model cannot reach real user data. When both protections are disabled simultaneously, a configuration OpenAI notes is typically reserved for advanced or trusted automation workflows, there is no secondary validation layer left to intercept a misdirected deletion command before it runs against the user's actual files.

OpenAI's response

Sottiaux was direct about the severity of the outcome: this is not how the system is meant to behave, even when a user operates in full access mode without the standard safeguards. OpenAI says it is updating developer guidance to more clearly warn against unsafe permission configurations, encouraging safer default modes over full-access execution, and has committed to publishing a detailed post-mortem with deeper technical findings and further remediation steps.

Part of a broader pattern in agentic coding tools

This incident sits alongside a run of AI coding tool safety and security stories we have covered recently, including the unpatched Cursor flaw that let cloned repositories execute code automatically on Windows. It also connects to the wider supply chain trust problem we detailed in our coverage of compromised AsyncAPI npm packages, where valid provenance attestations turned out not to guarantee commit integrity, and to the ServiceNow AI Platform sandbox escape flaw we covered last week, another case where a sandbox boundary was the difference between a contained incident and a real one. None of these incidents share a root cause, but together they describe the same underlying shift: as coding agents and AI platforms gain more autonomous filesystem and shell access, the cost of a misconfiguration or an edge case bug scales well beyond what a traditional development tool would produce.

What to do

Developers and organisations running Codex or comparable autonomous coding agents in full access environments should treat sandboxing and auto-review as mandatory safeguards rather than optional friction, particularly on any machine where a home directory holds work that has not been backed up elsewhere. Given how briefly this kind of misconfiguration takes to trigger destructive behaviour, security and platform teams standardising AI coding tool usage across an organisation should consider enforcing safer default configurations centrally, rather than leaving the choice to individual developer discretion.