llms.blog
OpenAI

OpenAI Patches Codex Deletion Bug That Erased Local User Files

OpenAI has released a security patch for its Codex coding agent after users reported that the model, running GPT-5.6 Sol, deleted local files without user confirmation during autonomous coding sessions. The issue occurred when Codex operated in full-access mode outside standard execution sandboxes. While performing automated cleanups of temporary workspaces and build artifacts, the agent executed destructive deletion commands that misidentified system directory paths. Root Cause and Execution

axc
axc
1 min
OpenAI Patches Codex Deletion Bug That Erased Local User Files

OpenAI has released a security patch for its Codex coding agent after users reported that the model, running GPT-5.6 Sol, deleted local files without user confirmation during autonomous coding sessions.

The issue occurred when Codex operated in full-access mode outside standard execution sandboxes. While performing automated cleanups of temporary workspaces and build artifacts, the agent executed destructive deletion commands that misidentified system directory paths.

Codex Agent File System Boundaries

Root Cause and Execution Path

According to details shared by OpenAI, the flaw stemmed from how the coding assistant handled temporary environment variables during session teardowns. When generating terminal commands to clean up intermediate compilation outputs and temporary working folders, the model occasionally referenced top-level environment variables like $HOME as temporary directories.

Because full-access mode grants the CLI agent permission to run filesystem commands directly on the host machine, the resulting recursive removal commands targeted root user folders rather than ephemeral subdirectories.

Implemented Safeguards

The update introduces several architectural checks to prevent autonomous file deletion:

  • Target Path Validation: Codex now executes pre-flight path resolution checks before executing any rm or filesystem deletion routine, rejecting commands that target root, home, or parent system directories.
  • Isolated Ephemeral Workspaces: Temporary files are now strictly routed into dedicated, newly initialized subfolders with explicit boundaries rather than dynamically resolved parent paths.
  • System Variable Guardrails: The agent is restricted from interpreting $HOME, ~, or top-level path variables as targets in cleanup scripts.
  • Gated Full-Access Mode: OpenAI added safeguards to prevent full-access execution from being enabled inadvertently, requiring explicit opt-in confirmation.

OpenAI recommended that developers running Codex utilize sandboxed execution environments and update their CLI installations immediately.

Sources

OpenAICodexToolingSecurity
ShareX (Twitter)LinkedIn

Written by

axc

More to read

  • Grammar-Constrained Decoding in Production: Finite State Automata, Pushdown Parsers, and Asynchronous Bitmasking

    Autoregressive language models generate text by sampling from a probability distribution over a discrete vocabulary at each step. While unconstrained sampling succeeds across open-ended text tasks, it offers no syntactic guarantees when producing machine-readable formats such as JSON, SQL, or structured tool calls. In automated agent loops, a single missing quotation mark, unbalanced bracket, or unescaped control character breaks downstream parser execution, forcing expensive retry round-trips.

    1 min

  • No Positional Embeddings (NoPE): How Causal Masking and Attention Geometry Encode Sequence Order

    A foundational tenet of the Transformer architecture established by Vaswani et al. (2017) is permutation equivariance. Because standard self-attention calculates token interactions purely through pairwise dot products across sets of vectors, shuffling the order of input tokens yields identical outputs up to the corresponding permutation. To establish word order, standard transformer models inject explicit positional information, ranging from learned absolute position embeddings (APE) to sinusoid

    1 min

  • Hugging Face ICML 2026 Audit: AI Coding Agents Falsify Claims Across 23% of 2,226 Examined Papers

    Hugging Face has published the findings of its ICML 2026 Open Reproductions challenge, a large-scale community audit that deployed autonomous AI coding agents to test the experimental claims of 2,226 accepted machine learning papers. The 19-day initiative involved 1,221 researchers and developers using tools including Claude Code, OpenAI Codex, Cursor, and OpenResearch orx. Participants generated 6,816 publicly auditable reproduction logbooks and executed 2,962 cloud compute jobs, examining rou

    1 min