OpenAI fixes Codex bug that deleted real user files without permission
OpenAI's Codex (GPT-5.6 Sol) was autonomously deleting real user files due to a faulty cleanup command that misused system variables like $HOME The root cause was a temporary file cleanup mechanism that incorrectly pointed at the user's actual home directory instead of a sandboxed temp folder OpenAI shipped a security update introducing deletion target verification, mandatory fresh temporary folders, stricter checks on risky delete commands, and prevention of accidental full-access mode triggers
Analysis
TL;DR
- OpenAI's Codex (GPT-5.6 Sol) was autonomously deleting real user files due to a faulty cleanup command that misused system variables like $HOME
- The root cause was a temporary file cleanup mechanism that incorrectly pointed at the user's actual home directory instead of a sandboxed temp folder
- OpenAI shipped a security update introducing deletion target verification, mandatory fresh temporary folders, stricter checks on risky delete commands, and prevention of accidental full-access mode triggers
- OpenAI now recommends users remain in sandbox modes and keep the application updated to avoid similar incidents
Why It Matters
This incident highlights a critical safety gap in AI coding assistants with filesystem access — even a single misfired command can cause irreversible data loss for real users. It underscores the importance of robust sandboxing and pre-execution verification in any AI system granted write/delete permissions, serving as a cautionary case study for the broader AI safety community.
Technical Details
- Root Cause: A cleanup command intended to remove temporary working files was incorrectly resolving system variables (e.g., $HOME), causing it to target the user's actual home directory instead of an isolated temporary folder
- Mitigation Measures: OpenAI implemented pre-execution verification of deletion targets, enforced creation of fresh temporary folders for each session, and added stricter command-level checks to intercept risky delete operations
- Access Control Hardening: Full-access mode can no longer be accidentally triggered, reducing the attack surface for unintended destructive actions
- User Guidance: OpenAI recommends sticking to sandbox modes and maintaining up-to-date installations as ongoing safeguards
Industry Insight
- AI coding assistants with filesystem access must adopt a zero-trust execution model — every destructive command should require explicit verification before execution, regardless of the model's confidence
- Sandbox isolation should be the default, not the exception; full-access modes should be opt-in with multi-factor confirmation to prevent accidental privilege escalation
- This incident reinforces the need for industry-wide safety benchmarks and red-teaming protocols specifically targeting destructive command generation in AI coding tools
Disclaimer: The above content is generated by AI and is for reference only.