clauding.de
DE
• 2 min read AI-generated

Codex Is Deleting Files: OpenAI Explains How GPT-5.6 Wipes Your Home Directory

Copy article as Markdown

A handful of users reported that Codex deleted files without asking. OpenAI looked into it — and the explanation is uncomfortably mundane.

OpenAI Security Developer
Featured image for "Codex Is Deleting Files: OpenAI Explains How GPT-5.6 Wipes Your Home Directory"

Thibault Sottiaux of OpenAI published an explanation yesterday that’s worth reading twice:

“We’ve investigated a handful of reports where GPT-5.6 unexpectedly deleted files.”

Then comes the causal chain. It has three links:

  1. Full access mode is enabled and Codex runs without sandboxing protections — including without auto review enabled.
  2. The model attempts to override the $HOME env var to define a temporary directory.
  3. The model makes an honest mistake and deletes $HOME instead.

That’s it. No attack, no prompt injection, no exotic edge case. An agent wants a scratch folder, fumbles an environment variable — and because nothing is asking anymore, the home directory is gone.

Why this is so uncomfortable

What sticks with me isn’t the bug. It’s the combination of those three points. Every single one is a decision a user makes: turn on full access. Sandbox off. Auto review off. All understandable choices if you want an agent to plough through work fast.

And that’s exactly the point. A model making a mistake isn’t remarkable — models make mistakes, that’s priced in. The question is what stands between the mistake and the damage. For these users, the answer was: nothing.

It’s the same pattern we saw with Claude Code 2.1.212 this week. There, the bug was plan mode letting file-modifying Bash commands like touch and rm through without a permission prompt. Different vendor, different cause, same spot: the layer that’s supposed to say “hang on”.

My take

I get the appeal of full access. Permission prompts are annoying, especially when you know exactly what the agent is doing. But the honest math looks like this: you’re trading a few seconds of clicking against the chance that an rm goes somewhere wrong because an env var sat in the wrong place.

Two practical takeaways, vendor-independent. First: if you run an agent without a sandbox, don’t run it where you live — container, VM, worktree, anything. Second: backups. Not because AI is uniquely dangerous, but because this is a very modern route to a very old accident.

I do appreciate the honesty of the explanation, by the way. “The model makes an honest mistake” is a remarkably un-marketing sentence.

Sources: