Баг в Codex: GPT-5.6 удалял файлы пользователей — OpenAI объяснила причину

On July 16, 2026, OpenAI confirmed a dangerous bug in its Codex coding agent: in certain cases, the GPT-5.6 model unexpectedly deleted users' files — up to and including the contents of the home directory ($HOME).

What exactly is happening

Codex deletes files when three conditions come together at once — this is what Thibault Sottiaux of OpenAI wrote, after looking into several user complaints. According to the company, the destructive failure occurs almost always in one and the same scenario, not randomly.

Codex is a console AI agent from OpenAI: it receives a task in natural language and executes terminal commands itself — creating files, running scripts, editing code. The bug appears when the agent is allowed to act without restrictions.

• Full access mode is enabled, and Codex is running without sandbox protections — including without command auto-review
• The GPT-5.6 model tries to redefine the $HOME environment variable in order to set a temporary directory
• The model makes a mistake and deletes the $HOME folder itself instead of the temporary one

"Regarding the file deletion.

We investigated several reports that GPT-5.6 unexpectedly deleted files," — Thibault Sottiaux, OpenAI, on X.

Why it matters

Codex operates with the user's own permissions, so its mistake hits real files, not an isolated copy. When protective layers are disabled, the model executes commands directly on the system — and an erroneous deletion command wipes out real data. Redefining $HOME is especially dangerous: the home directory usually contains configs, SSH keys, access tokens, and work projects.

Simon Willison, author of a popular technical blog about AI, called the case "a pretty nasty Codex bug." The problem isn't a single typo in the code, but a systemic risk: an agent with full access and no sandbox can destroy data because of a single logical error in the GPT-5.6 model's reasoning.

Sottiaux emphasizes: this is an "honest mistake" — the model doesn't act maliciously, it errs in the logic while trying to create a temporary folder. For the user, the difference is minor: the result is the same — lost files. That's why OpenAI is documenting not a one-off defect, but a class of behavior that recurs across different users with similar settings.

How to reduce the risk

Don't disable the sandbox and command auto-review — that's the direct takeaway from OpenAI's description. The destructive scenario requires exactly this combination: full access mode plus the absence of isolation. The sandbox restricts the agent's file operations to the working directory, while auto-review shows the command to the user before execution and gives a chance to cancel a dangerous deletion before it happens.

Full access mode exists for a reason — it's needed when a developer wants the agent to work without constant confirmation prompts: installing dependencies, modifying system files, running long pipelines. The convenience comes with risk: without a sandbox, the model has no safety net against its own mistake.

What this means

The Codex story shows the price of AI agent autonomy: the more rights a model has, the more expensive its mistake becomes. The sandbox and command confirmation aren't bureaucracy — they're the last line of defense between the model's honest mistake and a wiped disk.

FAQ

Why did Codex delete files?

According to OpenAI, the GPT-5.6 model tried to redefine the $HOME variable to point to a temporary directory and mistakenly deleted the home folder itself. The failure occurred when full access mode was enabled without sandbox protections and without command auto-review.

How do I avoid losing files when working with Codex?

Don't disable the sandbox and auto-review. OpenAI states that the dangerous scenario arises specifically in full access mode without isolation — when the model can execute deletion commands directly, without an intermediate check.