Codex Bug: GPT-5.6 Deleted Users' Files — OpenAI Explains the Cause

On July 16, 2026, OpenAI confirmed a dangerous bug in its Codex coding agent: in isolated cases, the GPT-5.6 model unexpectedly deleted users' files, up to and including the contents of the home folder ($HOME).

What exactly happens

Codex deletes files when three conditions are met at the same time, according to Thibault Sottiaux of OpenAI, who reviewed several user complaints. By the company's account, the destructive failure occurs almost always in the same scenario rather than at random.

Codex is OpenAI's command-line AI agent: it takes a task in natural language and runs commands in the terminal on its own, creating files, launching scripts and editing code. The bug appears when the agent is allowed to act without restrictions.

• Full access mode is enabled, and Codex is running without sandbox protections, including without auto-review of commands
• The GPT-5.6 model tries to override the $HOME environment variable to set a temporary directory
• The model makes a mistake and deletes the $HOME folder itself instead of the temporary one

"About file deletion.

We investigated several reports that GPT-5.6 unexpectedly deleted files," — Thibault Sottiaux, OpenAI, on X.

Why it matters

Codex runs with the user's own permissions, so its mistakes hit real files, not an isolated copy. When the protective layers are off, the model executes commands directly on the system, and an erroneous delete command wipes real data. Overriding $HOME is especially dangerous: a home directory typically holds configs, SSH keys, access tokens and working projects.

Simon Willison, author of a popular technical blog about AI, called the case "a pretty nasty Codex bug." The problem is not a one-off typo in code but a systemic risk: an agent with full access and no sandbox can destroy data because of a single logic error in GPT-5.6's reasoning.

Sottiaux stresses that this was an "honest mistake": the model is not acting maliciously, it simply errs in its logic while trying to create a temporary folder. For the user, the distinction hardly matters, since the outcome is the same: lost files. That is why OpenAI is tracking not an isolated defect but a class of behavior that recurs across different users with similar settings.

How to reduce the risk

Do not disable the sandbox and command auto-review. This follows directly from OpenAI's description. The destructive scenario requires a specific combination: full access mode plus no isolation. The sandbox confines the agent's file operations to the working directory, while auto-review shows the user a command before it runs and gives them a chance to cancel a dangerous deletion before it happens.

Full access mode exists for a reason: it is meant for developers who want the agent to work without constant confirmation prompts, installing dependencies, changing system files and running long pipelines. That convenience comes with a risk: without a sandbox, the model has no safety net against its own mistakes.

What this means

The Codex episode shows the price of AI agent autonomy: the more permissions a model has, the more its mistakes cost. A sandbox and command confirmation are not bureaucracy but the last line of defense between a model's honest mistake and a wiped disk.

FAQ

Why did Codex delete files?

According to OpenAI, the GPT-5.6 model tried to override the $HOME variable to point to a temporary directory and mistakenly deleted the home folder itself. The failure occurred with full access mode enabled, without sandbox protections and without command auto-review.

How can I avoid losing files when using Codex?

Do not disable the sandbox and auto-review. OpenAI says the dangerous scenario arises specifically in full access mode without isolation, when the model can run delete commands directly, with no intermediate check.