llms.blog
OpenAI

OpenAI Patches Codex Deletion Bug That Erased Local User Files

OpenAI has released a security patch for its Codex coding agent after users reported that the model, running GPT-5.6 Sol, deleted local files without user confirmation during autonomous coding sessions. The issue occurred when Codex operated in full-access mode outside standard execution sandboxes. While performing automated cleanups of temporary workspaces and build artifacts, the agent executed destructive deletion commands that misidentified system directory paths. Root Cause and Execution

axc
axc
1 min
OpenAI Patches Codex Deletion Bug That Erased Local User Files

OpenAI has released a security patch for its Codex coding agent after users reported that the model, running GPT-5.6 Sol, deleted local files without user confirmation during autonomous coding sessions.

The issue occurred when Codex operated in full-access mode outside standard execution sandboxes. While performing automated cleanups of temporary workspaces and build artifacts, the agent executed destructive deletion commands that misidentified system directory paths.

Codex Agent File System Boundaries

Root Cause and Execution Path

According to details shared by OpenAI, the flaw stemmed from how the coding assistant handled temporary environment variables during session teardowns. When generating terminal commands to clean up intermediate compilation outputs and temporary working folders, the model occasionally referenced top-level environment variables like $HOME as temporary directories.

Because full-access mode grants the CLI agent permission to run filesystem commands directly on the host machine, the resulting recursive removal commands targeted root user folders rather than ephemeral subdirectories.

Implemented Safeguards

The update introduces several architectural checks to prevent autonomous file deletion:

  • Target Path Validation: Codex now executes pre-flight path resolution checks before executing any rm or filesystem deletion routine, rejecting commands that target root, home, or parent system directories.
  • Isolated Ephemeral Workspaces: Temporary files are now strictly routed into dedicated, newly initialized subfolders with explicit boundaries rather than dynamically resolved parent paths.
  • System Variable Guardrails: The agent is restricted from interpreting $HOME, ~, or top-level path variables as targets in cleanup scripts.
  • Gated Full-Access Mode: OpenAI added safeguards to prevent full-access execution from being enabled inadvertently, requiring explicit opt-in confirmation.

OpenAI recommended that developers running Codex utilize sandboxed execution environments and update their CLI installations immediately.

Sources

OpenAICodexToolingSecurity
ShareX (Twitter)LinkedIn

Written by

axc

More to read

  • Data Filtering and Deduplication in Large Language Models: How Heuristics, MinHash LSH, SemDeDup, and Quality Classifiers Curate Pre-Training Corpora

    Data Filtering and Deduplication in Large Language Models: How Heuristics, MinHash LSH, SemDeDup, and Quality Classifiers Curate Pre-Training Corpora Pre-training data quality governs the downstream reasoning, factual accuracy, and sample efficiency of foundation large language models (LLMs). While early pre-training efforts relied on uncurated or lightly processed dumps from web repositories like Common Crawl, modern state-of-the-art models depend on multi-stage data curation pipelines that fi

    1 min

  • Agentic Search and Multi-Hop Retrieval in Production: Query Decomposition, Evidence-Gap Loops, and Synthesis Architecture

    Standard retrieval-augmented generation (RAG) relies on a single-pass paradigm: an incoming prompt is embedded, matched against a vector or hybrid index, and the top-k passages are injected into the generator's context window. This linear workflow functions reliably for direct fact retrieval, but it breaks down on complex research tasks. When a query requires chained dependencies, comparative analysis across isolated documents, or multi-step reasoning, single-shot retrieval fails because the req

    1 min

  • Supervised Fine-Tuning in Large Language Models: Loss Masking, Sequence Packing, and Alignment Dynamics

    Pre-training endows a large language model with broad linguistic patterns, world knowledge, and reasoning primitives by predicting the next token across trillions of uncurated web tokens. However, a raw base model remains a document completer rather than an interactive assistant. Given a prompt such as "Explain how a compiler works," a base model is as likely to generate additional exam questions or web navigation headers as it is to answer the query. Supervised Fine-Tuning (SFT), frequently te

    1 min