OpenAI patches Codex after GPT-5.6 Sol deleted user files without permission
A coding agent that nukes your home directory is every developer's nightmare — and it just happened at scale. OpenAI has shipped an emergency security update to Codex after users discovered that GPT-5.6 Sol, the model powering the tool's agentic coding mode, was autonomously deleting real user files during execution. The root cause: a cleanup command meant for temporary working folders was misusing system variables like $HOME, causing it to target the actual home directory instead of a sandboxed temp path.
The incident is a stark reminder that AI coding agents are not just autocomplete on steroids — they are autonomous actors with real filesystem access, and the gap between "helpful" and "destructive" can be a single misconfigured variable. OpenAI's fix introduces three layers of protection: Codex now verifies deletion targets before executing them, creates fresh temporary folders rather than reusing system paths, and blocks full-access mode from being triggered accidentally. The company is recommending users stick with one of the sandboxed execution modes and keep the app updated.
What makes this story matter beyond the bug itself is the pattern it reveals. OpenAI's Codex is one of the highest-profile agentic coding tools on the market, deployed by thousands of developers who trust it with real projects. The fact that a cleanup routine — one of the most mundane operations in any codebase — could escalate into data destruction exposes a fundamental tension in AI agent design: the more autonomy you give a model, the more catastrophic its mistakes become. This isn't a theoretical alignment problem; it's a practical engineering failure that wiped files off real machines.
The fix is live, but the broader question lingers. As AI coding agents get deeper system access to be more useful, how do you prevent the tool from becoming the threat? OpenAI's three-pronged approach — verify, isolate, restrict — is sensible, but it's reactive. The company had to ship this after users lost data, not before. We covered OpenAI's broader safety challenges earlier this month — OpenAI dissolves the team built to catch catastrophic AI risks — and this incident is exactly the kind of real-world failure those teams existed to prevent.
What to watch: whether competitors like Anthropic's Claude Code or Cursor's agent mode face similar incidents, and whether the industry moves toward mandatory sandboxing as a baseline for agentic tools rather than an opt-in safety feature.
Should AI coding agents be sandboxed by default, with full-access mode requiring explicit opt-in and warnings — or does that kill the productivity gains that make them worth using? Tell us in the comments.
Sources: The Decoder · The Decoder — original bug report
