GPT-5.6 Codex Reportedly Deletes Files From Users’ Home Directories

OpenAI has confirmed that its GPT-5.6 Codex model has, in a handful of documented cases, unexpectedly deleted files from users’ home directories, raising fresh concerns about the operational safety of autonomous coding agents run outside sandboxed environments. The disclosure came from Tibo Sottiaux (@thsottiaux), who shared findings from an internal investigation into the incidents on […] The post GPT-5.6 Codex Reportedly Deletes Files From Users’ Home Directories appeared first on Cyber Security News.

OpenAI has confirmed that its GPT-5.6 Codex model has, in a handful of documented cases, unexpectedly deleted files from users’ home directories, raising fresh concerns about the operational safety of autonomous coding agents run outside sandboxed environments. The disclosure came from Tibo Sottiaux (@thsottiaux), who shared findings from an internal investigation into the incidents on X. According to Sottiaux, the file-deletion behavior is rare but reproducible under specific configurations. The investigation identified three converging conditions that most commonly precede the destructive behavior. These incidents occur when full access mode is enabled, and Codex is run without sandboxing protections or auto-review safeguards. GPT-5.6 Codex Reportedly Deletes Files From Users In such cases, the model may attempt to override the $HOME environment variable to redefine a temporary working directory. However, due to an execution error, the model can mistakenly delete the $HOME directory itself instead of the intended temporary path. The root issue appears to stem from Codex’s handling of environment variable manipulation during file operations. When operators disable the sandbox and skip auto-review, there is no secondary validation layer to intercept potentially destructive commands. As a result, a misdirected deletion command may target a user’s actual home directory rather than an isolated working directory. Auto-review is designed specifically to flag high-risk actions, including filesystem operations, before execution. Sandboxing, meanwhile, isolates the agent’s file access so that even if a destructive command is issued, it cannot impact real user data. Sottiaux emphasized that the reported incidents occurred exclusively when users bypassed both protections simultaneously, a configuration typically reserved for advanced or trusted automation workflows. “This is of course not how we want the system to behave, even when a user operates the model in full-access mode without the safeguards of our sandbox or without using auto review,” Sottiaux stated, emphasizing that such outcomes are considered unacceptable regardless of configuration. On file deletions. We’ve investigated a handful of reports where GPT-5.6 unexpectedly deleted files. What we have found is that this most commonly occurs when:– Full access mode is enabled and codex is run without sandboxing protections, including without auto review being…— Tibo (@thsottiaux) July 16, 2026 OpenAI has stated that it is taking several steps to mitigate the risk. These include updating developer guidance to more clearly warn against unsafe permission configurations and encouraging users to adopt safer default modes rather than full-access execution. The company also confirmed that a detailed post-mortem will be released in the coming days, providing deeper technical insights into the root cause and outlining further remediation measures. While OpenAI describes the issue as extremely rare, the incident highlights a broader security concern surrounding agentic AI systems with direct filesystem and shell access. As these tools become more autonomous, the risk of misconfiguration increases significantly. Developers and organizations using Codex or similar systems in full-access environments should treat sandboxing and auto-review mechanisms as essential safeguards rather than optional features, especially in environments where home directories. Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs The post GPT-5.6 Codex Reportedly Deletes Files From Users’ Home Directories appeared first on Cyber Security News.