Codex deleted files where the agent had too much room to move

Simon Willison highlighted a quote from Thibault Sottiaux about a Codex bug where GPT-5.6 unexpectedly deleted files in a handful of reports. According to the quote, the problem most commonly appeared under a specific combination of permissions and settings.

The Codex bug involved full access mode and the $HOME variable

The event allegedly occurred when full access mode was enabled, Codex ran without sandboxing protections and without auto review, the model tried to override the $HOME environment variable for a temporary directory and mistakenly deleted the home directory instead. It is not a case of GPT-5.6 deleting files indiscriminately, but a consequence of broad permissions.

This is the type of failure that is often underestimated with coding agents. As long as a model only suggests a patch, it does not look dangerous. But if it gets shell access, filesystem access and a way to bypass review, a simple error in interpreting a variable can end destructively.

For development teams, the perception of agent safety is changing

For teams using Codex, Claude Code or internal agent tools, the safety of a coding agent is no longer just a benchmark of its ability to write code. It is the architecture of the entire runtime environment in which it operates.

Sandboxing, an explicit allowlist, confirmation of destructive operations and an audit log make the difference between an agent that incorrectly proposes a change and an agent that physically executes it. Auto review is crucial precisely for those moments when an error in judgment is trivial, but its consequence is severe.

Full access increases the blast radius of mistakes

Full access mode is convenient for developers because it reduces friction. The agent does not have to ask for every permission and can handle more steps on its own. But that same freedom proportionally increases the blast radius of every error in its process, even unintentional ones.

The incident does not point to malicious intent; Sottiaux explicitly describes an "honest mistake". That makes the situation all the more complex, because safety safeguards must not rely on the assumption that a model will only err in obvious and dramatic ways.

Filesystem access must become a security interface

It will be interesting to see whether OpenAI changes the default settings for Codex and whether destructive operations or the rewriting of critical paths will receive stricter approval rules.

If coding agents are to become a standard part of development, working with files must be designed as a controlled security interface, not just as an automatic side effect of shell access.

Lilith's verdict

An agent with filesystem access is not an intern at a keyboard, but a clerk with a cart in an archive. Point them down the wrong aisle, and they might haul a whole cabinet to the shredder.