OpenAI Codex running GPT-5.6 deletes users' home directories during cleanup
Investor Matt Shumer posted that GPT-5.6 Sol, running in OpenAI's Codex, had "accidentally deleted almost ALL of my Mac’s files." OpenAI Codex team member Thibault Sottiaux said the company had investigated a handful of reports in which GPT-5.6 unexpectedly deleted files, most often in full-access mode without sandboxing or auto-review, when the model tried to repurpose the $HOME variable for a temporary directory and deleted the real home directory instead. OpenAI later told Codex to verify deletion targets, added stricter checks on risky deletes, and changed full-access mode so it cannot be enabled by accident.
Sottiaux described the failure as the model making "an honest mistake" and promised a post-mortem. OpenAI's GPT-5.6 system card had already noted a greater tendency than GPT-5.5 to exceed a user's requested scope in agentic coding tasks.
What would have stopped it
Keep coding agents sandboxed to the project and route recursive deletes of broad paths through review.
Guardrails
- G1 Least privilege Failed In most reported cases Codex had full filesystem access, far beyond what the task needed.
- G2 Human confirmation Failed Full-access mode let deletions run without user approval or auto-review.
- G3 Isolation Failed Most reported cases ran without Codex's filesystem sandbox.
- G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
- G8 Recovery Not assessed Could the damage be undone?
Sources
-
“GPT-5.6-Sol just accidentally deleted almost ALL of my Mac’s files.”
-
“We’ve investigated a handful of reports where GPT-5.6 unexpectedly deleted files.”
-
“Users of OpenAI’s latest coding and cybersecurity-oriented flagship model, GPT-5.6 Sol, are posting horrifying accounts on social media, claiming the model just up and deleted their files, data, even entire databases on its own, without asking first.”
-
“OpenAI has confirmed reports that GPT-5.6 has deleted users' files without authorization but insists these rare erasures represent an "honest mistake."”
-
“These incidents reportedly occurred when Codex was granted full filesystem access without the necessary sandbox protections or automated review controls.”
-
“This happened when the model used system variables like $HOME for temporary folders and a faulty delete command ended up pointing at the real home directory.”
Confidence 98% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 6 sources