OpenAI has shipped a security update for Codex after several users reported that GPT-5.6 Sol in Codex was autonomously wiping files while running. The company says the fix is meant to stop Codex from deleting user data without asking.
The core issue was not described as a normal editing mistake. According to OpenAI, it came from a command intended to clean up temporary working files. Under the wrong conditions, that cleanup process could point at real user data instead.
What OpenAI says went wrong
The bug centered on how Codex handled temporary working files. A cleanup command was supposed to remove files created for the task at hand, but it could instead reach outside that intended area.
OpenAI says this could happen when the model used system variables like $HOME for temporary folders. If a faulty delete command then resolved to the real home directory, the command could delete actual user files rather than disposable working files.
That distinction matters. Temporary files are expected to be short-lived. User files are not. A coding assistant that runs commands needs to keep those categories separate, because a cleanup step can become destructive if it points at the wrong location.
The source article does not provide a count of affected users, a list of deleted file types, or a timeline for the reports. The confirmed facts are narrower: several users had reported the behavior, the reports involved GPT-5.6 Sol in Codex, and OpenAI connected the root cause to temporary file cleanup and faulty deletion targeting.
The new safeguards in Codex
OpenAI has now added several protections. The company has told Codex to verify deletion targets before running them. That means the assistant is expected to check where a delete command is aimed before it proceeds.
OpenAI has also told Codex to create fresh temporary folders. This addresses the risk created when temporary work is tied to broad system paths or variables that can resolve to real user locations.
Another change is that Codex should stop misusing system variables. The source specifically names $HOME, which can represent a real home directory rather than a throwaway workspace. Treating that kind of variable casually can turn a routine cleanup into data loss.
The update also adds stricter checks for risky delete commands. Those checks are meant to catch commands that could remove more than intended. In practical terms, this is about reducing the chance that an automated coding session can execute a destructive command against the wrong target.
OpenAI also says full-access mode can no longer be triggered by accident. That matters because full-access mode changes the risk profile: if an assistant has broader access, a mistaken command can affect more real user data.
Why sandbox modes are part of the answer
OpenAI recommends that users stick with one of the sandbox modes and keep the app up to date. That recommendation follows directly from the nature of the bug. If a command goes wrong, the level of access determines how much damage it can do.
A sandbox mode limits what the tool can reach. It does not make every command harmless, but it can reduce the blast radius if the model generates or runs a risky operation. For a tool like Codex, that boundary is especially important because the assistant can interact with files while helping with code.
The update also shows why keeping the app current matters. In this case, OpenAI says the fix includes multiple safeguards: target verification, fresh temporary folders, better handling of system variables, stricter checks on delete commands, and protection against accidental full-access mode.
Users do not need to know every implementation detail to understand the practical lesson. When an AI coding tool can run commands, file deletion is not just a theoretical risk. The safest setup is one where the tool has limited access, dangerous operations are checked, and temporary files are kept clearly separate from real project and user data.
What this means for AI coding workflows
The Codex bug highlights a basic tension in AI coding tools. The more useful an assistant becomes, the more it may need to create files, modify code, run commands, and clean up after itself. Each of those actions can save time, but each also needs guardrails.
Cleanup commands are a good example. They are often routine and easy to overlook, because their purpose is to remove clutter. But if the target is wrong, cleanup becomes deletion of real data. OpenAI’s fix focuses on that exact point: before deleting, Codex should know what it is deleting.
The mention of system variables like $HOME is also significant. Variables can make commands flexible, but they can also hide where a command will actually run. If an assistant treats a real user directory as a temporary folder, the command may look ordinary while pointing somewhere dangerous.
For users, the immediate takeaway is simple: update Codex, use sandbox modes, and be cautious with full-access capabilities. For OpenAI, the update is a recognition that AI coding assistants need safety checks around ordinary developer operations, not only around obviously dangerous requests.
The fix does not change the basic promise of Codex: helping users work with code. It does, however, underline that file access is a trust boundary. When a coding assistant can touch the filesystem, deletion behavior needs to be deliberate, verified, and constrained.