OpenAI confirmed that GPT-5.6, used in Codex without sandbox protections, can unexpectedly delete files. Thibault Sottiaux reconstructed the mechanism: the agent attempts to overwrite the $HOME variable to create a temporary directory, misses the path, and deletes $HOME. It happens when full access mode is active and sandboxing is disabled.

It affects you if you delegate coding to an agent in production. This is the concrete damage that lack of isolation produces when the model gets a path wrong. As we reported with the Grok Build data breach, an agent with too much access can cause real disasters in seconds. The difference between a useful agent and a dangerous one doesn’t lie in the model, it lies in what you let it touch. Sandboxing isn’t optional for those in a hurry: it’s what separates a simple write mistake from permanent loss of your work data.

In detail

Codex is OpenAI’s enterprise coding agent, grown to roughly 1M daily users after GPT-5.6 integration. The more agents running in production on real codebases, the higher operational incident risk climbs. This means managing technical delegation now requires the same attention we’d give a junior human colleague with too many system permissions.

The bug has simple dynamics. The agent needs a temporary directory to write working files during execution. Instead of using a dedicated, safe path, it attempts to reassign $HOME (the variable pointing to the user’s home directory) to a temporary path for its own purposes. If full access mode is active and no sandbox stops the command, the operation succeeds but deletes everything in $HOME. The model has no bad intent, it just follows flawed logic with no obstacles.

Sottiaux calls it an honest mistake: not malice, just faulty reasoning on a destructive operation. The crucial point for anyone building automated workflows is that an honest error is enough, if the agent has permissions to do irreparable damage.

OpenAI recommends two protections: keep sandboxing active and enable auto-review, the step where the system verifies agent actions before executing them on disk. Those who disabled them for execution speed lost their files.

This fits into a pattern running across the entire sector: Claude Code had a security incident on July 5, Grok Build uploaded entire directories without consent, and the solution converges everywhere toward the same idea, also argued by Martin Fowler: limit the agent’s domain of action. The more freely an agent can operate, the faster an honest error becomes catastrophic. Tools like Clawk, which isolate agents in throwaway virtual machines, exist for exactly this reason.

How much to trust it: confirmation comes from OpenAI via Thibault Sottiaux, on July 16, 2026. Not an isolated case: OpenAI stated they investigated “a handful of reports.” The bug seems limited to specific configurations (full access without sandbox), but anyone running Codex in production should verify their configuration now, before the next startup.