Recent reports indicate that GPT-5.6 Codex has unintentionally deleted files in users’ home directories under certain configurations, raising concerns about the risks of running advanced AI coding agents with unrestricted access to the system.
This issue, brought to light by researcher Tibo Sottiaux, appears to be linked to edge-case behavior when the model operates in full-access mode without sandboxing protections or automatic safety review mechanisms.
Initial findings suggest that these incidents of file deletion are not widespread but occur under specific conditions that significantly increase operational risk.
These conditions involve scenarios in which Codex is granted unrestricted filesystem permissions, operates without containment controls such as sandboxing, and lacks automated review safeguards to intercept high-risk commands.
In such environments, the model may attempt to redefine environment variables, specifically by overriding the $HOME directory to create or use a temporary workspace.
However, due to what has been described as an “honest mistake,” the model may misinterpret this operation and inadvertently execute deletion commands targeting the actual $HOME directory rather than a temporary path.
This situation highlights a critical category of AI-induced operational errors in which autonomous agents interact directly with sensitive system-level resources.
While the model’s underlying intent is not malicious, the lack of protective measures can lead to destructive actions. In Unix-like systems, the $HOME directory typically contains user profiles, SSH keys, configuration files, and project data, making such deletions potentially catastrophic for data integrity and security.
OpenAI has acknowledged this issue, emphasizing that the behavior does not align with expected system design and is considered a high-priority safety concern.
The company noted that incidents of this nature are “extremely rare” but confirmed that it is pursuing ongoing mitigation efforts.
These include updates to developer guidance to discourage unsafe execution modes, stronger recommendations for using sandboxed environments, and enhancements to automated review systems capable of detecting and blocking dangerous file operations before they are executed.
Additionally, new “harness-level” safeguards are being introduced to enforce stricter boundaries around filesystem access, especially in contexts where environment variables are modified programmatically. These controls aim to minimize the risk of destructive command execution, even when models are granted elevated permissions.
The incident underscores a broader challenge in AI-assisted development workflows: balancing flexibility and autonomy with robust safety controls.
As organizations increasingly incorporate AI agents into production pipelines, improper configurations, such as disabling sandboxing or bypassing validation layers, can expose systems to unintended consequences.
Security experts recommend that developers avoid running AI coding models in full-access mode unless necessary and always accompany such deployments with sandbox isolation, real-time command auditing, and least-privilege access policies.
Monitoring for anomalous filesystem activity and maintaining regular backups are also crucial defensive measures.
A detailed post-mortem is expected in the coming days, which may provide deeper technical insights into the root cause and additional mitigation strategies.
Until then, this incident serves as a cautionary example of how even non-malicious AI behavior can introduce significant operational risk when safeguards are absent.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
