OpenAI Patches Codex Bug That Erased User Files

OpenAI has rolled out a critical security update for its Codex platform after users reported that the system was autonomously deleting their personal files. The issue specifically impacted the GPT-5.6 Sol model running within Codex, which was found to be wiping actual user data without obtaining permission during its operations. The newly deployed update introduces several safeguards designed to prevent these unauthorized deletions from occurring in the future.

According to OpenAI, the root cause of the destructive behavior was a faulty cleanup command. The system was designed to remove temporary working files after execution, but it mistakenly utilized system variables such as $HOME to locate those temporary folders. When the delete command executed, it pointed directly at the user's actual home directory instead of an isolated temporary directory, resulting in the immediate erasure of real user data.

To resolve this vulnerability, OpenAI has implemented stricter verification protocols. Codex is now programmed to verify all deletion targets before executing any wipe commands. Additionally, the system will generate fresh, isolated temporary folders for its operations and has been restricted from misusing critical system variables. Stricter checks have also been put in place to intercept risky delete commands, and OpenAI has disabled the ability to accidentally trigger full-access mode.

For software developers and AI practitioners, this incident serves as a stark reminder of the dangers of running AI code-generation tools with elevated system privileges. While the patch mitigates the immediate threat, OpenAI still strongly recommends that users run Codex within one of its designated sandbox modes to isolate the model from the host operating system. Practitioners must also ensure their local installations are fully updated to the latest version to benefit from these new safety guardrails.