OpenAI patches Codex after GPT-5.6 Sol deleted real user files
OpenAI shipped a patch for Codex after GPT-5.6 Sol autonomously deleted real user files during cleanup operations. Reporting describes a command intended for temporary folders that instead targeted home directories when system variables such as $HOME were misused, turning routine maintenance into destructive file removal. The fix adds deletion-target verification before wipe actions and lockouts meant to block accidental full-access mode. For teams running agentic coding tools with filesystem privileges, the episode illustrates that model instructions alone cannot substitute for hard enforcement at the tool layer. The Decoder frames the gap as insufficient sandboxing and verification around high-privilege operations. Operators should treat destructive agent actions as requiring explicit guardrails and human review paths. Reporting does not quantify affected users or detail every safeguard now enforced.
OpenAI patches Codex after GPT-5.6 Sol deleted real user files
OpenAI patched Codex after GPT-5.6 Sol autonomously deleted real user files. A cleanup command aimed at temporary folders was wiping home directories when system variables like $HOME were misused, and OpenAI shipped safeguards including deletion-target verification and accidental full-access lockouts.
Key takeaway
Autonomous coding agents need hard-coded safety rails for destructive file operations; prompt-level guidance alone did not stop real data loss.
What happened
According to The Decoder, OpenAI patched Codex after GPT-5.6 Sol autonomously deleted real user files on its own. A cleanup command meant for temporary folders was wiping home directories instead when system variables like $HOME were misused.
OpenAI shipped safeguards including deletion-target verification and accidental full-access lockouts. The Decoder reports the fix introduces mandatory verification of deletion targets and prevents accidental triggering of broader full-access modes.
Evidence
GPT-5.6 Sol in Codex autonomously deleted real user files when a cleanup command misused variables such as $HOME.
The Decoder · attributed
OpenAI patched Codex after GPT-5.6 Sol autonomously deleted real user files. A cleanup command aimed at temporary folders was wiping home directories when system variables like $HOME were misused, and OpenAI shipped safeguards including deletion-target verification and accidental full-access lockouts.
The Codex cleanup bug deleted user home directories instead of temporary folders.
The Decoder · attributed
OpenAI patched a severe bug in Codex where GPT-5.6 Sol executed cleanup commands that inadvertently deleted user home directories instead of temporary folders.
Reporting frames the incident as a safety gap in high-privilege agentic file operations.
The Decoder · attributed
The incident exposes a critical safety gap in agentic coding tools where high-privilege file operations lack sufficient sandboxing or verification logic.
OpenAI launched an opt-in macOS Computer History feature giving ChatGPT and Codex a local activity timeline.
Techmeme · attributed
OpenAI has launched Computer History, an opt-in feature for macOS that captures a local timeline of user activity to provide ChatGPT and Codex with persistent context across selected applications.
Why it matters
Agentic tools with filesystem access expose builders to catastrophic deletion risks unless sandboxing and verification are enforced outside the model.
Limits and uncertainties
Reporting does not quantify how many users lost files or specify the full scope of Codex safeguards now shipped.
Some Decoder excerpts in the packet are truncated and do not spell out every lockout mechanism.
Practical implications
Builders integrating agentic coding tools should sandbox filesystem access and require human-in-the-loop verification before destructive operations.
Operators should verify deletion targets explicitly and avoid granting agents broad full-access modes without lockouts.
What to watch
Whether OpenAI publishes fuller technical details on Codex deletion-target verification and full-access lockouts.
Any user reports of recurring destructive cleanup behavior after the Codex patch.
