이미지: The Decoder
Summary
- OpenAI has patched a bug in Codex that let GPT-5.6 Sol delete real user files without approval.
- The cause was traced to a command meant to clear a temporary working folder that mistakenly referenced a system variable like $HOME, wiping the actual home directory instead.
- Codex now verifies deletion targets beforehand and includes safeguards to prevent full-access mode from being enabled by accident.
- 문제 모델
- GPT-5.6 Sol (코덱스)
- 신고 내용
- 여러 사용자가 자율 실행 중 실제 파일 삭제 보고
- 원인
- 임시 폴더 정리 명령이 $HOME 등 시스템 변수를 잘못 참조
- 조치 1
- 삭제 명령 실행 전 대상 사전 검증
- 조치 2
- 새 임시 폴더 생성, 시스템 변수 오용 차단
- 조치 3
- 위험한 삭제 명령에 대한 검사 강화
- 조치 4
- 전체 접근 모드 우발적 활성화 차단
- 권고
- 샌드박스 모드 사용, 앱 최신 버전 유지
It said it was clearing a temp folder — the home folder vanished instead
OpenAI's coding agent Codex received multiple reports of an incident in which its GPT-5.6 Sol model deleted real files without user approval while working autonomously. Users reported files disappearing suddenly during autonomous code execution, and according to an announcement OpenAI posted on X, the issue was fixed in this month's security update.
Codex is OpenAI's coding agent, released alongside ChatGPT and Sora, and it works by writing, running, and modifying code directly in a real computing environment based on a developer's instructions. GPT-5.6 Sol, the model behind the incident, is also the frontier model OpenAI introduced for defensive security work when it expanded its dedicated cybersecurity initiative, Daybreak, on August 10. The backdrop to this patch is that a model designed for tasks like vulnerability detection and security code review ended up deleting user files instead.
What went wrong
The root cause was a command written to clean up temporary working files left behind after code execution. That command used a system variable like $HOME to specify the location of the temporary folder, but in certain conditions, this variable pointed not to the temp folder but to the user's actual home directory. Because the deletion command followed this variable as-is, documents and configuration files that were never meant to be cleaned up were deleted along with everything else. The fact that Codex could, under certain conditions, switch into a full-access mode with access to the entire file system was also identified as a factor that widened the scope of the damage.
OpenAI's response
OpenAI changed Codex so that it now verifies the target path before executing a deletion command. Temporary folders are also freshly created each time, blocking the scenario where a system variable overlaps with an actual user directory. High-risk deletion commands now go through stricter checks, and the trigger conditions for full-access mode were redesigned so it can't be switched on accidentally. OpenAI advised users to keep one of the sandbox modes enabled and to update their apps to the latest version.
If you're using Codex now
Even after this patch, there are three things worth checking when using Codex. First, check your settings to confirm you're running in sandbox mode rather than full-access mode. Second, make sure your app and CLI tools are up to date. Third, for tasks involving large-scale deletion or file cleanup, it's safer to back up separately before execution. These steps won't prevent this specific bug, but they're practical ways to limit damage if a similar incident happens again.
Editor's take
In any structure where a coding agent directly accesses the file system to execute commands, risk emerges the moment the agent is left to decide for itself what to delete. The core of this incident wasn't a failure of the model's reasoning but a design flaw in the execution layer — using the $HOME variable as a stand-in for a temp folder is a risky coding pattern regardless of who writes it. The difference is that a human-written script fails once and stops there, while an agent can repeat the same mistake, and do so without user approval.
For teams using coding agents in production, the lesson here is clear. When granting an agent permission to delete or clean up files, the scope of accessible paths should be narrowed to the minimum necessary. Rather than granting access to an entire project folder, permissions should be limited to specific subdirectories, and automation involving deletion should include a separate approval step. The safeguards OpenAI built are, in effect, a way of forcing exactly this kind of principle into Codex itself.
As coding agents get deeper into real production environments, incidents like this are bound to keep happening. Building dedicated security-focused models, like the Daybreak initiative OpenAI also announced this week, and breaking down file access permissions into finer-grained controls are trends likely to spread beyond Codex to competing agent tools in the coming months.
Comments