Thibault Sottiaux, head of the OpenAI Codex team, posted a lengthy message on X today responding to reports that some users’ files were accidentally deleted after calling GPT-5.6 series models in Codex.
Sottiaux said that, since a few weeks ago, the team had received sporadic reports from a small number of Codex users that Codex performed destructive operations without authorization after GPT-5.6 series models were used. OpenAI found that commands intended to clean up temporary files had instead deleted users’ files.
In one scenario, Codex reused system environment variables such as $HOME during temporary work. As a result, an erroneous cleanup command could point to the user’s actual home directory. In some cases, the model attempted to delete or overwrite temporary paths without checking the contents already present in those paths. The relevant screenshots are shown below:
Sottiaux said that the following layers of protection have been added:
Codex is now explicitly instructed to check deletion targets before carrying out operations, create new temporary directories, avoid reusing system environment variables, prioritize reversible operations, and stop when the scope is unclear.
OpenAI has strengthened execution checks, improved the detection of high-risk deletion commands, and submitted them for review. If a command is rejected, the model will use a safer approach.
OpenAI has made it more difficult to enable full access accidentally, added clearer warnings, and further restricted particularly dangerous combinations of permissions.
OpenAI has updated its automated review system to better identify destructive behavior.
OpenAI has built targeted evaluation models to reproduce the failure cases observed by the company. It has also added reinforcement learning tasks and graders focused on these risks, while filtering destructive behavior out of the training data.