GPT-5.6 Codex Bug Deletes User Files

OpenAI has confirmed a critical bug in GPT-5.6's Codex implementation that causes the model to delete user files under specific conditions.

The Bug

According to Thibault Sottiaux, OpenAI has investigated multiple reports of GPT-5.6 unexpectedly deleting files. The issue occurs when:

1. Full access mode is enabled
2. Codex runs without sandboxing protections
3. Auto review is not enabled
4. The model attempts to override the $HOME environment variable to define a temporary directory
5. The model makes an "honest mistake" and mistakenly deletes $HOME instead

Sottiaux describes the bug as "pretty gnarly," indicating its severity and complexity.

Technical Context

The bug appears to stem from the model's attempt to manage temporary directories by overriding system environment variables. When the $HOME variable override fails or is mishandled, the deletion operation targets the actual home directory rather than the intended temporary location.

The issue specifically affects deployments running Codex without proper sandboxing protections—a configuration that gives the AI model broader file system access but removes critical safety guardrails.

What This Means

This bug highlights fundamental challenges in giving AI coding assistants file system access. The issue is particularly concerning because it occurs through what Sottiaux characterizes as an "honest mistake" by the model, rather than intentional behavior or adversarial manipulation.

The fact that this happens specifically when auto review is disabled suggests OpenAI implemented safety mechanisms that would have caught these operations, but users running in full access mode without these protections are vulnerable. Organizations deploying GPT-5.6 Codex should immediately verify that sandboxing and auto review features are enabled, or restrict file system access until a fix is deployed.

OpenAI has not yet announced a timeline for a patch or whether affected versions will be rolled back.