OpenAI Fixes Codex Bug That Deleted User Files Without Consent

What happened

OpenAI has patched a bug in its Codex coding assistant that caused the tool to delete real user files without permission. The fault was traced to the GPT-5.6 Sol model, which triggered a cleanup routine intended only for temporary directories but instead executed against users' home directories, wiping genuine data.

According to The Decoder, OpenAI has since updated Codex so that any deletion command now verifies its target before executing, preventing the tool from acting on directories outside its intended scope. The company has also closed off the pathway that allowed Codex's full-access mode to be triggered unintentionally, removing a key condition that made the original incident possible.

Why it matters

As AI coding assistants move from autocomplete tools to agents capable of executing file operations, tests and deployments on a developer's behalf, the margin for error narrows sharply. A model that can delete files is also a model that can delete the wrong files — and the consequences of an ambiguous instruction are no longer cosmetic, they are irreversible.

This episode is a reminder that agentic AI systems need guardrails calibrated to the severity of the action they can take, not just to the sophistication of the model behind them. For organisations piloting AI coding agents or other autonomous tooling, it underlines the importance of scoped permissions, target verification and clearly bounded "full-access" modes as standard design requirements rather than after-the-fact fixes.

The Renascence take

The interesting part of this story isn't the bug — it's what the bug reveals about how AI agents are being trusted with irreversible actions long before their safety architecture has caught up with their capability.

Most organisations evaluate AI agents on what they can do, not on what happens when they misread intent. A cleanup command that quietly escalates from "clear the temp folder" to "clear the home directory" is a classic behavioral-design failure: the system had no checkpoint between deciding an action and executing it. The fix here — verify the target before acting, and make destructive modes hard to trigger by accident — is the same principle that underpins good service design for humans: build friction deliberately around high-consequence actions, and never let convenience quietly expand into irreversible authority. Any team deploying agentic AI, whether in code, customer service or operations, should be asking not "can it do this task well?" but "what does it do when it's wrong, and who finds out first?"