Head to head
Codex vs Lovable
Comparing 5 documented Codex incidents against 3 for Lovable.
What these records show
Codex has the lower average severity among the incidents collected here (6.6 vs 8.7 for Codex and Lovable, from 5 and 3 incidents). These records can't establish which agent is safer: counts reflect how widely each is used and how often people report failures, not a failure rate.
| Metric | Codex | Lovable |
|---|---|---|
| Documented incidents | 5 | 3 |
| Average severity | 6.6 | 8.7 |
| Critical | 0 | 2 |
| High | 3 | 1 |
| Source checked | 4 | 1 |
Severity at a glance
Failure modes
The incidents behind these numbers
Codex
7.0Codex mass-deleted roughly 700GB across a Windows system — unrelated projects, installed apps, and OS components — during routine project work (GitHub #46022)7.0A Codex subagent's malformed rmdir command escaped a __pycache__ cleanup and wiped roughly two weeks of work across two project directories on drive E: (GitHub #40329)7.0OpenAI Codex wiped an entire hard drive after being asked to delete one old backup file (GitHub #11006)6.0OpenAI Codex deleted important project files with no explicit request or confirmation, exact command never captured (GitHub #38312)6.0OpenAI Codex ran "rm -rf *" and deleted an entire project after the user pressured it to stop pausing for safety checks (GitHub #6801)
Lovable
9.0A broken object-level authorization bug let any free Lovable account pull other users' source code, Supabase credentials and AI chat histories for 48 days before Lovable fixed it9.0Lovable-generated apps shipped without adequate Supabase row-level security, leaving databases readable and writable by anyone (CVE-2025-48757)8.0A security researcher found 16 vulnerabilities — including inverted access-control logic — in a Lovable-generated EdTech app, exposing 18,697 users' records and letting anyone delete accounts or grade exams