OpenAI Codex running GPT-5.6-Sol deleted roughly 221 GB from a developer's home directory across several concurrent auto-approved sessions, with no sandbox denial logged for whatever performed the deletion (GitHub #42875)

1. Instruction given

   Not disclosed precisely — the user had several codex-cli sessions running concurrently on a Mac Studio: two `codex exec` review sessions performing git operations and tests, four interactive GPT-5.6-Sol terminal sessions launched with `codex --approve-for-me`, and one Codex Desktop session with auto-approved escalations. No single command that caused the deletion was captured.

2. Expected behavior

   Auto-approved or sandboxed agent sessions should never be able to delete data outside their intended working scope — user repositories, shell configuration, Docker data directories, and CI runner state should remain untouched regardless of which of several concurrently running sessions issued a command, and any file-write-unlink outside a sandboxed session should be denied and logged.

3. Actual behavior

   Between 04:27 and 04:47 UTC on September 4, 2026, roughly 221 GB was permanently deleted (bypassing Trash) from the user's home directory on macOS 26.6.2 while the six codex-cli/Codex Desktop sessions described above were active, running codex-cli 0.153.0 with GPT-5.6-Sol at model_reasoning_effort=xhigh. Deleted paths included the user's ~/code/jin and ~/code/reference repositories, configuration directories (~/.nvm, ~/.local, ~/.config, ~/.claude, ~/.agents), shell configuration and history files (~/.zshrc, ~/.zprofile, ~/.zsh_history), three GitHub self-hosted runners, production and UAT Docker stack data directories, and system temp directories. ~/Library, ~/.ssh, ~/.aws, ~/.codex, Documents, and Downloads survived. The user found no sandbox file-write-unlink denial logged in macOS's own logs for whatever process performed the deletion, which they read as evidence the deleting process had unsandboxed filesystem access.

4. Damage

   Unpushed commits, production and UAT Docker stack data, three CI runners, Terraform state, and roughly 2.5 months of project run data and session transcripts were lost. The reporter requested OpenAI support (case 14410909) pull server-side records to determine whether a command executed outside the sandbox after auto-approval, and noted the pattern matched a failure mode they had seen reported before with GPT-5.6-Sol and temp directory handling. As of publication there is no maintainer response, no confirmed root cause, and no independent reproduction.

Classification

Agent

GPT-5.6-Sol

Failure mode

Destructive Action

Root cause

Tool Misuse

Domain

Infra

Source

Github Issue