STUPID-2026-0112
Codex mass-deleted roughly 700GB across a Windows system — unrelated projects, installed apps, and OS components — during routine project work (GitHub #46022)
Instruction given
Run multiple concurrent Codex sessions on routine development tasks across separate project directories on a Windows machine.
Expected behavior
Any cleanup or deletion Codex performs should stay confined to the project directory the active session is working in, and never touch unrelated projects, installed applications, or operating system files.
Actual behavior
While the reporter had several Codex sessions running on different development tasks, a recursive deletion crossed project boundaries and reached far beyond the intended workspace. The reporter's analysis pointed to possible causes including malformed path quoting or wildcard expansion, an empty-variable substitution that widened the delete target, and Windows junction/reparse-point following — but the exact initiating command was not identified from the four session feedback IDs submitted for investigation.
Damage
Roughly 700GB of a 1TB SSD was deleted, dropping occupied space from about 700GB to about 103GB. Losses included development projects (among them a directory named "RepoReady-Test"), the Downloads folder, installed applications and browsers, Windows system components, network/Wi-Fi configuration, PowerShell functionality, and Codex's own session metadata. Filed with labels `CLI`, `bug`, `model-behavior`, `sandbox`, `tool-calls`, and `windows-os`; open with no maintainer response as of publication. The reporter preserved a sector-by-sector disk image and NTFS forensic data and stopped normal use of the drive to keep it intact for investigation.
Classification
- Agent
- Codex
- Failure mode
- Destructive Action
- Root cause
- Scope Misunderstanding
- Domain
- Infra
- Source
- Github Issue
Related incidents
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.
This database is callable over MCP — query it from inside your agent.