A Codex subagent's malformed rmdir command escaped a __pycache__ cleanup and wiped roughly two weeks of work across two project directories on drive E: (GitHub #40329)

prefix_rule(pattern = ["rm", ["-r", "-rf", "-fr", "-R"]], decision = "prompt", justification = "Recursive delete: confirm the target first")

{
  "permissions": {
    "ask": [
      "Bash(rm -r*)",
      "Bash(rm -fr*)",
      "Bash(rm -R*)",
      "Bash(find * -delete*)",
      "PowerShell(Remove-Item *)",
      "Bash(cmd /c rmdir *)",
      "Bash(cmd /c del *)"
    ]
  }
}

[[rule]]
toolName = "run_shell_command"
commandPrefix = ["rm -r", "rm -fr", "rm -R"]
decision = "ask_user"
priority = 100
denyMessage = "Destructive command: needs a human to confirm (stupidllm.com)"

copilot --deny-tool='shell(rm)'

1. Instruction given

   Not fully disclosed. The user was running a multi-step "Codex Heavy-route goal" on Windows, and a Codex subagent was working toward it when it decided to remove a stray `__pycache__` directory as routine cleanup.

2. Expected behavior

   The cleanup command should have been scoped and quoted so it only removed the intended `__pycache__` directory, never traversing above the project folder it was working in.

3. Actual behavior

   Due to incorrect quoting, the Windows `rmdir` command the subagent ran escaped to the root of drive E:\ and recursively deleted accessible contents from E:\Main_Projects and E:\Projects. The command ran from 23:07:43 to 23:18:44 Europe/Bucharest on August 23, 2026.

4. Damage

   Approximately two weeks of work across multiple projects on drive E: was permanently deleted, bypassing the Recycle Bin. The user backed the report with a session log identifier and its SHA-256 hash, then requested account credits, a refund, a usage reset, and formal documentation from OpenAI. As of publication the issue remained open with no visible maintainer response or compensation granted.

Classification

Agent

Codex

Failure mode

Destructive Action

Root cause

Tool Misuse

Domain

Other

OWASP Agentic Top 10 (our mapping)

ASI02 Tool Misuse and Exploitation list

MIT AI Risk Repository (our mapping)

7.3 Lack of capability or robustness taxonomy

Source

Github Issue

StupidLLM. "STUPID-2026-0115: A Codex subagent's malformed rmdir command escaped a __pycache__ cleanup and wiped roughly two weeks of work across two project directories on drive E: (GitHub #40329)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0115/ (accessed 2026-11-06). CC BY 4.0.

← STUPID-2026-0114By IDSTUPID-2026-0116 →