STUPID-2026-0161
Codex treated its own logged safety-instruction text as shell input during a session audit, executing an embedded destructive-command example and deleting `.codex`/`.claude` symlinks in a user's Windows HOME directory (GitHub #36937)
Why 4/10
The rm-style command that fired targeted the effective HOME directory, but the only damage the reporter could actually confirm was two symlink entries (.codex, .claude) being removed; their real contents, on a separate drive, survived because the delete never traversed the symlinks. No maintainer has confirmed a fuller mechanism or ruled out further loss, so this is scored to what the forensic record actually shows rather than to the issue's more dramatic title.
- Scope
- 1/4
- A few files, one session, one credential, or a small cost
- Recoverability
- 1/3
- Fully recovered, with effort
- Did it happen
- 2/2
- Happened in real use
- Beyond the user
- 0/1
- Only the user's own non-production work
The score is the sum of these four factors. How each factor is scored · scored 2026-11-10
Instruction given
The user asked Codex CLI (danger-full-access mode, approval policy "never", Windows 10 via Git Bash) to audit its own older sessions — a review task, with no instruction to delete, execute, or modify anything.
Expected behavior
A stored rollout/session JSONL file is untrusted data describing a past conversation, never an executable program or shell input. Logged safety-instruction examples inside it — meant only to illustrate commands the model must refuse to run — should never reach a shell in any form, and a recursive delete should never be allowed to resolve to the user's HOME directory regardless of sandbox mode.
Actual behavior
While auditing an old session, Codex passed that session's rollout JSONL file path into the program position of a Bash login-shell invocation. Git Bash read the file's contents as shell input rather than as data, and interpreted a backtick-quoted example sitting inside the file's own saved safety-instruction text as a command substitution. That example was one of the model's bundled prohibition examples — a destructive recursive-delete pattern included only to show what must be refused — and it executed for real instead, targeting the effective HOME directory ($HOME resolving to C:\Users\<redacted>). The command's failure status was ignored and its stderr discarded, so nothing surfaced the problem at the time.
Damage
The reporter's own forensic reconstruction (full process auditing and Sysmon were off, so no complete trace exists) confirms the `.codex` and `.claude` symlink entries inside HOME were deleted; their real contents, stored on a separate D: drive, survived because the delete did not traverse the symlinks' targets. Filed August 4, 2026, the issue remains open with no maintainer response beyond automatic labeling, and cites five earlier related issues (#27131, #33624, #32684, #33557, #18509). On September 18, 2026 a non-maintainer contributor posted a proposed defense-in-depth fix — blocking session/archived-session paths from being run as programs or passed into a shell's -c/-lc — but it has not landed upstream. The reporter states they did not attempt a destructive reproduction and instead proposed a safe synthetic-fixture test.
Full write-up
On August 4, 2026, a Codex CLI user on Windows 10 (CLI 0.146.0, model gpt-5.6-sol, running in danger-full-access mode with approval policy never, via Git Bash) filed GitHub issue #36937 after asking Codex to audit its own earlier sessions and watching the audit itself turn destructive.
Codex's audit step passed the path of an old session's rollout JSONL file into the program position of a Bash login-shell command. Rather than reading the file as data, Git Bash treated it as shell input — and a backtick-quoted line buried inside the file's own saved safety-instruction text was interpreted as a command substitution and executed. That line was one of the model's bundled examples of a command it must refuse to run: a recursive delete pattern meant purely as documentation of what *not* to do. Executed for real, it targeted the effective HOME directory, with the command's exit status ignored and its stderr thrown away, so nothing in the session surfaced that anything had gone wrong.
The reporter's own forensic reconstruction — hampered by auditing and Sysmon both being off, so no full process trace survives — could confirm one piece of concrete damage: the .codex and .claude symlink entries inside HOME were deleted. Their actual contents, kept on a separate D: drive, survived only because the delete never followed the symlinks to their targets. The issue explicitly lists five earlier, related reports (#27131, #33624, #32684, #33557, #18509), suggesting this is a recurring failure class rather than a one-off. It remains open four months later with no maintainer response beyond automatic labeling; a non-maintainer posted a proposed fix — rejecting session-file paths used as programs or fed into a shell's -c/-lc — on September 18, 2026, but it has not been merged. The reporter did not attempt to reproduce the deletion itself, proposing instead a non-destructive synthetic-fixture test.
What makes this case distinct from a plain accidental rm -rf $HOME is the mechanism: the agent didn't run a dangerous command a user typed, it ran a *documentation example of a command it was told never to run*, because a log file containing that example was fed to a shell as if it were a program. The text that was supposed to be the safeguard was the payload.
Classification
- Agent
- Codex
- Failure mode
- Destructive Action
- Root cause
- Tool Misuse
- Domain
- Infra
- Language
- Bash
- OWASP Agentic Top 10 (our mapping)
- ASI02 Tool Misuse and Exploitation · ASI05 Unexpected Code Execution (RCE) list
- MIT AI Risk Repository (our mapping)
- 7.3 Lack of capability or robustness taxonomy
- Source
- Github Issue
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0161: Codex treated its own logged safety-instruction text as shell input during a session audit, executing an embedded destructive-command example and deleting `.codex`/`.claude` symlinks in a user's Windows HOME directory (GitHub #36937)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0161/ (accessed 2026-11-10). CC BY 4.0.
← STUPID-2026-0160By ID
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.