Quoting Thibault Sottiaux
Simon Willison's Weblog Simon Willison ● Covered by 5 sources
OpenAI's Codex tool sometimes deletes your whole home folder when run in unrestricted mode. The bug happens when the AI tries to redirect a temp folder and nukes $HOME by mistake instead.
Based on reporting by Simon Willison's Weblog, Simon Willison — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Thibault Sottiaux's admission reads like the kind of postmortem nobody wants to write. Codex, OpenAI's coding agent now paired with GPT-5.6, has been quietly wiping out files on a subset of user machines, and the company has finally pinned down why.
The pattern is specific enough to be almost reassuring, if you squint. It only shows up when someone runs Codex in full access mode with sandboxing turned off, including skipping auto review. In that configuration, the model sometimes tries to redefine the $HOME environment variable to point at a temporary directory of its own choosing. That's already a strange move for an AI coding assistant to make on its own. But the real damage happens when it botches the operation and deletes the actual $HOME directory instead of the temp one it meant to create.
Sottiaux frames it as an honest mistake rather than anything adversarial, and there's no indication this was some emergent scheming behavior. It's closer to a classic software bug: a model attempting a filesystem operation it doesn't fully control, in an environment with none of the guardrails that would normally catch a slip like this. Remove sandboxing and auto review, and you've removed the safety net that would have stopped a model's bad judgment from becoming a user's bad day.
What makes this notable isn't the existence of a bug. Every coding tool has bugs. It's that the failure mode sits exactly where AI agent safety conversations keep landing lately, on the gap between an agent operating in a sandbox and an agent given real, unsupervised access to a real filesystem. Full access mode exists because developers want speed and don't want to babysit every action. This is the tradeoff showing its teeth.
My take — AI-written commentary, not fact-checked reporting
This is the entire agentic-AI safety debate compressed into one bug report: give a model real permissions and skip the guardrails, and eventually it deletes your home directory instead of a temp folder. Nobody should be shocked. Full access mode without sandboxing is basically handing car keys to someone who's driven exactly zero times before, and calling the inevitable fender-bender an 'honest mistake' doesn't make it less predictable.
Read more about this at: Simon Willison's Weblog
