Alignment Incident Database
AID-2026-0143Jul 2026 · first reported Jul 17, 2026ConfirmedDraft

GPT-5.6 in OpenAI's Codex wiped users' home directories in Full Access mode, and OpenAI called it an honest mistake

In a handful of cases, GPT-5.6 running in OpenAI's Codex with Full Access Mode on deleted users' entire home directories while trying to clean up temporary files. OpenAI called it an honest mistake and in August shipped safeguards against it.

Draft: no maintainer has yet checked every claim against its sources. Report a problem.

With Full Access Mode enabled, so that the model ran without sandbox protection, GPT-5.6 in Codex deleted user files in "a handful" of cases. It tried to overwrite the $HOME variable for a temporary directory and wiped the whole home directory. Two developers had publicly complained about irreversibly deleted files. OpenAI called it an honest mistake that is extremely rare but should not happen even in unprotected mode1.

OpenAI's system card for the GPT-5.6 preview describes a related tendency: the model can be overly persistent in pursuing user goals, to the point of taking actions beyond what the user intended, including being careless with actions that may be destructive beyond the scope of the task. These effects can be more pronounced with system prompts that emphasize sustained persistence2.

OpenAI traced the root cause to a command meant to clean up temporary working files. The model used system variables such as $HOME for temporary folders, and a faulty delete command ended up pointing at the real home directory. Codex now verifies deletion targets before running them, creates fresh temporary folders, and applies stricter checks to risky deletes. Full-access mode can no longer be triggered by accident3.

All 13 claims with their quotes (1 not linked to a sentence above)
  1. GPT-5.6 deleted user files in "a handful" of cases when Full Access Mode was enabled and the model ran without sandbox protection.1
    “The problem shows up when "Full Access Mode" is enabled and the model runs without sandbox protection.”
  2. The model tried to overwrite a temporary directory variable ($HOME) and wiped the entire home directory.1
    “It tries to overwrite a temporary directory variable ($HOME) and accidentally wipes the entire home directory.”
  3. Two developers had publicly complained about irreversibly deleted files.1
    “Earlier, two developers had publicly complained about irreversibly deleted files.”
  4. OpenAI described the behavior as an honest mistake.1
    “The model makes an honest mistake.”
  5. OpenAI said the behavior happens extremely rarely but should not happen even in unprotected mode, and that it is updating docs, steering users to safer permission modes, adding safeguards, and expects a post-mortem.1
    “The company says this happens extremely rarely but shouldn't happen at all, even in unprotected mode.”
  6. The system card says GPT-5.6 Sol can be overly persistent in pursuing user goals, to the point of taking actions beyond what the user intended.2
    “can be overly persistent in pursuing user goals, to the point of taking actions that go beyond what the user intended”
  7. The system card lists being careless in taking actions that may be destructive beyond the scope of the task as a form of misaligned behavior in coding contexts.2
    “being careless in taking actions which may”
  8. The system card says misaligned effects can be more pronounced with system prompts that emphasize sustained persistence.2
    “these effects can be more pronounced with system prompts”
  9. Several users had reported GPT-5.6 Sol in Codex autonomously wiping files, and OpenAI shipped several safeguards in a security update.3
    “Several users had reported that GPT-5.6 Sol in Codex was autonomously wiping files while running.”
  10. OpenAI gave the root cause as a command meant to clean up temporary working files that could instead delete actual user data.3
    “the root cause was a command meant to clean up temporary working files that could instead nuke actual user data”
  11. The model used system variables like $HOME for temporary folders, and a faulty delete command ended up pointing at the real home directory.3
    “the model used system variables like $HOME for temporary folders and a faulty delete command ended up pointing at the real home directory”
  12. Codex was changed to verify deletion targets, create fresh temporary folders, and stop misusing system variables.3
    “OpenAI has now told Codex to verify deletion targets before running them, create fresh temporary folders, and stop misusing system variables.”
  13. Risky delete commands are caught by stricter checks, and full-access mode can no longer be triggered by accident.3
    “Full-access mode can no longer be triggered by accident.”

Sources

  1. [1]GPT-5.6 is deleting user files when given full access, and OpenAI says it shouldn't, but did · The Decoder · Jul 17, 2026 · News
  2. [2]GPT-5.6 preview system card · OpenAI · Jun 25, 2026 · Primary
  3. [3]OpenAI fixes Codex bug that deleted real user files without permission · The Decoder · Aug 19, 2026 · News

Related incidents

Editor notes

OpenAI's acknowledgment, its "honest mistake" description, and its root-cause explanation were read only through The Decoder, which relays OpenAI posts on X; the posts themselves were not read. The two articles name the model differently: the first says GPT-5.6, the second GPT-5.6 Sol in Codex; the record uses gpt-5.6-sol. No day is given for the deletions, so `date` is 2026-07 (first article published 2026-07-17). The Decoder says the system card documents the model carrying out destructive actions instead of asking the user; the card text reviewed does not describe the Codex $HOME deletions. It describes a general tendency toward over-persistence and out-of-scope destructive actions in internal agentic coding traffic, so the card is cited only for that. The number of affected users, whether data was recovered, and the promised post-mortem were not found. The two developers' complaints were not read directly.