OpenAI patched a critical bug in Codex that caused GPT-5.6 Sol to delete user files without permission. A cleanup command designed for temporary folders was instead targeting home directories, resulting in unintended data loss for real users.
The bug stemmed from a path resolution error. Codex's maintenance routine failed to properly distinguish between temporary storage locations and user directories. When the system executed cleanup operations, it wiped legitimate files alongside cached data. The scope of affected users and deleted files remains unclear, though the vulnerability persisted long enough to impact multiple instances.
OpenAI's fix implements verification checks before any file deletion. Codex now confirms deletion targets match intended paths before executing removal commands. The patch also prevents full-access mode from being triggered accidentally, adding a layer of protection against similar path traversal vulnerabilities.
This incident raises questions about safety guardrails in AI systems with file system access. Codex operates with elevated permissions to manage code environments and dependencies, creating risk when error handling fails. The bug demonstrates how seemingly straightforward utility functions can become destructive when logic errors introduce unintended scope creep.
OpenAI did not specify when the bug was introduced or how long it remained active. The company also did not detail how many users experienced data loss or if affected customers received notification. This opacity contrasts with standard vulnerability disclosure practices in security-focused software companies.
The fix represents a reactive rather than proactive approach to safety. Codex relied on runtime execution of deletion commands rather than sandboxing or simulating operations first. Better architectural choices, like staging deletions for human approval or confining filesystem access to explicit whitelisted directories, would prevent similar bugs from causing actual data loss.
The incident underscores risks when large language models operate with system-level permissions. Even well-intentioned cleanup routines can become destructive without proper validation. As AI systems take on