Codex Coding Agent Unsandboxed $HOME Deletion Bug
First seen Jul 16, 2026 · Updated Jul 16, 2026
Reports indicate that OpenAI's Codex coding agent (referenced as GPT-5.6) can unexpectedly delete a user's entire $HOME directory when run in 'full access mode' without sandboxing or auto-review safeguards. The root cause is the model attempting to override the $HOME environment variable to create a temporary directory and mistakenly deleting the real $HOME instead. This is an unintentional agent malfunction rather than a malicious attack, but it demonstrates severe real-world consequences of granting autonomous coding agents unsandboxed filesystem access.
Technical Analysis
The Codex agent, when operated in full access mode without sandboxing or auto-review enabled, attempts to set a temporary working directory by manipulating the $HOME environment variable. Due to a flaw in this logic, the agent's subsequent file deletion operations target the actual $HOME directory rather than the intended temporary path, resulting in destructive, irreversible deletion of user files. The entry point is the agent's own tool-execution layer (shell/file operations) combined with a lack of enforced sandbox boundaries, meaning there is no isolation layer to catch or contain the erroneous destructive command. While not exploited by an external attacker, the same class of unsandboxed tool-execution flaw could be leveraged by prompt injection or malicious instructions to trigger similar destructive actions deliberately, elevating this from an operational bug to a security-relevant design weakness.
Affected Systems
OpenAI Codex
Detection Signatures
- Log entries showing HOME environment variable reassignment followed by recursive delete/rm operations
- File system audit logs showing mass deletion under $HOME shortly after agent invocation with 'full access mode'
- Agent execution logs missing sandbox or auto-review confirmation flags prior to destructive filesystem calls
- Unexpected rm -rf or equivalent bulk deletion commands issued by coding agent process without user-confirmed path scoping
Remediation Steps
- 1
Enforce sandboxing by default
Require sandbox isolation for all coding agent file operations; disallow full access mode without explicit, scoped user confirmation.
- 2
Enable auto-review for destructive operations
Mandate automated or human review gates before any delete/move operations affecting directories outside an explicitly scoped temp path.
- 3
Validate environment variable overrides
Add guardrails preventing agents from redefining critical environment variables like $HOME without strict validation and confirmation.
- 4
Implement path allow-listing
Restrict agent file deletion capabilities to an explicit allow-list of temporary/project directories, never resolving to user home or system directories.
- 5
Add pre-deletion safety checks
Require confirmation dialogs or dry-run previews before executing recursive or bulk deletion commands in agentic coding tools.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.