# GPT-5.6 Codex: Understanding and Resolving Unexpected File Deletion Issues > Discover why GPT-5.6 Codex is deleting files and how to safeguard your data. > By Dave · 2026-07-17 > Source: https://otf-kit.dev/blog/gpt-5-6-codex-file-deletion GPT-5.6 in Codex is the most capable coding agent OpenAI has shipped. It holds long contexts, edits across files, and writes production-shaped diffs without hand-holding. That's the win. It also, in a "handful" of confirmed cases, deletes the user's home directory — the file-deletion issue OpenAI's own Head of Core Products flagged this week. That's the receipt. Tibo Sottiaux, OpenAI's Head of Core Products, [posted on X](https://www.neowin.net/news/gpt-56-codex-is-deleting-files-from-home-directories-in-a-handful-of-cases/) with the post-mortem-in-progress: when Codex runs in full-access mode without sandboxing and with auto review disabled, GPT-5.6 tries to override `$HOME` to point at a fresh temp directory — and instead deletes `$HOME` outright. On macOS and Linux, `$HOME` is your real home directory. So the model, in good faith, `rm -rf`'s your downloads, your dotfiles, your unfinished draft. The bug is rare. The blast radius is not. You don't have to stop using Codex to stay safe, and you don't have to give up its power to keep your files. ## What the bug actually is GPT-5.6, running inside Codex, has a specific failure mode. When you grant it full system access — the "I'll let it run anything" mode — Codex normally sandboxes the model's writes. Turn the sandbox off and disable auto review, and the model's filesystem calls go straight to your real machine. In that mode, GPT-5.6 occasionally tries to set `$HOME` to a fresh temp directory before running a shell command. The intent is reasonable: keep scratch work out of your actual home folder. The implementation, per Sottiaux, is an "honest mistake" — the override either fails to land or the shell that follows acts on the wrong path, and the cleanup step that was supposed to wipe the scratch directory instead wipes your real one. Three conditions have to line up for the bug to fire: 1. **Full-access mode** is on (the model can write anywhere). 2. **Sandboxing** is off (nothing intercepts the filesystem call). 3. **Auto review** is disabled (no human-in-the-loop checkpoint). Any one of those flipped and the model can't reach the path it's trying to delete. All three off, and you get a working `rm -rf $HOME`. ## Who's exposed The reporting is clear on the geography: `$HOME` is the user's main directory on macOS and Linux. Windows users aren't in the same risk profile because the variable doesn't point at the same path — but anyone running WSL, Git Bash, or any Unix-ish shell on Windows inherits the same behavior. A "handful" of cases sounds small until you are one of them. The bug nukes whatever sits at `$HOME`: `~/Documents`, `~/Downloads`, `~/.ssh`, `~/.config`, the dozen half-finished repos you didn't push yet. There's no recycle bin on Linux. There's no "are you sure" prompt the model can hear. By the time Codex reports success, the directory is gone. If you've been running Codex with full access "just to get past the friction," this is the friction you actually wanted. ## How to use Codex today without losing your home directory You don't need to stop. You need to flip one toggle and stop disabling two others. ```bash # Codex CLI — refuse full-access by default codex config set permission.mode sandboxed # Keep auto review on; it's the checkpoint that catches bad $HOME writes codex config set review.auto true # If you must use full-access, scope it to the repo, not the machine codex --workspace ./my-app --permission=full-access-local ``` Three rules that close the bug window: 1. **Stay on sandboxed mode by default.** Full-access is for specific tasks — debugging a build hook that needs system tools, running a migration script that touches `/etc`. Not for "I want it to stop asking." 2. **Leave auto review on.** It's the one checkpoint that runs before destructive shell calls. If you turned it off because it was noisy, fix the noise — don't remove the safety. 3. **Pin `$HOME` if you must run full-access.** Drop this in `~/.zshrc` or `~/.bashrc`: ```bash # Guard against Codex's $HOME override export HOME="$HOME" readonly HOME ``` `readonly` blocks the model's `export HOME=...` line. Belt-and-braces — the sandbox should catch it first, but the belt comes off less often than the braces do. If you're already in a session and want to verify nothing's gone, `ls -la ~ | wc -l` against a known-good baseline (your dotfiles count should be stable) is a fast sanity check. ![sandboxed mode vs full-access mode](https://cdn.otf-kit.dev/blog/gpt-5-6-codex-file-deletion/inline-1.png) ## What OpenAI is doing about it Sottiaux laid out three commitments on X: 1. **Updating the full-access development message** so the next time you toggle it, the warning text actually tells you what "full access" means in terms of blast radius. 2. **Guiding users to safer permission modes** — the in-product nudge toward sandboxed-by-default is getting louder. 3. **Adding "harness safeguards"** — internal checks that catch the `$HOME` override pattern before it lands on a real shell. A detailed post-mortem is promised "in the coming days." Until that ships, treat the official guidance as the source of truth. Don't trust third-party "Codex is fixed" claims you see in feeds — they almost always mean somebody patched the symptom and shipped it. ## The part that doesn't change when the model does Here's the angle that doesn't go away with the bug fix. Codex's value is in the diffs it produces, not in the files it stores. The files that matter — your repo, your components, your conventions — should not live in the agent's working directory. They should live in a repo with a structure the agent can read in 200 tokens and reason about deterministically. That's a durable layer. The model churns every quarter. The harness changes. The bug gets fixed and a new one ships in November. What stays is: - **A repo with a known shape.** Directories, naming, exports — all conventional, all documented in a `CLAUDE.md` or `AGENTS.md` the agent reads at session start. - **Components that work the same on web, iOS, and Android from one API.** If the model rewrites the button because it forgot what it shipped last week, you don't want three platforms to drift. You want one component definition the agent has to match. - **Permissions and access patterns that aren't tied to a model.** Sandbox config, `.gitignore` discipline, secrets in env not in code — those are durable regardless of whether you're running GPT-5.6, GPT-6, or a local 7B you fine-tuned on Saturday. Use Codex. Sandbox it. And build your app on a structure the agent can't accidentally nuke, because the agent doesn't own it — git does. GPT-5.6 in Codex is genuinely good. It's also capable of `rm -rf $HOME` in a narrow, well-understood set of conditions, and OpenAI has named those conditions publicly. Flip the sandbox on, leave auto review alone, and your home directory stays where it is. Everything else — the conventions, the cross-platform components, the structure that survives the next model release — is your job to keep stable, because the model won't.