A tech investor lost nearly all the files on his Mac. A software engineer lost his entire production database. In both cases, what deleted them was the artificial intelligence that was there to help write code.
OpenAI confirmed the incidents and, in recent weeks, published the fixes. The person responsible for Codex publicly detailed what they found. It's worth knowing the full story, because it's less about AI running amok and more about a setting that a lot of people turn on without thinking.
What exactly was happening
The most serious pattern was prosaic: a command meant to clean up temporary files ended up deleting the user's files.
The technical explanation fits in one sentence. When creating a temporary folder to work in, the model reused a system variable — $HOME, which points to the user's personal folder. When it came time to clean up the mess, the malformed command targeted the actual home directory, not the temporary folder.
There were also cases where the model tried to delete or overwrite a path without first checking what already existed there.
Translating this into the physical world: it's like asking someone to throw out the box of drafts and the person hauls off the entire office file cabinet, because both were labeled with the same name.
The condition no one should skip
Here's the part that changes how you read the case. According to the published investigation, the reported incidents occurred exclusively when the user had, at the same time:
- full access mode enabled,
- the sandbox turned off,
- and automatic review disabled.
In other words: the three safeguards existed, and the damage required all three to be turned off at once. This wasn't an AI breaking through a barrier — it was a tool operating exactly as configured, in a mode designed for advanced automation in a trusted environment.
It's the same lesson that came up when OpenAI paused its own training after a model escaped the lab: the safeguard existed and wasn't applied. Except that in that case, it was the company that didn't turn on the monitor; in this one, it's the user turning it off for convenience.
The uncomfortable detail
There's a detail worth noting, one that reporting on the case raised: the pre-launch evaluation had already flagged a significant increase in destructive behavior in this model — a spike reported as being several times higher than the previous one. The launch happened anyway, on July 9, 2026.
This isn't an accusation of bad faith: an evaluation signal is probabilistic, and no product ships with zero risk. But it helps calibrate the expectations of whoever uses it. If the vendor saw the signal and launched anyway, whoever installs it shouldn't assume "everything's been tested."
What OpenAI changed
- Codex is now instructed to verify the target before deleting, create new temporary folders, avoid reusing system variables, prefer recoverable actions, and stop when the scope isn't clear.
- Execution checks became stricter for high-risk deletion commands, which now go through review; if the command is rejected, the model is guided toward a safer path.
- Full access mode became harder to turn on by accident, with clearer warnings and restrictions on the riskiest permission combinations.
- Destructive actions are now filtered out of training data, and evaluations were created that reproduce the observed failures.
What to do at your company
The first two recommendations come from OpenAI itself; the rest apply to any agent that executes commands:
- Use approval mode. "Ask for approval" or equivalent. Full access only in an environment you trust and can recover.
- Keep the tool updated, because the safeguards arrive via updates.
- Never point an agent at production. A production database is not a place to test — that's exactly what one of the cases cost.
- Have a backup you've already tested restoring. A backup that's never been verified is hope, not a backup.
- Prefer a disposable environment. If the worst happens, you recreate the machine instead of recovering your life.
- Treat "full access" as a decision, not a checkbox. Every time someone turns off a safeguard to go faster, they're trading risk for minutes.
The honest summary
Neither case indicates AI acting with intent. What happened was an execution error in a mundane cleanup task — and that's precisely why the case matters: harm by mistake is far more likely than harm by malice, and almost no one prepares for the former.
The tool that writes code for you executes commands on your computer. That's what makes it useful, and it's what makes it capable of deleting what you didn't ask it to delete.
Facts gathered from the public statement by the person responsible for Codex at OpenAI, in August 2026, and from coverage by The Register, TechCrunch, and security publications. The reports of file loss are from publicly identified users.
Perguntas frequentes
What happened with OpenAI's Codex deleting files?
Cases were confirmed in which the model took destructive actions beyond what the user asked for. The most serious pattern was a command meant to clean up temporary files that ended up deleting the user's own files. Publicly, a technology investor reported losing nearly all files on his Mac and a software engineer reported losing an entire production database.
What was the technical cause?
While creating a temporary working folder, the model reused the system variable $HOME, which points to the user's personal folder. At cleanup time, a malformed command targeted the real home directory instead of the temporary folder. There were also cases where the model deleted or overwrote a path without first checking what was already there.
Does this happen with any configuration?
No. According to published reporting, the incidents occurred exclusively when the user had full-access mode enabled, sandboxing switched off and auto-review disabled — all three protections off at once. It was not AI breaking through a barrier, but the tool operating exactly as configured, in a mode meant for advanced automation in trusted environments.
What did OpenAI change after these cases?
Codex is now instructed to check the target before deleting, create fresh temporary directories, avoid repurposing system variables, prefer recoverable actions and stop when scope is unclear. Execution checks for high-risk deletion commands were tightened, full-access mode became harder to enable by accident, destructive actions are filtered from training data, and evaluations replaying the observed failures were built.
How do I use a coding AI safely in my company?
Use approval mode rather than full access, and reserve full access for environments you trust and can restore. Keep the tool updated, because protections arrive through updates. Never point an agent at production. Keep a backup you have actually tested restoring. And prefer disposable environments, where the worst case is rebuilding the machine.
Did the AI do it on purpose?
There is no indication of that. It was an execution error in a mundane temporary-file cleanup task. And that is exactly why the case matters: damage by mistake is far more likely than damage by malice, and almost nobody prepares for the former. The tool that writes code runs commands on your machine — that is what makes it useful, and what makes it capable of deleting what you never asked it to.