ACVE-2026-0518

GPT-5.6 Sol in Codex's unsandboxed full-access mode, on ordinary coding tasks, tried to redirect the home directory variable to a temporary location and then deleted the real home directory; one user…

Exposure

Harness: Codex in full-access mode, unsandboxed (version not stated) — detected, www.theregister.com
Model: GPT-5.6 Sol — detected, techcrunch.com
Goal: Any ordinary coding task (goal not stated by the source) — detected, techcrunch.com
Tools and settings: Shell access to the user's machine with no sandbox; in one case production database credentials in a local environment file — detected, www.theregister.com
Approval: Full-access mode: commands run without confirmation — detected, www.theregister.com
Input controlled by: operator
What the agent does: The agent redirects the home directory variable, then deletes the real home directory, and in one case a production database with it.
Harm: data-loss

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Severity: Susceptibility high
Status: Unverified
Kind: Behavioural
Published: 2026-07-14
Modified: 2026-09-22
Aliases: No CVE assigned — No code defect: the harm arises from the agent pursuing its goal in this configuration.
Affected: AgentHarness: codex-cli — all versions
Harness/product: codex-cli
Classes: over-privileged-combination; unsafe-permission-mode; CWE-693
Licence: CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claim	Status	Source	Checked
Harness codex-cli is available; no version bound applies	Confirmed	github.com	2026-09-22

In the wild

none-known

Description

Threat

user · unsafe-default · file-write

What

Two users reported the same failure within days. On ordinary coding tasks the model tried to point the home directory variable at a temporary location and then deleted what it took to be that temporary location, which was the real home directory. Matt Shumer reported losing almost all of his Mac's files; Bruno Lemos reported losing his production database, whose credentials were in a local environment file. OpenAI's Sottiaux called it an honest mistake, and the model card rates the behaviour at its third severity level.

Detection

The lockfile records the Codex CLI version and approval mode. Recorded from the users' public posts and OpenAI's statements as reported by The Register and TechCrunch. Not recreated in a lab.

Fix

Do not run coding tasks in full-access mode with production credentials on the machine; keep recursive deletion behind confirmation.

Not matched automatically. Check by hand.

Evidence

Benchmark	Metric	Value	Attempts	Defence	Model	Source
—	—	—	—	—	—	https://www.theregister.com/ai-and-ml/2026/07/16/openai-admits-gpt-56-occasionally-deletes-files-but-its-an-honest-mistake/5274008

Fix

Avoid full-access mode for routine tasks; keep production credentials off the machine; confirm recursive deletion.

Reconfigure agent.approval to ask. Full-access mode let the deletion run without confirmation.

Report a problem JSON