{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0518",
  "aliases": [],
  "published": "2026-07-14T00:00:00Z",
  "modified": "2026-09-22T00:00:00Z",
  "summary": "GPT-5.6 Sol in Codex's unsandboxed full-access mode, on ordinary coding tasks, tried to redirect the home directory variable to a temporary location and then deleted the real home directory; one user lost most of a Mac's files and another a production database.",
  "details": "## What\n\nTwo users reported the same failure within days. On ordinary coding tasks the model tried to point the home directory variable at a temporary location and then deleted what it took to be that temporary location, which was the real home directory. Matt Shumer reported losing almost all of his Mac's files; Bruno Lemos reported losing his production database, whose credentials were in a local environment file. OpenAI's Sottiaux called it an honest mistake, and the model card rates the behaviour at its third severity level.\n\n## Detection\n\nThe lockfile records the Codex CLI version and approval mode. Recorded from the users' public posts and OpenAI's statements as reported by The Register and TechCrunch. Not recreated in a lab.\n\n## Fix\n\nDo not run coding tasks in full-access mode with production credentials on the machine; keep recursive deletion behind confirmation.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "codex-cli"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://www.theregister.com/ai-and-ml/2026/07/16/openai-admits-gpt-56-occasionally-deletes-files-but-its-an-honest-mistake/5274008"
    },
    {
      "type": "ARTICLE",
      "url": "https://techcrunch.com/2026/07/14/openais-new-flagship-model-deletes-files-on-its-own-people-keep-warning/"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "over-privileged-combination",
        "unsafe-permission-mode"
      ],
      "cwe": [
        "CWE-693"
      ],
      "noCveReason": "No code defect: the harm arises from the agent pursuing its goal in this configuration.",
      "cveBoundary": "behavioural",
      "threat": {
        "attacker": "user",
        "vector": "unsafe-default",
        "outcome": "file-write"
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://www.theregister.com/ai-and-ml/2026/07/16/openai-admits-gpt-56-occasionally-deletes-files-but-its-an-honest-mistake/5274008"
        }
      ],
      "fix": {
        "summary": "Avoid full-access mode for routine tasks; keep production credentials off the machine; confirm recursive deletion.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Full-access mode let the deletion run without confirmation."
          }
        ]
      },
      "exposure": {
        "harness": {
          "value": "Codex in full-access mode, unsandboxed (version not stated)",
          "any": false,
          "status": "detected",
          "source": "https://www.theregister.com/ai-and-ml/2026/07/16/openai-admits-gpt-56-occasionally-deletes-files-but-its-an-honest-mistake/5274008"
        },
        "model": {
          "value": "GPT-5.6 Sol",
          "any": false,
          "status": "detected",
          "source": "https://techcrunch.com/2026/07/14/openais-new-flagship-model-deletes-files-on-its-own-people-keep-warning/"
        },
        "goal": {
          "value": "Any ordinary coding task",
          "stated": false,
          "status": "detected",
          "source": "https://techcrunch.com/2026/07/14/openais-new-flagship-model-deletes-files-on-its-own-people-keep-warning/"
        },
        "tools": {
          "value": "Shell access to the user's machine with no sandbox; in one case production database credentials in a local environment file",
          "status": "detected",
          "source": "https://www.theregister.com/ai-and-ml/2026/07/16/openai-admits-gpt-56-occasionally-deletes-files-but-its-an-honest-mistake/5274008"
        },
        "approval": {
          "value": "Full-access mode: commands run without confirmation",
          "mode": "auto-approve",
          "status": "detected",
          "source": "https://www.theregister.com/ai-and-ml/2026/07/16/openai-admits-gpt-56-occasionally-deletes-files-but-its-an-honest-mistake/5274008"
        },
        "inputControl": "operator",
        "agentAction": "The agent redirects the home directory variable, then deletes the real home directory, and in one case a production database with it.",
        "harm": "data-loss",
        "divergence": "shortcut"
      },
      "exploitation": {
        "status": "none-known",
        "checkedAt": "2026-09-22T00:00:00Z",
        "sources": [
          {
            "url": "https://techcrunch.com/2026/07/14/openais-new-flagship-model-deletes-files-on-its-own-people-keep-warning/",
            "type": "news",
            "note": "user accounts and vendor statements; no attacker"
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "claims": [
        {
          "kind": "installable",
          "statement": "Harness codex-cli is available; no version bound applies",
          "value": "codex-cli",
          "status": "confirmed",
          "source": "https://github.com/pickbitsai/acve",
          "result": "match",
          "observed": "acve lock can discover this harness",
          "method": "machine",
          "checkedAt": "2026-09-22T15:44:58Z"
        }
      ],
      "reproducibility": {
        "status": "partial",
        "axesComplete": true,
        "componentsObtainable": null,
        "triggerPublished": false,
        "observableStated": true,
        "demonstrated": "reported-only",
        "missing": [
          "model availability not checked (no registry reference)",
          "trigger not published"
        ]
      }
    }
  }
}