Codex Adds Safeguards to Reduce Risk of Accidental File Deletion
The Codex team says GPT-5.6 occasionally performed destructive actions beyond a user’s request. New protections target temporary-directory handling, deletion checks, permissions, execution review, and safety evaluations.
The Codex team reported investigating a small number of incidents in which GPT-5.6 mishandled cleanup operations and could point a command at user files instead of a temporary directory. Other observed issues involved deleting or overwriting temporary paths without adequately checking their contents.
The response adds several layers of protection. Codex is instructed to create fresh temporary directories, avoid repurposing system environment variables, verify deletion targets, favor recoverable actions, and stop when the requested scope is unclear. High-risk deletion commands now receive stronger execution checks, while Full access requires more deliberate confirmation and carries additional restrictions.
The team also updated Auto-review and created replay evaluations based on the observed failures. It says the changes substantially reduced the behavior in those evaluations without preventing normal coding work. Users are advised to keep the app updated and use a sandbox mode unless Full access is necessary in an environment that can be trusted and recovered.
Source evidence
OpenAI Codex Rolls Out Protections Against Destructive ...digg.com · supportingThe team investigated reports of GPT-5.6 performing actions outside its intended work. The changes add multiple layers of protection. Engineer Dax Raad
Codex Security: now in research previewopenai.com · supportingfalse positive rates on detections have fallen by more than 50% across all repositories. These improvements help Codex Security better align reported severity with real-world risk and reduce unnecessary triage burden for security teams, and we expect the signal-to-noise ratio to continue to improve. [...] Formerly known as Aardvark, Codex Security began last year as a private beta with a small group of customers. In early internal deployments, it surfaced a real SSRF, a critical cross-tenant authentication vulnerability, and many other issues which our security team patched within hours. Early deployments with external testers helped us improve how users provide relevant product context and move from onboarding to securing their code. We also significantly improved the quality of our findings over the course of the beta: scans on the same repositories over time show increasing precision, in one case cutting noise by 84% since initial rollout. We’ve reduced the rate of findings with o
OpenAI Codex Update Reduces Risk of Destructive Actionslinkedin.com · supportingRecapping some changes we have rolled out over the last couple of weeks that have further reduced the risk associated to potentially destructive
Codex Security, One Month Later | Michael Banksmichaelbanks.org · supporting## Fewer findings, better signal The headline number changed from 11 findings in June to 4 findings in July. I would not frame that as "Codex Security got better because the number went down." That is too simple. The codebase changed during the month, and I had already fixed or reduced several classes of risk. The more interesting part was that the July run felt better calibrated. The findings clustered around practical application-security themes: public workflow abuse controls, safe rendering of metadata, and safer handling of URLs and filesystem writes in maintenance tooling. I am intentionally keeping that description high-level because the goal of this post is not to publish a playbook for the specific issues. [...] That may sound like a small UI change, but it made the scan easier to trust. Security reviews have a lot of quiet time. When the tool tells you what phase it is in, you spend less time wondering whether it is stuck and more time waiting for the right handoff point.
Paul Solt on X: "Codex can do bad things by accident. Back ...x.com · supportingRecapping some changes we have rolled out over the last couple of weeks that have further reduced the risk associated to potentially
Tibo on X: "Hi! Recapping some changes we have rolled out over the last couple of weeks that have further reduced the risk associated to potentially destructive actions being performed by Codex during its work. A few weeks ago, we started investigating a small number of reports where GPT-5.6 in … / Xx.com · supportingadded clearer warnings, and further restricted especially risky permission combinations. - We updated Auto-review to better identify destructive actions. - We built targeted evaluations that replay the failures we observed. We’re also adding reinforcement-learning tasks and graders focused on these risks, and filtering destructive actions from training data. In those replay evaluations, the changes substantially reduced the behavior while preserving Codex’s ability to complete normal coding work. Two things to do on your end: - Keep the Codex app up to date. We are always improving safety, performance and many other things. - Use one of the sandbox modes: "Ask for approval" or "Approve for me". Only use Full access for environments you trust and can recover. Thanks and happy Codexing out [...] added clearer warnings, and further restricted especially risky permission combinations. - We updated Auto-review to better identify destructive actions. - We built targeted evaluations that repl