Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-07-18 · source-backed
Thibault Sottiaux at OpenAI published an investigation into "a handful of reports where GPT-5.6 unexpectedly deleted files," finding it happens most commonly when full access mode is enabled in Codex. Simon Willison relayed it.
A frontier lab publishing a first-party post-mortem on its model destroying user data is rare enough to be the story on its own. This isn't a GitHub issue with 40 thumbs-up and no response. It's the vendor saying yes, our model deletes your files sometimes, here's when.
The instruction is blunt and I'll repeat it without softening: do not run coding agents in unsandboxed full-access mode. Not Codex, not Claude Code, not anything. Full access exists because sandboxing is annoying and the agent is more capable without it. That trade was always bad and now there's a labeled failure mode attached to it.
What ties this to everything above is where the failure lives. GPT-5.6 deleting files isn't an alignment failure in the way that phrase usually gets used. Nobody prompt-injected it. It's a capable model given unbounded filesystem authority, doing something wrong once in a while, with no boundary to catch it. Same shape as the permission bypasses in story one and the MCP servers in story two: the model behaved plausibly, the system around it had no floor.
A new arXiv paper (2605.18991) makes this argument formally, that agent security failures come from system composition (tool grants, trust boundaries, data flow between components) rather than model-level alignment gaps. Which implies model-layer prompt-injection defenses are structurally insufficient no matter how good they get. I think that's right, and I think it's the frame that survives the next two years.
Practically, for anyone running agents on real work: containerize. Use a scratch worktree or a container with the repo mounted and nothing else. Commit before every unattended run so the worst case is git reset --hard. If your agent has write access to ~, your blast radius is your entire life. And if you're using Claude Code specifically, note that Vercel just made Sandbox data downloads free, which removes the per-invocation egress cost that made containerized agent execution unpredictable to budget. The excuse got cheaper this week too.
Each link below shares sources, entities, or timing with this story.
SaaStr uses OpenAI / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (SaaStr uses OpenAI); both cover Claude Code, Codex, MCP, Nobody; overlapping topics (access, agent, claude, code, model).
OpenAI released Codex CLI / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (OpenAI released Codex CLI); both cover Claude Code, MCP, OpenAI, Same; overlapping topics (agent, claude, code, codex, model).
OpenAI released Codex / Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (OpenAI released Codex); both cover Codex, GPT, OpenAI, Simon Willison; reported by the same outlet (simonwillison.net).
Anthropic partners with OpenAI / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Anthropic partners with OpenAI); both cover Claude Code, GPT, MCP, OpenAI; overlapping topics (agent, claude, code, data, model).
OpenAI uses Vercel / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (OpenAI uses Vercel); both cover Claude Code, Codex, GPT, OpenAI; overlapping topics (claude, code, model).
Linked by a graph relationship (OpenAI uses Vercel); both cover Claude Code, Codex, OpenAI, Sandbox; overlapping topics (agent, code, model).
OpenAI uses Vercel / Shared entities / Earlier coverage
Linked by a graph relationship (OpenAI uses Vercel); both cover Claude Code, Codex, Full, MCP; earlier Claude Code coverage from 2026-06-17.
GitHub Copilot supports OpenAI / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (GitHub Copilot supports OpenAI); both cover GitHub, GPT, OpenAI, Same; overlapping topics (code, data, gpt-5, model, openai).