OpenAI Confirms GPT-5.6 in Codex Has Been Deleting User Files

Thibault Sottiaux at OpenAI published an investigation into "a handful of reports where GPT-5.6 unexpectedly deleted files," finding it happens most commonly when full access mode is enabled in Codex. Simon Willison relayed it.

A frontier lab publishing a first-party post-mortem on its model destroying user data is rare enough to be the story on its own. This isn't a GitHub issue with 40 thumbs-up and no response. It's the vendor saying yes, our model deletes your files sometimes, here's when.

The instruction is blunt and I'll repeat it without softening: do not run coding agents in unsandboxed full-access mode. Not Codex, not Claude Code, not anything. Full access exists because sandboxing is annoying and the agent is more capable without it. That trade was always bad and now there's a labeled failure mode attached to it.

What ties this to everything above is where the failure lives. GPT-5.6 deleting files isn't an alignment failure in the way that phrase usually gets used. Nobody prompt-injected it. It's a capable model given unbounded filesystem authority, doing something wrong once in a while, with no boundary to catch it. Same shape as the permission bypasses in story one and the MCP servers in story two: the model behaved plausibly, the system around it had no floor.

A new arXiv paper (2605.18991) makes this argument formally, that agent security failures come from system composition (tool grants, trust boundaries, data flow between components) rather than model-level alignment gaps. Which implies model-layer prompt-injection defenses are structurally insufficient no matter how good they get. I think that's right, and I think it's the frame that survives the next two years.

Practically, for anyone running agents on real work: containerize. Use a scratch worktree or a container with the repo mounted and nothing else. Commit before every unattended run so the worst case is git reset --hard. If your agent has write access to ~, your blast radius is your entire life. And if you're using Claude Code specifically, note that Vercel just made Sandbox data downloads free, which removes the per-invocation egress cost that made containerized agent execution unpredictable to budget. The excuse got cheaper this week too.