Quoting Thibault Sottiaux

Yesterday, Simon Willison relayed a bug report from Thibault Sottiaux that sent a chill through the developer community: under specific configurations, GPT-5.6 can “unexpectedly” delete a user’s entire home directory. It wasn't a malicious attack, nor a user command—it was an “honest mistake” made by the model while acting autonomously. Though casually dubbed “a pretty gnarly Codex bug,” this incident rips open a crack in AI engineering that has long been underestimated.

What happened? The trigger conditions are remarkably specific: full access mode must be enabled, and the execution environment must lack both sandboxing protections and the auto-review mechanism. While running, GPT-5.6 attempts to override the $HOME environment variable, repointing it to a temporary directory meant for workspace intermediates. Then, during cleanup, the model “honestly” misjudges the variable and executes a deletion of $HOME—which, because of the redirection, now points to the user’s real home folder. In plain terms, the agent tried to tidy up a temporary desk space and ended up emptying the owner’s entire study.

This isn’t a typical software flaw; it’s a dangerous disconnect between AI reasoning chains and system privileges. The model bore no ill intent; it simply followed a logically “correct” temp-directory management flow without constraints. The core failure: it had permission to modify critical environment variables without any checks asking, “Are you absolutely sure you want to do this?”

The trend: AI agents enter the ‘root access era’ As AI evolves from Copilot’s code suggestions to Codex’s direct command execution, the security model must evolve in parallel. The old worry was about models generating unsafe code; the new elephant in the room is that even benign code, when strung into an automated chain with one false assumption about system state, can cause irreversible harm. Think of a super-capable intern given sudo privileges—out of goodwill they might want to reorganize directories, but a single symlink misjudgment could wipe the entire repo.

Zooming out, AI agents are moving from the console into the OS kernel, yet the industry’s adoption of the “principle of least privilege” remains sloppy. Many tools grant agents broad filesystem access as if they naturally deserve user-equivalent rights. This bug proves we should treat every agent as an untrusted process—no matter how intelligent the underlying model seems.

Practical takeaways: three things to do right now If you’re using or testing coding agents like Codex, this incident hands you three immediate security baselines. First, always run agents inside containers or dedicated VMs—make sandboxing a physical boundary, not a mental comfort. Second, enable execution review (auto-review or human-in-the-loop) so a developer has the final say before each command runs. Third, tightly control environment variables—especially $HOME and $PATH—prohibit modifications, and even enforce them via read-only mounts. As a bonus, consider deploying honeypot files in non-critical locations; any anomalous touch or deletion can trigger alerts early.

Counterintuition: ‘honest’ can be more dangerous than malicious Most people associate data loss with malware or external attacks, but this event flips the script: the damage came from a flawed assumption within the model's rational reasoning. Because the agent appeared “trustworthy” and its intent wasn’t bad, users were more likely to relax permissions. This reveals a deeper truth: in complex systems, well-meaning yet unconstrained automation is often harder to guard against than outright hostility. We’ll be living alongside such “rational but misaligned” AI behavior for a long time, and the focus of security must shift from defending against adversaries to constraining collaborators.