[Data loss] ~221 GB deleted from $HOME while gpt-5.6-sol sessions were running (codex-cli 0.153.0, macOS 26.6)

What version of Codex CLI is running?

codex-cli 0.153.0 (codex exec, launched by the implementer agent); interactive sessions codex-cli 0.153.0 via codex --approve-for-me; Codex Desktop bundled 0.153.0-alpha.5 (ChatGPT.app 26.901.20858)

What subscription do you have?

ChatGPT Pro 5x + 20x

Which model were you using?

gpt-5.6-sol, model_reasoning_effort=xhigh

What platform is your computer?

macOS 26.6.2 (25G83), Mac Studio (Mac13,2)

What terminal emulator and version are you using (if applicable)?

Terminal.app

Codex doctor report

What issue are you seeing?

On 2026-09-04 between 04:27 and 04:47 UTC, ~221 GB was permanently unlinked from my home directory on a Mac Studio (macOS 26.6.2) with my own user privileges, bypassing the Trash, while gpt-5.6-sol Codex sessions were executing on the machine.

Deleted: every repository under ~/code/jin and ~/code/reference, ~/.nvm, ~/.local, ~/.config, ~/.claude, ~/.agents, ~/.zshrc / /.zprofile / /.zsh_history, three GitHub self-hosted runners (/actions-runner*), the host-side data directories of my production and UAT Docker stacks (/prod, ~/uat, ~/test), $TMPDIR and /private/tmp. Untouched: ~/Library, ~/.ssh, ~/.aws, ~/.codex, ~/.npm, Documents, Downloads.

Codex activity at the time (client rollouts survived in ~/.codex/sessions):

• codex exec review session 01a06aa2-14df-7c81-aa76-98310b0dddd9, 04:16–04:26 UTC, cwd ~/code/jin/lexa-worktrees/w5-16-claudecli, approval_policy=never, sandbox=workspace-write
• codex exec review session 01a06aab-17d1-70d3-8b04-2e7e56a58dbb, 04:26–04:36 UTC, cwd ~/code/jin/lexa-worktrees/w5-18-reconcile, same policy
• four interactive gpt-5.6-sol sessions open in terminal workspaces with cwd ~/code/jin, launched with codex --approve-for-me --model gpt-5.6-sol, i.e. escalations out of the sandbox approved by codex-auto-review rather than by me
• a Codex Desktop session 04:00–04:04 UTC (three require_escalated commands auto-approved)

The macOS unified log for 04:24–04:50 UTC contains no sandbox file-write-unlink denial from any process, so whatever performed the deletion was running with full filesystem access — the condition OpenAI described in July for GPT-5.6 Sol deleting $HOME while handling a temporary directory (see #19202, #38312). The pattern here (home-directory contents including $TMPDIR, user privileges, a ~15-minute traversal that stopped abruptly, temporary-directory setup/cleanup code paths running in the in-window sessions) matches that failure mode.

The two in-window rollouts list only review commands (git diff, tests, file reads, mkdtemp/cleanup under $TMPDIR). But a client-written rollout cannot show whether a command was executed unsandboxed after automatic approval, and it does not cover execution paths that write no rollout (sub-agents, background PTY sessions, Codex Desktop threads, automations, app-server). The other local evidence that could identify a different cause (shell history, other agents' transcripts) was destroyed by the deletion itself. Only server-side records can settle this; I have asked OpenAI support to preserve and provide them (support case: 14410909).

What steps can reproduce the bug?

Not deterministically reproducible; it happened once. Setup at the time:

1. macOS 26.6.2, codex-cli 0.153.0, model gpt-5.6-sol, model_reasoning_effort=xhigh, config.toml: approval_policy=on-request, sandbox_mode=workspace-write, network_access=false.
2. Interactive sessions started via codex --approve-for-me --model gpt-5.6-sol -c model_reasoning_effort="xhigh" in terminal workspaces (herdr 0.8.2) with cwd ~/code/jin.
3. An implementer agent spawning codex exec review sessions in git worktrees under ~/code/jin/lexa-worktrees, each running npm test, npx vitest, node -e scripts that create and remove temporary directories under $TMPDIR (mkdtempSync + a project cleanup helper), and git diff.
4. Codex Desktop (ChatGPT.app 26.901.20858, bundled codex-cli 0.153.0-alpha.5) used shortly before for troubleshooting, with escalations auto-approved.
   Full timeline, free-space telemetry, sandbox-log query and per-command listing are in the attached report.

What is the expected behavior?

No command run by or on behalf of a Codex session should delete anything outside the workspace. Any escalation out of the sandbox that can touch $HOME, $TMPDIR or a temporary-directory override should require an explicit human confirmation showing the exact paths, regardless of --approve-for-me. The July 2026 mitigations for the $HOME deletion should be in effect on codex-cli 0.153.0 / gpt-5.6-sol; if they were, this should not have been possible from a Codex session.

Additional information

• Report attached: incident20260904massdeletion.pdf (timeline, blast radius, every gpt-5.6-sol session that day with commands, sandbox evidence, what is requested from OpenAI).
• Impact: unpushed commits, production/UAT data directories, Terraform state, CI runners, and ~2.5 months of run data (usage ledger, per-run logs and transcripts) collected for an open-source orchestrator project and its launch write-ups; only a partial aggregate projection stored outside $HOME survived.
• Rollout JSONL files and unified-log extracts available on request.
• Questions I would like answered: whether any command in the window ran with full filesystem access after codex-auto-review approval; whether any execution path exists that does not write a local rollout; whether --approve-for-me can ever grant unsandboxed execution without a human prompt.

incident20260904massdeletionpublic.pdf

Start with the attached incident report, the preserved Codex session rollout JSONL, and the sandbox-log evidence described in the issue. Trace the approval and sandbox paths involved in the listed sessions, then determine whether any command received unsandboxed access without explicit confirmation. Done means identifying the execution path or documenting that the available evidence cannot establish one.