A Codex CLI user asked the agent to audit its own older sessions -- a read-only review task. The audit itself turned destructive, and the thing that made it destructive was Codex's own safety documentation.
What the source says
Per GitHub issue #36937, filed against Codex CLI 0.146.0 (model gpt-5.6-sol, Windows 10, danger-full-access mode, approval policy never, via Git Bash): Codex's audit step passed the path of an old session's rollout JSONL file into the program position of a Bash login-shell invocation. Git Bash read the file's contents as shell input rather than as data, and a backtick-quoted line buried inside that file's own saved safety-instruction text was interpreted as a command substitution -- and executed.
That line was one of the model's bundled examples of a command it must refuse to run: a recursive-delete pattern included purely as documentation of what not to do. Executed for real, it targeted the effective HOME directory, with the command's exit status ignored and stderr discarded, so nothing in the session surfaced that anything had gone wrong.
The reporter's forensic reconstruction -- hampered by process auditing and Sysmon both being off, so no full trace survives -- confirmed one concrete piece of damage: the .codex and .claude symlink entries inside HOME were deleted. Their actual contents, kept on a separate drive, survived only because the delete never followed the symlinks to their targets. The issue lists five earlier, related reports (#27131, #33624, #32684, #33557, #18509). It remains open more than three months later with no maintainer response beyond automatic labeling; a non-maintainer proposed a fix on September 18 -- blocking session-file paths from being run as programs or fed into a shell's -c/-lc -- that has not been merged.
What it doesn't establish
The reporter did not attempt to reproduce the deletion destructively and proposed a non-destructive synthetic-fixture test instead, so there's no independent confirmation beyond the one forensic reconstruction described above. No maintainer has confirmed the mechanism or ruled out further loss -- the only damage anyone could actually verify was the two symlink entries, not a fuller HOME wipe.
Why it's scored where it is, not higher
Severity 4/medium: scope 1 (one user's HOME directory), recoverability 1 (the real data survived; the symlinks didn't), realisation 2 (it happened, confirmed), impact 0. The title of the underlying GitHub issue reads more dramatically than the confirmed forensic record supports -- this is scored to what's actually verified. Full scoring and source: https://www.stupidllm.com/incident/STUPID-2026-0161/
What makes it worth noting anyway: this isn't a user typing a dangerous command and the agent running it. It's a stored log of a past conversation -- including the model's own bundled list of commands it must refuse -- being fed to a shell as if it were a program. The artifact that was supposed to document the refusal became the payload. Five related open issues suggest this is a recurring failure class, not a one-off.
Top comments (0)