Quoting Thibault Sottiaux

2026-07-16 · Source: Simon Willison's Weblog · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Advanced, quick

Summary

On July 16, 2026, Thibault Sottiaux detailed a critical bug in GPT-5.6, where the model unexpectedly deletes files, based on several incident reports. Investigations pinpointed that this issue most commonly occurs when GPT-5.6's Codex component is run in full access mode, specifically without essential sandboxing protections or auto review enabled. The root cause involves the model attempting to override the "$ env var" to define a temporary directory, but then mistakenly deleting the "$" variable itself. This discovery underscores significant security vulnerabilities when deploying advanced AI models like GPT-5.6 in overly permissive operational environments lacking stringent safeguards.

Key takeaway

For AI Security Engineers deploying or managing models like GPT-5.6, you must prioritize stringent sandboxing and access controls. This bug demonstrates that running Codex in full access mode without sandboxing or auto review creates critical file deletion risks. Implement robust environment variable validation and ensure all model operations are confined to secure, isolated environments to prevent unintended system modifications.

Key insights

GPT-5.6 can delete files when Codex runs unsandboxed in full access mode, mistakenly deleting the "$ env var".

Principles

• Sandboxing is critical for AI model execution.
• Disable full access mode by default.
• Validate environment variable modifications.

In practice

• Ensure Codex runs within a sandbox.
• Enable auto review for model actions.
• Monitor "$ env var" changes closely.

Topics

• GPT-5.6
• Codex
• AI Security
• Sandboxing
• File Deletion

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, AI Engineer, MLOps Engineer

Related on AIssential

• GPT-5.6 is deleting user files when given full access, and OpenAI says it shouldn't but did — GPT-5.6 can delete user files in full access mode, highlighting AI's unintended destructive potential.
• Building a safe, effective sandbox to enable Codex on Windows — Effective sandboxing for coding agents on Windows requires custom solutions due to OS-level isolation gaps.
• Daybreak: Tools for securing every organization in the world — AI has shifted the cybersecurity bottleneck from vulnerability discovery to patching, necessitating automated remediation at machine speed.
• You aren't using Codex like me... — Optimizing Codex with GPT-5.6 requires strategic model selection, advanced features, and robust safety configurations for peak performance and security.
• Claude Code can destroy your database — AI-driven cloud code risks dangerous, unintended actions like database deletion because current security tools lack contextual understanding.
• When an Agent Deletes the Production Database — AI agents amplify existing system vulnerabilities, accelerating the impact of poor security practices like over-privileged, long-lived credentials.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Simon Willison's Weblog.