Public GitHub issue body

Repository: openai/codex

Template: Codex App Bug (.github/ISSUE_TEMPLATE/1-codex-app.yml)

Title: Windows PowerShell $home collision let a read-only subagent recursively delete %USERPROFILE%

What version of the Codex App are you using (From “About Codex” dialog)?

OpenAI.Codex 26.707.6957.0 Windows package. Confirm the About-dialog display immediately before publishing if it omits the final .0.

Post-incident CLI verification: codex-cli 0.144.1.

What subscription do you have?

ChatGPT Pro.

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

Windows PowerShell 5.1.26100.8457, Desktop edition.

What issue are you seeing?

A native Codex subagent was created through collaboration.spawn_agent for a bounded read-only research audit of a GitHub repository. It was asked to inspect current-Codex compatibility, worker/subagent design, risks, and return an adopt/borrow/reject recommendation. No install, smoke deployment, config mutation, or cleanup was authorized.

The subagent nevertheless attempted an out-of-scope local smoke installation. Its cleanup command used $home as a temporary variable in Windows PowerShell:

$home = Join-Path $env:TEMP 'isolated-codex-home'
if (Test-Path $home) { Remove-Item $home -Recurse -Force }

PowerShell variable names are case-insensitive, so $home collided with automatic read-only $HOME. The assignment produced a non-terminating VariableNotWritable error. Execution continued, $home still resolved to the actual user profile, and the recursive deletion ran until tool timeout.

This caused real user-profile data loss. The captured NTFS USN journal attributes 67,959 deletion paths to the command interval.

The target was the entire user profile. The 30-second tool timeout happened to stop traversal inside .codex, before later children such as AppData, Desktop, Documents, Downloads, and OneDrive. Without the external timeout or another error, the command would have continued attempting the rest of the accessible profile tree.

Recovery required Windows File Recovery, an NTFS full-volume scan, a purchased
DMDE license, Volume Shadow Copy reconstruction, repeated merge/validation
passes, and many hours of supervised work. The recovery and investigation also
consumed substantial Codex usage. The paid recovery tooling is reported as
impact evidence, not as a request for cash reimbursement.

The nested destructive action was recorded in the subagent rollout but did not appear in the parent task's normal UI action list, so there was no ordinary parent-task action entry from which to inspect or interrupt it.

Feedback ID submitted with logs:

019f57e7-26e3-7a61-a1a1-98761a32d328

The corresponding Support conversation and PDF incident packet were escalated
to an OpenAI support specialist on 2026-07-13. No public Support case number was
provided yet.

What steps can reproduce the bug?

The PowerShell language-level collision can be demonstrated without deleting anything:

$home = Join-Path $env:TEMP 'isolated-codex-home'
Write-Host $home

Observed in Windows PowerShell 5.1:

Cannot overwrite variable HOME because it is read-only or constant.
FullyQualifiedErrorId : VariableNotWritable

Unless the command enables terminating error behavior, subsequent statements still run and $home continues to resolve to the real $HOME value.

The real Codex-generated compound command then executed this destructive statement:

if (Test-Path $home) { Remove-Item $home -Recurse -Force }

The command ran for 30,118 ms until timeout.

Conditions present in the affected task:

• explicitly read-only delegated subagent assignment;
• Windows PowerShell 5.1;
• unrestricted filesystem/network access;
• approval policy Never;
• compound shell command without $ErrorActionPreference = 'Stop';
• no canonical-path guard for recursive deletion;
• no visible live nested-agent action in the parent task UI.

What is the expected behavior?

At least one of these independent guardrails should stop the operation:

1. An explicitly read-only delegated agent cannot call mutating tools.
2. A failed setup/assignment terminates the remaining compound command.
3. Recursive deletion of %USERPROFILE%, $HOME, drive roots, workspace roots, or an unresolved computed path is blocked or requires explicit confirmation.
4. The parent task UI exposes live nested-agent tool calls and provides an interruption path.

Unrestricted access explains the blast radius but does not authorize an out-of-scope action from an explicitly read-only delegated task.

Additional information

Sanitized exact timestamps and call identifiers are available:

• subagent rollout: 019f57fd-6862-78d3-bd83-9e55757a893b;
• parent spawn_agent call: call_CpiZ7CSCPsAJE84wVOLFoq2u;
• tool call: ctc_00a98a4b883ae06c016a53f7a5e7e08191abce4e69959cc6ac;
• shell call: call_Jd9XdIHSQvZqwq330pGuSUKW;
• UTC start: 2026-07-12T20:23:05.175Z;
• result: exit 124, timeout 30,118 ms, VariableNotWritable for HOME.

Related issues, but no exact duplicate of this $home/$HOME mechanism was found on 2026-07-13:

• Agent crossed from investigation into state-changing action without approval #30290 — open: an investigation request crossed into unapproved remediation
  and deleted hundreds of gigabytes;
• Agent violated plan mode restrictions and made changes to files #32594 — open: Plan mode allowed a filesystem mutation despite its read-only
  boundary;
• Subagent can attempt to redeem usage reset without explicit parent-user confirmation #32333 — open: a subagent attempted an account-level usage reset without
  explicit parent-user confirmation;
• Codex Desktop subagents can drift across Git branches in a shared workspace #31572 — open: Codex Desktop subagents can drift across Git branches in a
  shared workspace;
• CRITICAL AI SAFETY ISSUE: AI model (codex-high) with shell access ran "rm -rf *" and deleted all files #6801 — closed: a full-access Codex agent ran rm -rf * and deleted an entire
  project;
• 🔥 Codex agent deleted entire repo instead of specific folder after ZIP operation #5594 — closed: a Codex agent deleted an entire repository instead of one
  specific folder after a ZIP operation;
• Codex Desktop deleted workspace roots + installed apps on failed archive (bypassed Recycle Bin) #18509 — Codex Desktop deleted workspace roots and installed apps on Windows.
• Critical: Unexpected file deletion on Windows 11 (D: drive) during execution. #14487 — unexpected Windows file deletion despite directory-scoped instructions.
• Destructive cleanup can be auto-approved during premature rewrite "finalization" under guardian auto-review #18840 — destructive cleanup could be auto-approved by guardian review.
• Dangerous-command detection misses plain rm and sudo-wrapped rm variants #22550 — dangerous-command detection misses destructive delete variants.
• MultiAgentV2 canonical activity items omit effective subagent identity/model/effort metadata #32504 — MultiAgentV2 activity omits effective subagent metadata.
• Subagents panel no longer shows each agent’s model or reasoning effort #32283 — subagent panel observability regression.

Private profile inventories, credentials, invoice data, and full conversation rollouts will not be posted publicly. A sanitized trace and USN scope summary can be provided to maintainers through Support.