Repository navigation
🔥 Codex agent deleted entire repo instead of specific folder after ZIP operation #5594
Description
What version of Codex is running?
codex-cli 0.47.0
What subscription do you have?
pro
Which model were you using?
codex-high
What platform is your computer?
Darwin 25.0.0 arm64 arm
What issue are you seeing?
While using the Codex agent to automate a simple archive operation, the agent ended up deleting the entire repository due to an overly broad cleanup step after creating a .zip file.
Expected behavior
The agent should only remove the target folder that was zipped — or at least confirm before executing a global find ... -delete or rm -rf command
Actual behavior
After successfully creating the archive folder and .zip file, Codex executed:
find . -maxdepth 2 -type d ! -path '.' ! -path './archive' -exec rm -rf {} +and later similar variants without exclusions, which deleted most of the project, including .git/.
What steps can reproduce the bug?
--
Reproduction steps
- Ask Codex to “archive subfolder X into a zip and clean up afterwards.”
- Observe that after the zip is created, Codex attempts to “clean up” by using a global
findcommand with overly broad conditions. - The cleanup logic expands iteratively, removing the entire repository.
Suggested improvement
- Add explicit safeguards before executing any command that includes
rm,-delete, or similar — even when running in agent mode, which currently lacks default safety restrictions. - Require confirmation or dry-run validation when deleting at repo root level.
Environment
- Codex agent (VS Code extension)
- OS: macOS / Linux
- Task:
archive testing-005
Logs
Excerpt from session:
Ran mkdir -p archive
Ran zip -rq archive/testing-005-generation.zip ...
Ran find . -maxdepth 2 ...
Ran find . -maxdepth 2 ! -path '.' ! -path './archive' -exec rm -rf {} +
Additional context
I have a full log and screenshot of the execution trace showing this chain of commands.
Happy to attach if helpful.
What is the expected behavior?
No response
Additional information
No response
Activity
github-actions commentedon Oct 24, 2025
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
rm -rfcommand without safeguards #3934rm -rf .gitout of nowhere #3728Powered by Codex Action
techjoec commentedon Oct 24, 2025
Yeah the "clean up" term should be coded somehow for different logic. To the model clean up means "kill with fire". I found it on a bad trip consisting of creating tons of junk temp and tee'ed output files I wanted cleaned up. So I told it something like "Stop creating temp files here, you should use /path/to/better/place for any transient items. Now clean this all up!" and it did the same basically. I run YOLO no-sandbox 99.9% of the time, so shame on me if it goes bad bad, but yeah 'clean' does not translate well.
etraut-openai commentedon Nov 11, 2025
Thanks for the bug report. We've shared the feedback with the team members who are responsible for training our codex models. We're tracking this feedback and similar reports so we can make the model more robust in future iterations.
If you see other model behavior that you'd like to report, please use the recently-added
/feedbackcommand in the CLI. That will provide us with additional details including logs and conversation text.Pritahi commentedon Dec 29, 2025
Hi, I saw the 'rm -rf' incident with Codex. This is exactly the kind of 'rogue agent' behavior MCP Shield (https://mcp-shield.vercel.app) is built to block at the proxy level. Interested in learning how we can help keep your repo safe?