Agent chaosAs reported·28 Oct 2026
A developer says Codex's cleanup of one node_modules folder wiped almost their whole 1 TB drive
As reported One person’s public account. We couldn’t independently confirm it, and we’ll update this if the facts change.
A developer says a Codex command meant to delete one node_modules folder ran across their whole E: drive instead, taking personal photos, university work and other projects with it.
This is one person's account on GitHub, not independently confirmed. It was filed as a critical bug report against OpenAI's Codex on 27 October 2026 and was still open when we read it.
What happened
The developer was using Codex on Windows to upgrade a React Native and Expo app from SDK 57 to SDK 58 and sort out dependency conflicts. The project lived in a folder on their E: drive, a 1 TB NVMe SSD. They say they had told Codex to work on the app, not to delete anything outside the project folder.
To clear out the old dependencies, Codex ran a cmd.exe rmdir command from Windows PowerShell, aimed at the project's node_modules folder. The report includes the exact command and its timestamp. It ran for about 19 seconds and ended with access-denied errors on system folders and the Recycle Bin.
How it went wrong
The developer believes the quoting and escaping broke somewhere between PowerShell and cmd.exe. Instead of staying inside node_modules, the delete walked the root of the E: drive. Protected system folders refused; everything else the account could touch went.
When it finished, the project folder was empty. The drive's root held only the Recycle Bin, the App folder and System Volume Information.
The damage
According to the report, the loss covers the app's source, assets, local config and Git history, plus unrelated projects, personal photos, university assignments and academic documents built up over several years.
A recovery tool found the deleted file records, names and paths included, but one recovered photo came back as nothing but zero bytes. The developer suspects the SSD had already wiped the freed space. Codex rebuilt 496 text files from its own session log on another drive, which brings back none of the photos, documents, binary files or Git history.
What they want
They are asking OpenAI to investigate, to make Codex check and resolve paths before any destructive command, to block recursive deletes that could reach a whole drive or anything outside the workspace, and to stop and ask when it can't be sure what a delete will hit. They offered to share the full session log privately.
Our take
This is our opinion. We covered a near-identical Codex rmdir quoting report on 22 October. Windows shell quoting is a trap for agents, because one wrong escape can turn a path into a drive root. Clearing node_modules looks harmless, which is exactly why nobody watches it. Run agents on a drive that holds only the project, keep real backups of everything else, and never let a recursive delete run without a check that its target sits inside the workspace.
Check that every recursive delete's resolved path sits inside the project before it runs, and keep the agent off drives that hold anything else.
