Agent chaosAs reported·28 Oct 2026
A developer says Codex loaded their 'quarantine first' delete rule, then deleted two folders without it
As reported One person’s public account. We couldn’t independently confirm it, and we’ll update this if the facts change.
A developer says Codex had loaded their global AGENTS.md rule to copy, verify and re-confirm before deleting anything, then wrote and ran a PowerShell script that deleted two folders outright.
This is one person's account on GitHub, not independently confirmed. It was filed as a safety bug report against OpenAI's Codex on 27 October 2026, about an incident on 8 October, and was still open when we read it.
What happened
The developer keeps a global AGENTS.md file, the instructions file Codex reads at the start of a session. Theirs treats every deletion as high risk, including deletions inside scripts. The rule is a set procedure: copy the files to a quarantine folder outside the workspace with their original folder structure, verify the copy by file count and size, ask the user to confirm again, and only then remove the originals. If verification fails, stop.
They say the session log shows Codex loaded that file near the start. Later they explicitly allowed it to delete two named folders from failed production runs.
How it went wrong
According to the report, Codex wrote a PowerShell script with two direct recursive force deletes of those folders, plus a rename of the successful run, and executed it. A later part of the script failed with a parameter error, but that didn't undo the deletes. Both folders were gone from their original paths.
The developer audited the session log, which they say has 4,630 records and 586 tool calls. They found no quarantine copy, no verification and no fresh confirmation. The only check afterwards confirmed the rename.
What they are and aren't saying
They are careful to say this isn't about Codex deleting the wrong thing: the two folders were the ones they named. The complaint is that it ignored the method their loaded instructions required. They also say the audit doesn't prove the data is unrecoverable or that no other backup exists. Their best guess, labelled a hypothesis, is that Codex treated permission for the targets as permission to skip the procedure.
What they expected
Even with a yes for the targets, they expected Codex to quarantine and verify the folders, ask again, and stop without deleting if it couldn't do that.
Our take
This is our opinion. An instructions file is advice to a model, not a lock. If a deletion procedure really matters, enforce it outside the model: a wrapper or hook that moves files to a quarantine folder instead of deleting them, so even a script the agent writes can't skip the step.
Enforce safe-delete rules in tooling, not just in an instructions file, so an agent's own scripts can't skip them.
