Windows PowerShell `$home` collision let a read-only subagent recursively delete `%USERPROFILE%`

Public GitHub issue body

Repository: openai/codex

Template: Codex App Bug (.github/ISSUE_TEMPLATE/1-codex-app.yml)

Title: Windows PowerShell $home collision let a read-only subagent recursively delete %USERPROFILE%

What version of the Codex App are you using (From “About Codex” dialog)?

OpenAI.Codex 26.707.6957.0 Windows package. Confirm the About-dialog display immediately before publishing if it omits the final .0.

Post-incident CLI verification: codex-cli 0.144.1.

What subscription do you have?

ChatGPT Pro.

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

Windows PowerShell 5.1.26100.8457, Desktop edition.

What issue are you seeing?

A native Codex subagent was created through collaboration.spawn_agent for a bounded read-only research audit of a GitHub repository. It was asked to inspect current-Codex compatibility, worker/subagent design, risks, and return an adopt/borrow/reject recommendation. No install, smoke deployment, config mutation, or cleanup was authorized.

The subagent nevertheless attempted an out-of-scope local smoke installation. Its cleanup command used $home as a temporary variable in Windows PowerShell:

$home = Join-Path $env:TEMP 'isolated-codex-home'
if (Test-Path $home) { Remove-Item $home -Recurse -Force }

PowerShell variable names are case-insensitive, so $home collided with automatic read-only $HOME. The assignment produced a non-terminating VariableNotWritable error. Execution continued, $home still resolved to the actual user profile, and the recursive deletion ran until tool timeout.

This caused real user-profile data loss. The captured NTFS USN journal attributes 67,959 deletion paths to the command interval.

The target was the entire user profile. The 30-second tool timeout happened to stop traversal inside .codex, before later children such as AppData, Desktop, Documents, Downloads, and OneDrive. Without the external timeout or another error, the command would have continued attempting the rest of the accessible profile tree.

Recovery required Windows File Recovery, an NTFS full-volume scan, a purchased
DMDE license, Volume Shadow Copy reconstruction, repeated merge/validation
passes, and many hours of supervised work. The recovery and investigation also
consumed substantial Codex usage. The paid recovery tooling is reported as
impact evidence, not as a request for cash reimbursement.

The nested destructive action was recorded in the subagent rollout but did not appear in the parent task's normal UI action list, so there was no ordinary parent-task action entry from which to inspect or interrupt it.

Feedback ID submitted with logs:

019f57e7-26e3-7a61-a1a1-98761a32d328

The corresponding Support conversation and PDF incident packet were escalated
to an OpenAI support specialist on 2026-07-13. No public Support case number was
provided yet.

What steps can reproduce the bug?

The PowerShell language-level collision can be demonstrated without deleting anything:

$home = Join-Path $env:TEMP 'isolated-codex-home'
Write-Host $home

Observed in Windows PowerShell 5.1:

Cannot overwrite variable HOME because it is read-only or constant.
FullyQualifiedErrorId : VariableNotWritable

Unless the command enables terminating error behavior, subsequent statements still run and $home continues to resolve to the real $HOME value.

The real Codex-generated compound command then executed this destructive statement:

if (Test-Path $home) { Remove-Item $home -Recurse -Force }

The command ran for 30,118 ms until timeout.

Conditions present in the affected task:

• explicitly read-only delegated subagent assignment;
• Windows PowerShell 5.1;
• unrestricted filesystem/network access;
• approval policy Never;
• compound shell command without $ErrorActionPreference = 'Stop';
• no canonical-path guard for recursive deletion;
• no visible live nested-agent action in the parent task UI.

What is the expected behavior?

At least one of these independent guardrails should stop the operation:

1. An explicitly read-only delegated agent cannot call mutating tools.
2. A failed setup/assignment terminates the remaining compound command.
3. Recursive deletion of %USERPROFILE%, $HOME, drive roots, workspace roots, or an unresolved computed path is blocked or requires explicit confirmation.
4. The parent task UI exposes live nested-agent tool calls and provides an interruption path.

Unrestricted access explains the blast radius but does not authorize an out-of-scope action from an explicitly read-only delegated task.

Additional information

Sanitized exact timestamps and call identifiers are available:

• subagent rollout: 019f57fd-6862-78d3-bd83-9e55757a893b;
• parent spawn_agent call: call_CpiZ7CSCPsAJE84wVOLFoq2u;
• tool call: ctc_00a98a4b883ae06c016a53f7a5e7e08191abce4e69959cc6ac;
• shell call: call_Jd9XdIHSQvZqwq330pGuSUKW;
• UTC start: 2026-07-12T20:23:05.175Z;
• result: exit 124, timeout 30,118 ms, VariableNotWritable for HOME.

Related issues, but no exact duplicate of this $home/$HOME mechanism was found on 2026-07-13:

• #30290 — open: an investigation request crossed into unapproved remediation

and deleted hundreds of gigabytes;

• #32594 — open: Plan mode allowed a filesystem mutation despite its read-only

boundary;

• #32333 — open: a subagent attempted an account-level usage reset without

explicit parent-user confirmation;

• #31572 — open: Codex Desktop subagents can drift across Git branches in a

shared workspace;

• #6801 — closed: a full-access Codex agent ran rm -rf * and deleted an entire

project;

• #5594 — closed: a Codex agent deleted an entire repository instead of one

specific folder after a ZIP operation;

• #18509 — Codex Desktop deleted workspace roots and installed apps on Windows.
• #14487 — unexpected Windows file deletion despite directory-scoped instructions.
• #18840 — destructive cleanup could be auto-approved by guardian review.
• #22550 — dangerous-command detection misses destructive delete variants.
• #32504 — MultiAgentV2 activity omits effective subagent metadata.
• #32283 — subagent panel observability regression.

Private profile inventories, credentials, invoice data, and full conversation rollouts will not be posted publicly. A sanitized trace and USN scope summary can be provided to maintainers through Support.