🔥 Codex agent deleted entire repo instead of specific folder after ZIP operation

Resolved 💬 4 comments Opened Oct 24, 2025 by talchaimdamri Closed Nov 11, 2025

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex is running?

codex-cli 0.47.0

What subscription do you have?

pro

Which model were you using?

codex-high

What platform is your computer?

Darwin 25.0.0 arm64 arm

What issue are you seeing?

While using the Codex agent to automate a simple archive operation, the agent ended up deleting the entire repository due to an overly broad cleanup step after creating a .zip file.

---

Expected behavior

The agent should only remove the target folder that was zipped — or at least confirm before executing a global find ... -delete or rm -rf command

---

Actual behavior

After successfully creating the archive folder and .zip file, Codex executed:

find . -maxdepth 2 -type d ! -path '.' ! -path './archive' -exec rm -rf {} +

and later similar variants without exclusions, which deleted most of the project, including .git/.

What steps can reproduce the bug?

Reproduction steps

Ask Codex to “archive subfolder X into a zip and clean up afterwards.”
Observe that after the zip is created, Codex attempts to “clean up” by using a global find command with overly broad conditions.
The cleanup logic expands iteratively, removing the entire repository.

---

Suggested improvement

Add explicit safeguards before executing any command that includes rm, -delete, or similar — even when running in agent mode, which currently lacks default safety restrictions.
Require confirmation or dry-run validation when deleting at repo root level.

---

Environment

Codex agent (VS Code extension)
OS: macOS / Linux
Task: archive testing-005

---

Logs

Excerpt from session:

Ran mkdir -p archive
Ran zip -rq archive/testing-005-generation.zip ...
Ran find . -maxdepth 2 ...
Ran find . -maxdepth 2 ! -path '.' ! -path './archive' -exec rm -rf {} +

---

Additional context

I have a full log and screenshot of the execution trace showing this chain of commands.
Happy to attach if helpful.

What is the expected behavior?

_No response_

Additional information

_No response_

View original on GitHub ↗

4 Comments

github-actions[bot] contributor · 10 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#3934
#3728
#3989
#4969
#5154

Powered by Codex Action

techjoec · 10 months ago

Yeah the "clean up" term should be coded somehow for different logic. To the model clean up means "kill with fire". I found it on a bad trip consisting of creating tons of junk temp and tee'ed output files I wanted cleaned up. So I told it something like "Stop creating temp files here, you should use /path/to/better/place for any transient items. Now clean this all up!" and it did the same basically. I run YOLO no-sandbox 99.9% of the time, so shame on me if it goes bad bad, but yeah 'clean' does not translate well.

etraut-openai contributor · 9 months ago

Thanks for the bug report. We've shared the feedback with the team members who are responsible for training our codex models. We're tracking this feedback and similar reports so we can make the model more robust in future iterations.

If you see other model behavior that you'd like to report, please use the recently-added /feedback command in the CLI. That will provide us with additional details including logs and conversation text.

Pritahi · 8 months ago

Hi, I saw the 'rm -rf' incident with Codex. This is exactly the kind of 'rogue agent' behavior MCP Shield (https://mcp-shield.vercel.app) is built to block at the proxy level. Interested in learning how we can help keep your repo safe?