How Codex tried to delete Python cache files and wiped a repository
Codex7 min readBusiness + PersonalCodex tried to remove Python cache files, but its PowerShell command selected far more and deleted source code, tests, fixtures, and Git data.
This is the clearest example in the dataset of why a safe intention is not a safe target set. The filter looked reasonable in prose. The resolved list was catastrophic. Nothing independently checked that every file still matched the intended extensions.
How the incident unfolded
The public account dates the incident to July 27, 2026. The report centers on an OpenAI GitHub issue reporter, using Codex Desktop 0.144.1 on Windows.
The maintenance intent was narrow: remove compiled Python bytecode. Codex recursively enumerated files with Get-ChildItem and an Include filter.
The shell invocation did not constrain results as the agent assumed. Each resolved path was sent directly to Remove-Item -Force without independent extension, .git, count, or boundary validation.
The directory structure remained, but the files and parts of repository history were gone. The reporter described near-total loss of the active repository, corrupted Git history, unrecoverable files, and a reconstructed project that could no longer reproduce the original full test suite.
What actually caused the damage
The agent did not need a special way into the computer. It used the same terminal access the person had already granted. Once a command was allowed to run with that access, folders outside the visible project were reachable too.
Opening one project in an agent does not automatically fence the agent inside that folder. A real boundary has to be enforced before a command runs, especially when the command can remove many files at once.
Shell filters are implementation details, not proof. An agent must validate the post-filter target set before applying a destructive verb.
The command was individually deleting files, yet the aggregate consequence was a recursive wipe. Consequence-aware policy must look beyond one invocation shape.
Deleting .git objects damaged the mechanism users normally rely on to undo source loss.
A more accurate Codex Desktop 0.144.1 on Windows model might make fewer mistakes. It still cannot replace limits on what the software is allowed to do.
How Leash could have changed the outcome
With a supported Codex Desktop 0.144.1 on Windows integration, Leash checks the proposed action before it runs. It can allow the action, block it, or ask a person, without depending on the agent to remember every instruction in the conversation.
Destructive Protection can recognize a broad or recursive deletion, while Rules Protection can protect personal folders and anything outside the active project.
Codex can send the PowerShell command before execution. Destructive Protection recognizes recursive Remove-Item patterns and asks by default.
Rules Protection can require a dry run, reject any cleanup containing .git or non-bytecode extensions, and hold operations whose target count exceeds the stated task.
The high-value outcome is not that Leash understands Python better than Codex; it is that a broad irreversible operation cannot quietly inherit trust from a narrow maintenance request.
For an OpenAI GitHub issue reporter, that would mean ordinary work could continue while the exact dangerous step received its own decision. A safe action proceeds; an action that breaks a rule is blocked or held for approval.
Leash would not need to predict every choice made by Codex Desktop 0.144.1 on Windows. It would only need to stop the dangerous action before it became real.
What this means for a new agent user or indie developer
For a newcomer or indie developer, the practical lesson is simple: an open project is not a sandbox. If an agent can use your terminal, assume it can reach every file your account can reach until a real rule proves otherwise.
A sensible starting policy for this case is: Enumerate and validate every resolved target before deletion. Reject .git and source extensions regardless of shell filters.
Leash Personal Open Source can protect a Codex Desktop 0.144.1 on Windows workflow locally with your own model-provider key. Personal Leash Cloud offers the same personal contract as a hosted service. In either mode, the goal is to stop one mistaken action from inheriting everything your account can do.
What a CIO, CTO, or CISO should take from this
For a CIO, CTO, or CISO, agent terminal access should be treated like automation running under an employee's identity. Project boundaries, protected user folders, recoverable deletion, and evidence of every high-impact decision matter more than which model produced the command.
For organizations using Codex Desktop 0.144.1 on Windows, Business Leash Cloud adds an independent action-time safety layer. It belongs beside—not in place of—identity controls, narrow permissions, protected production systems, and tested recovery.
For this incident, the operational priorities are clear: Require a dry run, count, and representative sample for bulk cleanup. Create a snapshot or clean Git state before maintenance.
What to change before the next agent session
For this file-loss case, start with the consequences that would be hardest to reverse. Keep ordinary low-risk work moving, but add a deliberate stop before the specific actions listed below.
- Enumerate and validate every resolved target before deletion.
- Reject .git and source extensions regardless of shell filters.
- Require a dry run, count, and representative sample for bulk cleanup.
- Create a snapshot or clean Git state before maintenance.
What is confirmed—and what is not
This account follows OpenAI Codex GitHub issue #35707 and the additional sources linked below. Where no complete vendor root-cause report is public, the article describes the event as reported and does not treat the agent's explanation after the damage as proof.
Leash currently evaluates the proposed tool input, not a kernel-resolved file manifest. A rule and human review can stop this command shape, while deterministic target validation in the cleanup script remains the strongest technical control.
The Leash claim for Codex Desktop 0.144.1 on Windows has a clear boundary: the action must pass through a supported before-action integration. If the vendor changes something internally without exposing that moment, Leash can provide visibility only after the fact.
The bottom line
The lasting lesson is not that agents should never clean files. It is that a cleanup request should never silently become permission to erase unrelated parts of a computer.
The point is to keep Codex Desktop 0.144.1 on Windows useful for routine work without gambling the wider laptop, repository, inbox, or production environment. That is the practical role Leash is designed to play in this story.