How Codex reportedly executed its own session log and deleted a Windows home directory
Codex7 min readBusiness + PersonalCodex reportedly handed a saved session log to Git Bash as a program. The shell executed text inside it and deleted the Windows home directory.
This case is unusual, but the basic mistake is easy to understand: a saved session log was treated as a program. Text that was harmless inside a record became executable when it was handed to the wrong part of the shell.
How the incident unfolded
The public account dates the incident to August 4, 2026. The report centers on an OpenAI GitHub issue reporter, using Codex CLI 0.146.0 with GPT-5.6 Sol.
The user asked Codex to audit historical saved session logs. Codex constructed a Bash command intended to inspect one log file stored in JSONL format.
The pathname was accidentally placed where a program or executable shell-input file belonged. Git Bash began treating text inside the saved log as commands instead of data.
An example of a forbidden destructive command inside the log then targeted the Windows home folder. The reporter described deletion of C:\Users\<redacted> contents, a Git hard-reset reflog entry one second after the triggering tool call, and continued interpretation of the JSONL after the deletion fragment. Raw logs and personal diagnostics were withheld.
What actually caused the damage
A JSONL file is simply a text log in which each line stores a record. It should be opened and parsed as data. In this report, the shell was instead told to treat that file like executable input.
The log contained examples of commands the agent was not supposed to run. Those examples were safe while they were only text. They became dangerous when the shell started executing the file line by line.
Logs, prompts, Markdown, and model instructions are untrusted data even when the application created them.
Security examples often contain commands that look real because they are teaching what not to do. They become dangerous when a shell is asked to execute the file instead of read it.
The command hid errors and ignored failure signals, removing clues that the attempted log review had turned into execution.
A more accurate Codex CLI 0.146.0 with GPT-5.6 Sol model might make fewer mistakes. It still cannot replace limits on what the software is allowed to do.
How Leash could have changed the outcome
With a supported Codex CLI 0.146.0 with GPT-5.6 Sol integration, Leash checks the proposed action before it runs. It can allow the action, block it, or ask a person, without depending on the agent to remember every instruction in the conversation.
Rules Protection can require the agent to verify the destination and can block a bulk move or overwrite when the earlier setup step failed.
Leash evaluates the Codex shell call before it starts. A rule can block session, JSONL, Markdown, and log files in executable or source positions and hold any command path that turns data into shell input.
Destructive Protection also evaluates destructive content visible in the proposed event when present, but the more durable policy is the boundary between data and executable instructions.
The evidence trail is external to the agent's explanation: the attempted program, file type, and target can be reviewed before any historical content runs.
For an OpenAI GitHub issue reporter, that would mean ordinary work could continue while the exact dangerous step received its own decision. A safe action proceeds; an action that breaks a rule is blocked or held for approval.
Leash would not need to predict every choice made by Codex CLI 0.146.0 with GPT-5.6 Sol. It would only need to stop the dangerous action before it became real.
What this means for a new agent user or indie developer
For an everyday developer, the rule is straightforward: open logs with a log reader or data parser, never as a shell program. If an agent proposes to run a session, prompt, Markdown, or JSONL file, stop and inspect the command.
A sensible starting policy for this case is: Parse JSONL with a data parser; never source it. Reject logs, Markdown, prompts, and session files in a shell program position.
Leash Personal Open Source can protect a Codex CLI 0.146.0 with GPT-5.6 Sol workflow locally with your own model-provider key. Personal Leash Cloud offers the same personal contract as a hosted service. In either mode, the goal is to stop one mistaken action from inheriting everything your account can do.
What a CIO, CTO, or CISO should take from this
For security and engineering leaders, audit records should remain readable but non-executable. Standard agent policies should block logs, prompts, and documentation from being placed where a shell expects a program.
For organizations using Codex CLI 0.146.0 with GPT-5.6 Sol, Business Leash Cloud adds an independent action-time safety layer. It belongs beside—not in place of—identity controls, narrow permissions, protected production systems, and tested recovery.
For this incident, the operational priorities are clear: Use synthetic benign fixtures for regression tests. Keep audit data readable but non-executable and separate from workspaces.
What to change before the next agent session
For this workflow case, start with the consequences that would be hardest to reverse. Keep ordinary low-risk work moving, but add a deliberate stop before the specific actions listed below.
- Parse JSONL with a data parser; never source it.
- Reject logs, Markdown, prompts, and session files in a shell program position.
- Use synthetic benign fixtures for regression tests.
- Keep audit data readable but non-executable and separate from workspaces.
What is confirmed—and what is not
This account follows OpenAI Codex GitHub issue #36937 and the additional sources linked below. Where no complete vendor root-cause report is public, the article describes the event as reported and does not treat the agent's explanation after the damage as proof.
A pre-shell policy is only one layer. Codex itself should reject data files as programs, and operating-system execution controls should enforce file types. If dangerous content is synthesized only after the hook event, Leash needs the completed tool input to see it.
The Leash claim for Codex CLI 0.146.0 with GPT-5.6 Sol has a clear boundary: the action must pass through a supported before-action integration. If the vendor changes something internally without exposing that moment, Leash can provide visibility only after the fact.
The bottom line
The lasting lesson is that data and instructions need a hard boundary. A safety example stored in a log must never become a real command because an agent chose the wrong way to read the file.
The point is to keep Codex CLI 0.146.0 with GPT-5.6 Sol useful for routine work without gambling the wider laptop, repository, inbox, or production environment. That is the practical role Leash is designed to play in this story.