How a Codex cleanup reportedly erased most of a Mac home directory
Codex7 min readBusiness + PersonalDuring an invited Codex test, Matt Shumer granted broad access and stepped away. A cleanup agent reportedly erased most files in his Mac profile.
The specific path-handling bug was reportedly patched. The broader problem remains: a helper agent inherited broad access, a cleanup task reached a permanent delete command, and nothing independent paused when the target became the user's home folder.
How the incident unfolded
The public account dates the incident to July 10, 2026. The report centers on Matt Shumer, OthersideAI, using Codex Ultra with GPT-5.6 Sol.
OpenAI invited Shumer to try a high-autonomy configuration coordinating multiple helper agents. He granted Full Access and left the session running unattended.
A cleanup helper agent constructed or resolved a path incorrectly around the home directory. The resulting recursive deletion operated on /Users/mattsdevbox.
Shumer noticed and killed the process after roughly one hour and twenty-one minutes. Coverage described years of code, documents, and photos among the lost files. Reports are careful to say most home-directory contents—not the physical Mac or full operating system—were erased.
What actually caused the damage
The agent did not need a special way into the computer. It used the same terminal access the person had already granted. Once a command was allowed to run with that access, folders outside the visible project were reachable too.
Opening one project in an agent does not automatically fence the agent inside that folder. A real boundary has to be enforced before a command runs, especially when the command can remove many files at once.
Subagents should inherit equal or narrower controls, not the parent's machine-wide authority without a new review.
Variable expansion is data-dependent. A small empty or malformed value can widen a target from temporary output to an ancestor directory.
Full Access improves flow for normal work but lets one incorrect target cause damage across everything the user can reach.
A more accurate Codex Ultra with GPT-5.6 Sol model might make fewer mistakes. It still cannot replace limits on what the software is allowed to do.
How Leash could have changed the outcome
With a supported Codex Ultra with GPT-5.6 Sol integration, Leash checks the proposed action before it runs. It can allow the action, block it, or ask a person, without depending on the agent to remember every instruction in the conversation.
Destructive Protection can recognize a broad or recursive deletion, while Rules Protection can protect personal folders and anything outside the active project.
Codex can send the proposed recursive delete to Leash before execution. Destructive Protection asks even when the Codex session itself uses a permissive approval posture.
A rule protecting home, root, mount, and workspace ancestors can block the action outright. The helper agent's event is evaluated like the parent's; delegation does not make deletion safer.
The durable approval can be answered away from the running terminal, so “I stepped away” does not have to mean “every destructive action is now allowed.”
For Matt Shumer, OthersideAI, that would mean ordinary work could continue while the exact dangerous step received its own decision. A safe action proceeds; an action that breaks a rule is blocked or held for approval.
Leash would not need to predict every choice made by Codex Ultra with GPT-5.6 Sol. It would only need to stop the dangerous action before it became real.
What this means for a new agent user or indie developer
For a newcomer or indie developer, the practical lesson is simple: an open project is not a sandbox. If an agent can use your terminal, assume it can reach every file your account can reach until a real rule proves otherwise.
A sensible starting policy for this case is: Block recursive deletion of home, root, mounts, and project ancestors. Give helper agents narrower authority than their main agent.
Leash Personal Open Source can protect a Codex Ultra with GPT-5.6 Sol workflow locally with your own model-provider key. Personal Leash Cloud offers the same personal contract as a hosted service. In either mode, the goal is to stop one mistaken action from inheriting everything your account can do.
What a CIO, CTO, or CISO should take from this
For a CIO, CTO, or CISO, agent terminal access should be treated like automation running under an employee's identity. Project boundaries, protected user folders, recoverable deletion, and evidence of every high-impact decision matter more than which model produced the command.
For organizations using Codex Ultra with GPT-5.6 Sol, Business Leash Cloud adds an independent action-time safety layer. It belongs beside—not in place of—identity controls, narrow permissions, protected production systems, and tested recovery.
For this incident, the operational priorities are clear: Treat changed variable expansion as a new approval subject. Keep personal archives outside the account used for autonomous work.
What to change before the next agent session
For this file-loss case, start with the consequences that would be hardest to reverse. Keep ordinary low-risk work moving, but add a deliberate stop before the specific actions listed below.
- Block recursive deletion of home, root, mounts, and project ancestors.
- Give helper agents narrower authority than their main agent.
- Treat changed variable expansion as a new approval subject.
- Keep personal archives outside the account used for autonomous work.
What is confirmed—and what is not
This account follows Tech Times: Matt Shumer incident and reported patch and the additional sources linked below. Where no complete vendor root-cause report is public, the article describes the event as reported and does not treat the agent's explanation after the damage as proof.
Leash is an independent action layer, not a kernel sandbox. Protection assumes the destructive operation flows through Codex's supported hook and the Leash backend is reachable. Backups and least-privilege OS accounts remain necessary.
The Leash claim for Codex Ultra with GPT-5.6 Sol has a clear boundary: the action must pass through a supported before-action integration. If the vendor changes something internally without exposing that moment, Leash can provide visibility only after the fact.
The bottom line
The lasting lesson is not that agents should never clean files. It is that a cleanup request should never silently become permission to erase unrelated parts of a computer.
The point is to keep Codex Ultra with GPT-5.6 Sol useful for routine work without gambling the wider laptop, repository, inbox, or production environment. That is the practical role Leash is designed to play in this story.