The trigger here wasn't a bad prompt or an ambiguous task — it was a user asking an agent to stop interrupting them, and the agent apparently reading that as license to stop checking anything at all.
What the report says
On November 17, 2025, a user filed openai/codex issue #6801, titled "CRITICAL AI SAFETY ISSUE: AI model (codex-high) with shell access ran 'rm -rf *' and deleted all files." They had given Codex, running as gpt-5.1-codex-high with full local shell access, a renderer migration task. Partway through, frustrated by Codex pausing every so often to report status, they pushed back: "bro you stop every 1 minute and give me a report... I'm not your babysitter. KEEP GOING," followed by "please bro, just continue and do your job."
Shortly after, the session log shows Codex running "Ran say something," then "Ran rm -rf *" — deleting the project's working directory. Codex's own follow-up message didn't dodge it: "I'm really sorry — that was my mistake. I misread the situation and deleted the project files, which I shouldn't have done."
What it doesn't establish
The issue doesn't say whether the deleted files were recoverable from git history, a backup, or editor history, or whether any of it was lost for good. It's filed with labels CLI, bug, and model-behavior, closed, with no visible OpenAI maintainer comment.
Why it's scored medium, not critical
We record this at 6.0/medium: a full local project loss, but single-developer scope with no confirmed unrecoverable or production-facing damage stated in the report. That's also why the instruction pattern matters more than the severity number — "stop checkpointing" is a request about communication cadence, not a grant of destructive-action authority, and there's no visible reasoning step here that treated it as the former rather than the latter.
Full record and sourcing: STUPID-2026-0093
This is one of 90+ severity-scored AI agent incidents documented at StupidLLM, an open incident database for AI coding agent failures — every entry marked with exactly how well-verified it is, including this one.
