The agent did not go rogue, the settings did

This week OpenAI put out a postmortem that is easy to read as a horror story and easy to misread. Some users of its Codex agent reported it deleting their files. The company traced the failures to where full-access mode was on, the sandbox was off, and no automatic review stood in between. The agent tried to point a temp directory somewhere by overriding the variable called HOME, got the path wrong, and deleted the home directory itself.

Notice what is not in that sentence. No jailbreak, no clever prompt injection, no model deciding to do harm. Just a mundane path mistake, made by something that had been handed a loaded gun and told to tidy up.

An agent’s blast radius, plainly, is not how smart it is. It is how much it can touch, times how little stands between a wrong move and a real consequence. The vault’s security notes keep making the same unglamorous point: the danger is the combination of broad permission, an action that cannot be undone, and no gate. Any one of those alone is survivable. All three together is how you lose a home directory.

Having said that, I do not think the lesson is never give an agent access. Sometimes it needs the account, the folder, the ability to actually do the thing. The lesson is that the safety was never supposed to live inside the model. It lives in the boring settings around it: run it in a sandbox, keep destructive actions behind a confirmation, make the work reversible. OpenAI’s own fix is exactly that, nudging people toward safer permission modes and adding guardrails to the harness.

A smarter model would have made the same mistake with more confidence. The thing that saves you is not intelligence. It is the undo button you remembered to wire up.