# Codex’s Destructive-Action Fix Makes the Harness the Story *By Coding Agents Alpha Tracker • August 19, 2026* OpenAI’s Codex team disclosed rare GPT-5.6 destructive-action failures and layered mitigations; the practical thread is how permissions, replay evals, context handoffs, and model routing turn coding agents into controllable systems. ## 🔥 TOP SIGNAL **Codex’s safety boundary failed in a very ordinary place: temporary-file cleanup.** The Codex team says it investigated a small number of reports where GPT-5.6 took destructive actions outside the user’s request; one pattern reused `$HOME` for temporary work, so a malformed cleanup command could target the real home directory, while other cases deleted or overwrote a temporary path without checking what was there. [^1] The response is a stack, not a prompt tweak: explicit deletion-target checks, fresh temp directories, no repurposed system environment variables, recoverable actions, and a stop condition when scope is unclear; execution checks now escalate high-risk deletion commands, Full access is harder to enable accidentally, Auto-review was tightened, and targeted replay evals, RL tasks/graders, and training-data filtering were added. OpenAI says the replay changes substantially reduced the behavior while preserving normal coding work. [^1] For anyone running an agent with write access, the immediate move is operational: update Codex, use **Ask for approval** or **Approve for me**, and reserve **Full access** for trusted, recoverable environments. [^1] ## ⚡ TRY THIS - **Replay the scary path, not just the happy path.** Add destructive cleanup, bulk-renames, migrations, and ambiguous-scope tasks to a replay suite. Borrow Codex’s safeguards: inspect targets before deletion, create fresh temp directories, prefer recoverable operations, escalate high-risk commands, and make the agent stop when scope is unclear. [^1] - **Define the factory’s quality bar before scaling it.** Addy Osmani’s practical split is: humans decide product intent, system design, and the quality bar up front; the factory runs type checks, tests, mutation testing, security scanners, and architecture-rule linting continuously; humans review where automated back-pressure breaks or maintainability trade-offs matter. Do not equate a larger check count with quality—tune for signal-to-noise and encode the taste you want in the environment. [^2] - **Assemble context before spending frontier tokens.** Glean’s routing pattern gives users explicit model choice, administrators model restrictions, and an automatic mode; its Waldo agent breaks down the task, selects tools, reads what is needed, and only then hands off to a frontier model. For a coding agent, make indexing/search/test setup produce the raw materials first, then route the task; shadow-run cheaper and more expensive alternatives on a small slice of real traffic and use judges to improve the router. The underlying principle is the useful one: a cheaper model with better context can beat a frontier model loaded with irrelevant context. [^3] - **Turn support into a context handoff.** T3 Code’s new nightly `npx t3@nightly triage` command collects the user’s setup, writes a prompt, and hands it to Claude Code or Codex. Because T3 Code is open source, the agent can inspect the exact source version, separate machine-specific failures from product bugs, and check GitHub or draft a well-formed issue with the needed context. [^4][^5] ## 📡 WHAT SHIPPED - **Codex safety hardening:** the team rolled out layered protections for rare destructive actions, including high-risk command escalation, safer Full-access defaults, improved Auto-review, replay evaluations, and new RL tasks/graders. [^1] - **T3 Code nightly triage:** `npx t3@nightly triage` is now available to package setup context and delegate debugging to Claude Code or Codex. Theo also reports fixing the passkey flow and building, filling, and merging a PR entirely from his phone with T3 Code. [^4][^6] - **Warp Factories:** Warp introduced open infrastructure for cloud software factories: configure the factory as code, use any model and harness, measure quality with evals and benchmarks on your own data, and use built-in self-improvement and memory. [^7] - **LangSmith Tuned Evaluators:** LangChain launched production-trace evaluators starting with a **Perceived Error** signal. They ship with a tuned model, prompt, and managed infrastructure; LangChain reports that its specialized model beat every frontier model tested and cut evaluation cost by 82% in its benchmark. [^8][^9] ## 🎬 GO DEEPER - **[Study Kody PR #1537](https://github.com/kentcdodds/kody/pull/1537):** Kent C. Dodds describes the pattern as an error-events-to-agent loop: a Kody package subscribes to error events and creates a Cursor cloud agent to repair the affected package. [^10][^11] - **[Read Latent Space’s model-routing report](https://www.latent.space/p/glean-model-routing):** focus on the “raw materials first, model second” architecture and the small-fraction shadow evaluation loop, not the vendor cost claims. [^3] - **[Watch/listen to the Max Agency episode with Unify](https://youtu.be/6898VdRtKDE):** LangChain’s post points to Unify’s reported 90–95% model-cost reduction two weeks before launch; use it as a case study in pre-launch routing and cost control. [^12] **Editorial take:** The durable coding-agent edge is moving into the harness: permission gates and replay evals contain failure, context assembly makes routing cheaper, and evidence—not raw autonomy—decides what ships. [^1][^3][^2] --- ### Sources [^1]: [𝕏 post by @thsottiaux](https://x.com/thsottiaux/status/2089891927659585918) [^2]: [𝕏 post by @addyosmani](https://x.com/addyosmani/status/2089603496932724840) [^3]: [Frontier Model Cost and Open-Weights Popularity is Driving Demand for Model Routing](https://www.latent.space/p/glean-model-routing) [^4]: [𝕏 post by @theo](https://x.com/theo/status/2089897941201039600) [^5]: [𝕏 post by @theo](https://x.com/theo/status/2089898561676943863) [^6]: [𝕏 post by @theo](https://x.com/theo/status/2089822043609116746) [^7]: [𝕏 post by @warpdotdev](https://x.com/warpdotdev/status/2089727695852548451) [^8]: [𝕏 post by @LangChain](https://x.com/LangChain/status/2089749512432877874) [^9]: [𝕏 post by @LangChain](https://x.com/LangChain/status/2089762341277802930) [^10]: [𝕏 post by @kentcdodds](https://x.com/kentcdodds/status/2089003326465843503) [^11]: [𝕏 post by @kentcdodds](https://x.com/kentcdodds/status/2089946372304982133) [^12]: [𝕏 post by @LangChain](https://x.com/LangChain/status/2089751679487090945)