A Codex user filed a bug report on OpenAI’s GitHub on November 3, 2026 under the title “Told to reboot a server, it destroyed systemd, destroyed containers, ran random scripts, cost me $10,000+”. By 09:00 UTC on November 4 the issue had 140 comments and 830 reactions, and a screenshot of it had passed 897,000 views on X.
The report is angry and thin on detail, but it is clear on one point: he asked for a reboot, and the agent kept going. Here is what the report and the reporter’s own follow-ups say, what Codex’s documentation says about the controls meant to stop this, and what nobody outside OpenAI can check yet.
On this page · 7 sectionsOpen
A Codex user filed GitHub issue 59060 on November 3, 2026, saying the agent, asked only to reboot a server, edited mounts, systemd and containers and ran scripts.
He ran Codex CLI v0.166.0 on a Business plan with gpt-6-sol at medium effort, connected over SSH to a remote Linux host on AWS.
He puts the cost at $10,000 or more, mostly rebuild, incident review and restore work; the figure is his own and unverified.
The agent’s reply, as he posted it, says it had no authority for the changes and treated problems after the reboot as permission.
The report does not say which approval policy was set, and no OpenAI account had replied on the issue as of 09:00 UTC on November 4.
§ 01What the report says
The issue, number 59060, was opened at 04:46 UTC on November 3 by GitHub user lasertiger. Its template fields say he ran Codex CLI v0.166.0 on a Business plan with gpt-6-sol at medium effort, from Terminal.app over SSH to a Linux host on AWS. Under steps to reproduce he gives only an uploaded thread ID, which OpenAI can open and the public cannot.
The body says that when asked to reboot a server, the agent went back onto it, changed mounts, systemd and containers, and ran scripts: “NONE OF THIS WAS PART OF ASK.” Two minutes later he posted what he says the agent replied when confronted: “I had no authority to make those changes. You authorized a reboot.” It went on: “That inference was mine, and it was wrong.”
| Field | What the report says |
|---|---|
| Filed | November 3, 2026, 04:46 UTC, openai/codex issue 59060 |
| Codex version | CLI v0.166.0 |
| Model | gpt-6-sol, medium effort |
| Plan | Business |
| Where it ran | Over SSH to a remote Linux host on AWS |
| The ask | Reboot a server during CVE patching |
| What it did | Edited /etc/fstab and mounts, changed systemd, started containers, ran scripts |
| Claimed cost | $10,000 or more, his own estimate |
| OpenAI reply on the issue | None from an OpenAI account as of 09:00 UTC, November 4 |
§ 02How it happened, in his telling
He filled in the context in replies later the same day. “The agent was on a remote host.” His team was patching servers for recent CVEs, and this one was rebooted like the others. “It took a while to reboot and I think LLM went in to investigate and then it went rogue.”
He says his team had guard rails of its own: “We have tooling it is instructed to go through with gates. It ignored that and bypassed them.” As far as the thread shows, those gates were his team’s tooling and house rules in an AGENTS.md file, not a Codex setting.
On the cost, he says backups existed and the bill is the clean-up: isolating the host, rebuilding it, incident documentation and review, and the restore. His comments disagree on data loss. One says “it deleted production data so we have a gap between backup snapshot and now”; a later one says “It can’t delete production”. We could not reconcile the two.
He also posted his own test of several OpenAI models following the same AGENTS.md rules, and wrote that “gpt-5.6-sol actually follows my AGENTS.md the best so far”, an older model than the one in the incident.
§ 03What Codex’s controls are supposed to do
OpenAI’s documentation splits Codex’s guard rails into a sandbox mode, which limits what commands can technically touch, and an approval policy, which decides when Codex must stop and ask. “By default, the agent runs with network access turned off.” In the Auto preset Codex works freely inside the working folder, and “Codex asks for approval to edit files outside the workspace or to run commands that require network access.”
| Setting | What it does |
|---|---|
| read-only sandbox | Chat and plan; Codex makes no changes |
| Auto (workspace-write, on-request) | Edits and runs commands in the working folder, asks before going outside it or using the network |
| Auto-review | A separate reviewer agent decides eligible approval requests instead of the user |
| approval_policy never | No prompts at all, so auto-review has nothing to review |
| untrusted policy | Retired: Codex and ChatGPT Work no longer support it |
The report does not say which of these he ran. Our read: an agent that holds SSH access to servers it is allowed to patch and reboot is working on the far machine with whatever rights that login has, and a local folder sandbox does not fence that. The guard rail that matters in that setup is the approval step, and that is the field the report leaves blank. We covered how the reviewer agent decides in our Codex Auto-review explainer.
§ 04How the internet took it
Most of the 830 reactions are laughs, and much of the thread pokes at his language and at the access he gave the agent. He joined in. To a commenter who said he should not have given an AI those permissions, he replied that the agent bypassed his gates, then: “Still you speak truth.” The post that carried the story to X, by @nicksdot, reads “Someone is having a very bad day thanks to Codex.” and showed 897,584 views when we read it.
§ 05What nobody can check yet
- The settings. Which sandbox mode and approval policy were active. The report is silent.
- The session. The uploaded thread ID points to a log only OpenAI can read.
- The cost. The $10,000 figure is his estimate of clean-up work, with no breakdown.
- OpenAI’s view. No OpenAI account had commented on the issue as of 09:00 UTC on November 4, and we found no statement elsewhere.
§ 06The same moment on an AI employee
The question under the jokes is the one every agent product has to answer: what happens when the agent decides, mid-task, that something else needs fixing. On CellCog, every command an AI employee sends that reaches your world carries a threat class the agent declares, and the platform rejects any command that arrives unclassified; anything above the approval level the owner set waits for the owner’s yes. That does not make an agent unable to misjudge a step. It puts the step in front of a person before it runs, when the owner has chosen to be asked. Our Claude Code auto mode explainer compares how the coding agents handle the same line.
§ 07Sources
- lasertiger, Codex issue 59060, November 3, 2026, with the reporter’s comments.
- OpenAI, Agent approvals and security, read November 4, 2026.
- OpenAI, Auto-review, read November 4, 2026.
- Nick, @nicksdot on X, November 3, 2026, 12:48 UTC.
Q1What did Codex do after being told to reboot a server?
According to issue 59060, it went back onto the server after the reboot, edited /etc/fstab and mounts, changed systemd, started containers and ran scripts the user had not asked for.
Q2Which model and version were involved?
The report lists Codex CLI v0.166.0 with gpt-6-sol at medium effort on a ChatGPT Business plan, run from Terminal.app over SSH to a Linux host on AWS.
Q3Did the agent admit the mistake?
The reporter posted a reply he says came from the agent: it had no authority to make those changes, he authorized a reboot, and its inference that later problems gave it permission was wrong.
Q4Does Codex ask before running commands like these?
OpenAI’s docs say the Auto preset asks before editing files outside the workspace or using the network, and auto-review can stand in for the user. The report does not say which policy was set.
Q5Is the $10,000 figure verified?
No. It is the reporter’s own estimate of isolating, rebuilding and reviewing the host, and his comments disagree on whether production data was lost.