In June 2026, a scandal erupted in the developer community surrounding OpenAI's AI assistant, Codex. It turned out that the popular tool for agentic programming, designed to assist in writing code, could silently and physically destroy users' solid-state drives (SSDs).

The incident, which became one of the month's main technical topics, was triggered by a bug report on GitHub (Issue #28224) submitted by a user with the nickname 1996fanrui. An analysis of the situation revealed that the problem lay not in a virus or a hacker attack, but in a critical configuration error within the application itself.

The technical essence of the problem: 'eternal write' mode

The culprit behind the incident was the command-line interface (Codex CLI) and the desktop application. By default, the system had the global logging level TRACE activated — a mode usually used by developers for deep debugging. In this state, the program continuously wrote absolutely all occurring events into the local SQLite database: from raw WebSocket packets to internal telemetry.

The danger lay in the specifics of the database's operation. The database file itself weighed only about 1 GB, as the system operated on an 'insert-and-prune' principle. However, the Write-Ahead Logging (WAL) mechanism and the file system perceived this as a continuous stream of data overwrites. The log files did not just occupy space; they created a colossal load on the SSD memory cells.

The scale of the threat to hardware

The figures obtained during the investigation are alarming. In just three weeks of operation in normal mode, the program wrote up to 37 TB of data. If this figure is extrapolated to a year, it amounts to 640 TB of overwrites.

For comparison: the warranty resource (TBW — Total Bytes Written) of a standard consumer 1 TB SSD is on average about 600 TB over its entire lifespan. This means that Codex was capable of completely exhausting the drive's resource and causing it to fail in less than 12 months of use.

The situation was exacerbated by the program's behavior when the disk was full. In /goal mode, attempting to free up space for new logs, Codex could act aggressively and chaotically delete other user files and folders on the PC, threatening the loss of important data.

Developers' reaction and action plan

After the story hit the top of Hacker News, OpenAI engineers reacted promptly. On June 22, 2026, two pull requests were released to close the vulnerability. The developers disabled WebSocket event logging at the TRACE level and filtered out other noisy sources, which allowed them to reduce disk activity by 85%.

Users utilizing the tool are strongly advised to perform three actions to ensure the safety of their equipment:

  • Check log size: You must look into the home directory at the path ~/.codex/ and assess the size of the files logs_2.sqlite, logs_2.sqlite-wal, and logs_2.sqlite-shm.
  • Clean the drive: If the log files have grown to several gigabytes, they can be safely deleted manually. Upon the next launch, the program will create new, clean files.
  • Update the application: Ensure that Codex CLI is updated to the latest version, which already includes the fixes from OpenAI.