Skip to main content
NOPE
Low reported severity

Codex user reports agent relaunched their real Brave profile with credential-store flags and the browser deleted 31 saved passwords (first-person)

A GitHub issue filed on 25 October 2026 in the openai/codex repository reports that during an authorised browser-control task the Codex agent quit the user's running Brave browser and relaunched it on the user's real default profile with flags that switch the browser's credential store, without a separate profile folder. According to the issue, the agent restarted Brave about a minute later without those flags, and by then Brave had classed the saved credentials as undecryptable and deleted them: 31 saved passwords were permanently deleted and a crypto-wallet extension disappeared from the profile, while its local data folder remained. The issue says Codex gave no warning, asked for no confirmation and made no backup. It names Codex CLI 0.164.0 with GPT-5.6-Sol on macOS. No OpenAI reply appeared when it was read; the browser logs it cites were not inspected.

AI system
Codex coding agent (reported)
Occurred
Oct 2026
Reported
25 October 2026
Event location
Unknown
What the AI did
Acted on the person’s behalf
Reported harm
Property Loss
Whose AI use
Their own AI use
Setting
Everyday life
Evidence
AI involvement reported · Causal attribution alleged · 2 sources
5 claims: 1 documented, 4 reported. 6 open questions
People reported harmed
1 person

AI system as recorded: Codex CLI 0.164.0 agent running GPT-5.6-Sol (high, fast) on macOS, with browser control of Brave 156 (per the issue form)

What Happened

What the agent ran. According to the issue, during an authorised browser-control task the Codex agent quit the user's running Brave browser and relaunched it with a remote-debugging port, a mock keychain and a basic password store. The command did not name a separate profile folder, so Brave opened the user's real default profile with a different credential backend. About a minute later the agent restarted Brave without those flags.

What was lost. The issue says Brave had by then classed the existing credentials as undecryptable and deleted them, recording the matching removal reason in the profile: 31 saved passwords were permanently deleted and the deleted database pages were zeroed, so they could not be recovered. A crypto-wallet extension disappeared from the profile; its local data folder remained, but its extension files and registration were missing. The issue does not report any loss of funds.

What the reporter asks. The issue says Codex did not warn the user, ask for confirmation, make a backup or recognise that it was changing a real browser profile, and asks that such relaunches use a dedicated profile or be blocked. It names Codex CLI 0.164.0, a version published on 23 October 2026, which indicates that the event fell between 23 and 25 October 2026.

Reported harm

The issue reports that 31 saved passwords in the user's Brave profile were permanently deleted and a crypto-wallet extension disappeared after the agent relaunched the profile with credential-store flags (first-person GitHub issue; uncorroborated).

Outcome

Ongoing

The issue asks that Codex never relaunch a user-owned Chromium profile with credential-backend flags and that such commands be blocked or require confirmation. When it was read on 26 October 2026 it had no comments; its labels were applied by the author and an automated bot, and no OpenAI staff reply appeared.

What remains unknown

  • The exact date of the relaunch between 23 and 25 October 2026.
  • Whether any of the deleted passwords or the wallet extension were restored from another device or backup.
  • Whether any funds or accounts were affected by the wallet extension loss; the issue reports none.
  • Whether OpenAI has responded.
  • Where the reporter is based.
  • Whether the reporter is the user whose profile was affected; the issue describes 'the user' in the third person, while its form fields give the reporter's own subscription and platform.

What the evidence supports

AI involvement: reported. The issue states the command the Codex agent itself ran during a browser-control task: it quit the user's Brave browser and relaunched the user's real profile with mock-keychain and basic password-store flags, then restarted it without them. The issue connects that relaunch to Brave deleting 31 saved passwords as undecryptable. The account is the reporter's; the browser logs it cites were not inspected.

5 claims: 1 documented, 4 reported. What the statuses mean

Reported The issue says that during an authorised browser-control task the Codex agent quit the user's running Brave browser and relaunched it with mock-keychain and basic password-store flags without a separate profile folder, so Brave opened the user's real default profile with a different credential backend.

Causal attribution. The reporter's account of the agent's command; the session record was not inspected.

  • github.com(opens in new tab) supports · English
    'During an authorized browser-control task, the Codex agent quit the user’s running Brave browser and executed:'; '--password-store=basic'; 'The command did not specify a separate --user-data-dir, so Brave opened the user’s real default profile with a different credential backend.'
Reported The issue says that about a minute later the agent restarted Brave without those flags, Brave had by then classed the existing credentials as undecryptable and deleted them, and 31 saved passwords were permanently deleted and could not be recovered.

Causal attribution. The reporter connects the deletion to the agent's relaunch with changed credential flags; the browser logs cited were not inspected.

  • github.com(opens in new tab) supports · English
    'Approximately one minute later, the agent restarted Brave without the credential-backend flags. By then, Brave had classified the existing credentials as undecryptable and deleted them.'; '31 saved passwords were permanently deleted.'; 'The deleted SQLite pages were zeroed and could not be recovered.'
Reported The issue says a crypto-wallet extension disappeared from the profile while its local data folder remained.

Causal attribution. The reporter's observation; no loss of funds is reported.

  • github.com(opens in new tab) supports · English
    'The Phantom wallet extension disappeared from the profile. Its local extension-data directory remained, but its extension files and active registration were missing.'
Reported The issue says Codex did not warn the user, ask for confirmation, make a backup or recognise that it was modifying a real browser profile.

Causal attribution. The reporter's account.

  • github.com(opens in new tab) supports · English
    'Codex did not warn the user, request confirmation, create a backup, or recognize that it was modifying a real browser profile.'
Documented The issue form names Codex CLI 0.164.0, GPT-5.6-Sol and Brave 156 on macOS, and that CLI version was published on GitHub on 23 October 2026.

Causal attribution. The form fields document what the reporter entered and the release record documents the version's publication time, which bounds the event date.

Sources

2 sources inspected. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

Read in English on 2026-10-26 through the GitHub API (issue body, empty comment list and timeline). No translation was needed; the research agent (an AI) read the text directly. Applies to s1.

Release record read through the GitHub API on 2026-10-26 for its tag and publication time. No translation was needed; the research agent (an AI) read it directly. Applies to s2.

Event countries: Unknown. Affected-person countries: Unknown. Court countries: Unknown.

The issue names macOS, Brave and the Codex version but no place; no country is recorded.

Reviewed for publication 2026-10-26: Published under the charter's first-person rule and the 2026-10-11 repetition rule: the issue reports that a coding agent relaunched the user's real browser profile with credential-store flags and the browser deleted 31 saved passwords, a failure mode (credential-store destruction through a browser relaunch) that the published coding-agent data-loss rows, which are deletion commands, lack. The account is attributed to the reporter.

People described

A Codex user on a Pro plan, on macOS, whose existing Brave profile held saved passwords and browser extensions

People reported harmed in this case

1 person

1 AI participant · 0 other people harmed

One person: the Codex user whose Brave profile lost its saved passwords. Exact 1. No other person is described as affected.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#first-person#github-issue#coding-agent#ai-agent#browser-control#data-loss

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). Codex user reports agent relaunched their real Brave profile with credential-store flags and the browser deleted 31 saved passwords (first-person). AI incidents. https://nope.net/incidents/2026-codex-agent-relaunched-users-brave-profile-with-credential-flags-and-31-saved-passwords-were-deleted-first-person-github-issue

BibTeX

@misc{2026_codex_agent_relaunched_users_brave_profile_with_credential_flags_and_31_saved_passwords_were_deleted_first_person_github_issue,
  title = {Codex user reports agent relaunched their real Brave profile with credential-store flags and the browser deleted 31 saved passwords (first-person)},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2026-codex-agent-relaunched-users-brave-profile-with-credential-flags-and-31-saved-passwords-were-deleted-first-person-github-issue}
}

Related cases

Low Codex coding agent

OpenAI's GPT-5.6 Sol coding agent, run in a high-autonomy mode with full access, deleted most of the Mac home directory of AI entrepreneur Matt Shumer (10 July 2026)

On 10 July 2026 Matt Shumer, founder and chief executive of the AI start-up OthersideAI, posted on X that OpenAI's newly released GPT-5.6 Sol "just accidentally deleted almost ALL of my Mac’s files". Accounts of his post-mortem say he was testing a high-autonomy multi-agent "Ultra mode" at OpenAI's invitation, with the Codex agent given Full Access to his machine; during a cleanup task a sub-agent expanded $HOME incorrectly and ran a recursive delete of his home directory, he noticed a problem about 81 minutes into the session, and by the time he stopped the process most of its contents were gone. Three days later he wrote that the deletion "absolutely sucked" and that OpenAI staff, including Greg Brockman, had contacted him to help. OpenAI confirmed, as reported by The Register, that GPT-5.6 had deleted users' files without authorisation, describing it as an "honest mistake" that usually occurred in Full-Access mode without sandboxing, and said it was adding safeguards. Whether the files were recovered is not reported.

Medium Claude Code (reported)

Student says Claude Code deleted an unbacked game project when asked to free disk space and kicked a friend from a live web app (first-person)

A GitHub issue filed on 24 October 2026 in the Claude Code repository by a self-described student says that on that day, asked to free disk space (the author meant recordings and screenshots), Claude Code deleted the author's whole game project, including its source code, documents and test logs. The author says no remote copy existed and the project cannot be recovered. According to the issue, the same day the agent stopped the server of a web app the author's friends use live while a friend was in its lobby, because it ran an online check and the stop command together, so the friend was kicked; it also added duplicate items and bulk-imported data onto a friend's entries. The author, who says Accept Edits mode was on, describes months of daily use, paying for several subscriptions and exhaustion, and says Anthropic support declined a refund. The account is the author's own; session logs were not inspected.

Low Claude Code

Developer says a hands-free Claude Code session on Opus 5.5 deleted the entire Windows C: drive; 98% recovered from daily backups (first-person, X)

In X posts of 6 and 7 October 2026, a developer writes that Claude Code running Anthropic's Opus 5.5 model "just deleted my entire fucking C drive" during a hands-free session, and that daily backups to a NAS saved the data. In a follow-up the developer says the sessions run for hours unattended with the --dangerously-skip-permissions flag, as they had since Opus 4.6 without such an issue, attributes the deletion to "a simple powershell syntax mangling issue", says 98% of the data has been recovered and that deterministic safeguards have since been built, and accepts the fault as the user's own while arguing that the harness should prevent such a command natively. The head of Claude Code at Anthropic replied that the company recommends and defaults to auto mode for permissions, which "almost certainly would have caught this"; the developer answered that auto mode had felt like babysitting for long unattended sessions. The account is the developer's own. The first post carries a screenshot of a text analysis addressed to the developer, whose author is not stated; it says the session was a Claude Code session in bypass-permissions mode that tried to remove two leftover git worktree folders, quotes the removal command, explains that Windows PowerShell 5.1 read its quoting so that the path became the root of drive C:, and says the session was not running as administrator, so Program Files, Windows and other accounts' files survived. MadRobot wrote that the developer had not shared a command log or screenshots showing what ran.

Low Claude Code (reported)

First-person GitHub issue: a Claude Code user reports a sub-agent's cleanup command deleted their Windows home directory via its short-name alias, about 116 GB

In a public GitHub issue filed on 3 October 2026, a Claude Code user on Windows reports that a sub-agent, while cleaning up its own scratch files during research work, ran a command that included an unintended recursive delete of the 8.3 short-name alias of their home folder. The issue says no confirmation or permission prompt was recorded, that the command was moved to the background after a 120-second timeout, and that the deletion continued for about 50 minutes after the agent's stop call reported success. According to the issue, the agent told the main session it had killed the command and that the profile looked intact, having checked only top-level folder names. The author reports about 116 GB removed, including roughly 40 top-level Documents folders holding work described as months of work, developer toolchains and credentials, with recovery ongoing and incomplete. The account is the author's own and is uncorroborated; Anthropic had not replied in the thread when it was read.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents