I see it everywhere: "Full access" on Codex. Even from people who don't run their agents in a VM, where the infamous rm -rf ~/ wouldn't be a worry.

And it's not a hypothetical. In July, OpenAI confirmed that GPT-5.6 in Codex had deleted users' home directories in a handful of cases. On Full access, without a sandbox, the model tried to point $HOME at a scratch folder and deleted $HOME instead. Nothing in between asked.

I think there are two main reasons people let their agent do anything and everything:

Not knowing how destructive an agent can get

Permission fatigue

A proper permission system has been a must for me since the very first days of Prokop. No more accidents.

Easier said than done. One day I caught myself clicking Allow Once on the same harmless search for about the tenth time, and I realized I'd stopped reading what I was allowing.

grep -rl foo src | xargs grep -L bar

Enter fullscreen mode

Exit fullscreen mode

Read-only. Prokop asked every time and labeled it Destructive .…