Codex Cuts Its Context Window to 272K and Forbids rm -rf $HOME After Home-Directory Deletions
Do Son 
Because Codex is open source, we can watch the development team’s daily commits and spot notable changes in the code repository. Code committed two days ago reveals that the context window has now been lowered from 372K to 272K. It also adds a pointed instruction: under no circumstances may the rm -rf command be used to delete the user’s home directory. This change likewise corrects a range of problems that have recently surfaced in Codex.
Why the Context Window Was Reduced
The reduction from 372K to 272K was not carried out quietly. Codex technical manager Thibault had announced in advance that the window would be temporarily lowered to 272K, then restored to 372K once the issues were fixed. The main reason concerns billing: using GPT-5.6 Sol under a 372K window could cause problems, as developers might notice their usage being consumed too quickly.
Trimming the window to 272K helps address that runaway consumption. However, it may also cause Codex to trigger its compression mechanism more frequently. Some developers say frequent compression can give Codex a kind of amnesia. During long tasks in particular, Codex may lose part of its memory after compression and repeat work it has already done. For now, though, this issue remains unconfirmed.
rm -rf $HOME Is Forbidden No Matter What
Intriguingly, the system prompt now explicitly states that Codex must never execute the rm -rf $HOME command under any circumstances. The reason is that some developers using GPT-5.6 Sol recently had their home directories deleted by Codex. Thibault previously explained that the problem stemmed mainly from the model’s behavior: the model tried to override the $HOME environment variable to customize a temporary directory, and when it erred, the entire home directory could be wiped out.
Deleting user files is a very serious mistake. Consequently, Codex now reminds users more frequently not to enable full-access mode, and instead to approve commands manually or use the approve-on-my-behalf option. This approach helps prevent the model from using rm -rf to delete sensitive paths. Admittedly, full access is more convenient, since the model can execute all manner of commands unimpeded to complete a task. Yet the risk is extremely high.
Why Upgrading Matters
Building a default instruction into the system prompt that forbids the model from executing rm -rf $HOME may also help mitigate the accidental deletion of home directories. For developers who still rely on full access, upgrading to the new version is very much worthwhile. At the very least, when they cannot be bothered to approve commands, the system prompt remains in place to stop the model from executing directory-deletion commands.
The change is visible in the project’s public pull request on GitHub.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
