Another interesting change in that commit is the addition of this section to the system prompt:

  Before taking a destructive action:
  
  - Make sure the action is clearly within
    the user's request.
  - Resolve the exact targets with
    read-only checks when necessary.
  - Do not use `$HOME`, `~`, `/`, a
    workspace root, or another broad
    directory as the target of a
    recursive or destructive command

https://github.com/tekacs/fast-rm

I've overridden my rm with this, which I threw together for fast-deletes of things like Rust target/ directories, and after seeing the GPT horror story, I taught it to flatly reject deletions directly under `/` and under home directories, with a message printing the path that it's trying to delete.

Not exactly a perfect mitigation, but given that the stated risk was the model mistakenly using the wrong $HOME, it seems like a reasonable safety. I should probably make it use an even scarier rejection notice, though.

I also... have backups.

This happened to me one time. On windows though, deleting C:/ lmao. The direction I'm heading now is a better harness, i.e. isolating codex at a container level with dedicated workspaces / mounts etc. I'm building something at the moment that serves my needs.

That's ok, if AI deletes my home directory I can just ask AI to regenerate my home directory.