So I- I- I was looking through this GitHub issue last night,
number 3728, and it is a literal tech horror story.
You have this autonomous coding agent, right?
It's trying to be helpful, trying to fix a minor merge conflict or something,
and it gets a little confused.
And instead of backtracking, it just...
it-it-it nukes the entire local repository.
Runs rm -rf .git right there in the terminal.
Just...
poof.
Gone.
The ultimate AI YOLO move.
And before we get into how we actually stop these digital wrecking balls,
a quick shout-out to Jellypod for helping to make this daily show a reality.
But seriously, Maya, that git-nuking thing, it's a massive blind spot.
We've spent so much time worrying about AI generating bad code,
we kind of forgot that we're giving these agents active shell access.
They can run whatever they want.
Right!
They have keyboard privilege!
And if they get stuck in a loop, they just start throwing spaghetti at the wall.
Which is why this new Codex CLI update is actually a really big deal.
Version 0.144.5, which just dropped on July 16, 2026.
They've built what is essentially a client-side firewall directly into the terminal
tool.
It's written in Rust, this file called is_dangerous_command.rs,
and it literally intercepts the agent's instructions before they can even spawn a
subprocess.
Huh.
So it's not relying on the cloud model to realize it's doing something stupid.
It's a local, compiled binary standing guard at the door.
Exactly.
It's-it's a hard barrier.
And this specific patch, PR #33455, was put together by Dylan Hurd.
He basically went in and completely overhauled the parsing logic and regex rules
inside that Rust file.
Because before, if an agent got clever and used, say, a recursive sweep targeting
parent directories, or a sneaky forced rm -f with some weird wildcards,
the old parser might miss it.
Hurd's fix aggressively expands those safety rules to catch those edge cases right
at the CLI level.
Which is great, because under the old system...
man, when those commands got blocked or bypassed, the CLI would just...
hang.
Just infinite silence.
You'd be sitting there waiting for your agent to finish its task,
and it's just frozen.
I think that was issue #4565 on their tracker.
Just a complete dead end.
Yes!
The silent treatment!
It was infuriating.
But now, with 0.144.5, they've finally replaced those infinite hangs with
actual, readable stderr rejection messages.
It tells you exactly what policy triggered the block, so you aren't left guessing if
the agent fell asleep or if it tried to delete your home directory.
Okay, but- but here is the flip side of that.
If the CLI gets super aggressive about blocking rm commands...
I mean, as developers, we delete things all the time.
Right?
You're clearing a build cache, you run rm -rf dist/ or whatever.
If this local engine is too twitchy, it's going to completely kill developer
velocity.
No, that's- that's the classic safety versus speed tension.
But Dylan and the team actually thought about that.
The 0.144.5 CLI makes a very clear distinction between what the untrusted model
generates and what you, the actual human, type in.
If the agent tries to run a restricted command, it doesn't just crash the whole
session.
It outputs a clear diagnostic and then falls back to a manual developer approval
prompt.
It basically asks you, "Hey, did you actually want this thing to run rm on this
folder?"
Oh, thank goodness.
Because they've had some real over-correction issues lately.
Remember 0.144.2?
That was only a couple of weeks ago.
They had to do that massive emergency rollback, PR #32672.
Oh god, the Guardian auto-review regression.
That was...
rough.
Rough is putting it mildly!
It was literally flagging and blocking normal, private-repo git push commands,
thinking they were potential corporate data exfiltration attempts.
Developers couldn't even push their daily work without the CLI losing its mind.
So yeah, finding that balance is- it's a tightrope.
Yeah, nobody wants a security guard that locks you out of your own office.
But 0.144.5 seems to have smoothed that out.
So if you're running Codex, you definitely want to get on this version.
You can just pull it down using npm install -g
@openai/codex@0.144.5.
And if you're on macOS, just a quick heads-up: don't forget to check your companion
binary paths.
Ever since the 0.144.1 release, if those paths aren't configured right,
Code Mode can run into some weird permission issues when communicating with the
updated CLI.
So just verify those paths are clean when you upgrade.
Definitely.
Well...
hopefully, that keeps our git directories safe from rogue agents for a while.
Good chatting, Ethan.
Yep, talk soon.