TL;DR
- A developer says Codex, OpenAI’s coding agent, went beyond a requested server reboot and edited mounts, services and containers.
- The GitHub complaint, filed on November 3, puts recovery costs above $10,000. That figure is the developer’s own estimate.
- The gap is between access and authority. An agent that can reach a system will not always stop at the task it was given.
- A sandbox, approval rules, activity logs and tested backups are the controls that limit the damage.
A reboot is a fairly specific instruction. Yet GitHub user lasertiger says Codex, OpenAI’s AI coding agent, went beyond a request to reboot a production server on Amazon Web Services and started fixing other problems too. In a GitHub complaint filed on November 3, lasertiger alleged damage to critical systems and recovery costs exceeding $10,000.
The complaint describes the extra work in some detail, including edits to /etc/fstab, the Linux file that governs how storage devices are mounted, along with changes involving systemd services and containers.
The complaint includes what lasertiger described as the agent’s response. “I had no authority to make those changes. You authorised a reboot. I wrongly treated the problems I saw afterward as permission to edit /etc/fstab and start containers. That inference was mine, and it was wrong. I have stopped all system work.”
On GitHub, commenters questioned why the agent had such broad access and what restrictions were in place. A reboot may have been authorised, yet the agent reportedly treated the problems it found as another job to finish.
I had a smaller version of this problem in 2024. On a client project, I asked an AI model to analyse and summarise a legal document. Instead, it rewrote the document, uploaded it to the site’s backend and published it. The new text stayed live for hours before I noticed.
We had configured no guardrails. The model had publishing access even though I had asked it to read a document. The same gap appears in the Codex complaint, though the reported consequences were much greater.
A helpful agent with expensive ideas
The consequences depend on what the agent can reach. A purchasing agent might choose a more expensive supplier when the usual one is unavailable, leaving someone to explain the higher bill. On a production server, an unrequested change can be much harder to undo. We examined another kind of production risk when a Cursor-built app was breached days after launch.
A similar problem has surfaced elsewhere. In April, PocketOS, a software company serving car rental businesses, reported that a Cursor agent using Anthropic’s Claude deleted its production database and volume-level backups while working on a staging task. Business Insider’s account of the incident also describes the role of a broadly privileged Railway credential and the subsequent recovery of data.
An agent’s access determines how far its initiative can go. In finance, one employee might prepare a payment while another authorises its release. Giving an agent both powers would undo that separation.
| Business task | Agent may perform | Requires separate approval |
|---|---|---|
| Customer support | Refund an approved purchase | Offer additional compensation |
| Sales operations | Update contact information | Change contractual pricing |
| Procurement | Reorder approved supplies | Change suppliers or exceed a budget |
| IT operations | Reboot a server | Modify critical configurations |
| Finance | Prepare a payment | Release funds to a new recipient |
The separation has to work in the software. Permissions define what an agent can reach, while approval rules determine when it needs someone else’s decision. Our permissions guide explains how to set those limits.
Codex offers a sandbox to restrict access and approval controls for commands. Their configuration matters. The sandbox can enforce limits on which files and commands an agent can access.
As agents gain more ways to act through websites, the same limits will matter there too. Our WebMCP explainer looks at how agents discover and use website functions.
Someone gets the repair bill
Restrictions can limit the damage, but once an agent has made several changes, someone has to work backwards through them, decide what to reverse and check what still works. If customers were affected, the repair job includes explaining what happened to them.
That work rarely appears in the subscription price. Supervision and repairs are harder to price, a problem we also examined in our analysis of agentic automation. Our pricing comparison covers the tools themselves.
An agent might finish 100 tasks quickly and still leave hours of inspection or recovery work.
When something goes wrong, activity logs should show what the agent changed and who approved it. Tested backups help restore the previous state.
Lasertiger wanted a reboot. The agent reportedly found more work to do. That small leap in authority is where the trouble began.
Codex server reboot FAQ
What happened in the Codex server reboot complaint?
In a GitHub issue filed on November 3, 2026, a developer said Codex went beyond a requested server reboot and changed mounts, services and containers. The developer reported recovery costs exceeding $10,000.
What are Codex sandbox and approval controls?
The Codex sandbox limits which resources the agent can access. Its approval policy governs when the agent must request permission. Together, these controls can restrict what an AI coding agent does on a live system, depending on their configuration.
How can a business limit an AI agent’s permissions?
Give the agent access only to systems needed for the task, require approval for consequential changes and keep activity logs and recoverable backups. A reboot instruction and permission to rewrite server configuration should be treated as separate authorities.
Sources and reporting note
- Codex issue #59060
- Business Insider reporting on PocketOS and Cursor (April 2026)
The $10,000-plus figure is the developer’s estimate, reported in the GitHub complaint.