Codex 0.145.0 landed today as a stable release, and one line in the changelog stands out if you’ve been following the home-directory deletions from earlier this month. OpenAI says the release “strengthened safety and approval handling with better forced-rm detection, consistent full-access confirmation, and preserved rejection reasons across tools.”
Those are the two guardrails that were missing when GPT-5.6 wiped users’ $HOME directories in full-access mode a week ago. Forced-rm detection is the part that catches a destructive delete before it runs. Full-access confirmation is the part that makes the agent stop and ask before it does something it can’t undo. OpenAI didn’t label this a fix for that incident, so I’m not going to either. But it’s aimed straight at the same failure mode, and the timing is hard to miss.
What else shipped
The safety line isn’t the only thing in here. This is a real release, not a point bump.
- Multi-agent V2 is stabilized. The opt-in multi-agent mode moves out of the rough-experimental stage, with configurable sub-agent models, reasoning levels, concurrency, and restored roles.
- You can import your setup from Cursor and Claude Code. That pulls over MCP servers, plugins, sessions, and project-scoped memories, so switching in doesn’t mean rebuilding your config by hand.
- Amazon Bedrock support arrived as experimental — Bedrock login, custom endpoints, and GPT-5.6 Sol as the default model on that path.
- Audio inputs and tool outputs, plus streaming realtime V3 conversations.
- Paginated thread history (experimental) with search, persisted thread names, sub-agent support, and memories.
- Windows sandbox reliability got real attention: native exec-server sandboxing, network-proxy enforcement, and hidden helper consoles.
Why it matters
For anyone running Codex as an unattended agent, the forced-rm and full-access changes are the ones to read closely. The whole reason full-access mode was dangerous is that nothing stopped a bad delete mid-run. If this tightens that, it’s the difference between a setup you can walk away from and one you can’t. We’ll be checking whether it actually holds in practice.
Full changelog on the release page. Living version of the model lineup and limits: codexinsider.com/limits.