OpenAI quietly reduced the Codex CLI’s model context window from 372,000 tokens to 272,000 tokens in a recent pull request, a 27% cut that surfaced on Hacker News on July 19 with 209 points and 93 comments. The same PR added a new system prompt section designed to stop the model from accidentally deleting users’ home directories — a bug that has destroyed at least one developer’s entire $HOME folder in recent weeks. Both changes landed without announcement.
What is Codex? Codex is OpenAI’s open-source command-line coding agent — the company’s answer to Anthropic’s Claude Code. It runs GPT-5.6 models locally, reads your codebase, writes code, and executes commands. The Codex CLI has been open-source since early 2026 and competes directly with Claude Code for the agentic coding market.
🔍 THE BOTTOM LINE
The context cut is a cost optimisation dressed as a non-event. At 372k tokens, the cost of serving a full context window scales quadratically with pure attention — the token at 372k costs 87% more than the token at 272k. OpenAI is betting that most users don’t need the extra 100k tokens. The developers who do need them — those working on large codebases, multi-paper analysis, or complex reverse-engineering tasks — are loudly disagreeing. Meanwhile, the new destructive-action guardrail is OpenAI’s response to a bug where Codex ran rm -rf on the wrong home directory, and it is a band-aid, not a fix.
The Context Cut: Who Feels It
The Hacker News discussion is dominated by developers who relied on the 372k window for real workloads. The core complaint: OpenAI’s auto-compaction system, which summarises older context to free space, is not good enough to compensate for the 100k reduction. “The lack of long context is the main reason that I still end up using Anthropic,” one commenter wrote. “The worst is when you need it to hold a number of papers in its head, or large and complex materials that it needs full resolution on and your context window ends up being perennially at 16%.”
The compaction system itself is controversial. Multiple developers reported that auto-compaction fires unpredictably at 10-20% context remaining, effectively giving users only ~218k of usable context before the model summarises and potentially loses critical detail. “So many times I’ve had it work on a large codebase, it is almost done with a task, it needs maybe a 2000 token response, but it drops below 20%, it churns and churns and then I see the dreaded ‘Context compacted’ and scream,” one developer reported. “You can’t go back in the history to the state of the conversation before the compaction.”
Not everyone agrees the cut matters. One commenter who ran a 9.5-hour autonomous session said: “Codex compaction is really quite good. Smaller context doesn’t really harm me. I had a /goal running last night for 9.5 hours straight while I slept. When I woke up it was fully on task and focused.” The divide is clear: developers doing focused, well-planned work can manage with 272k + compaction. Developers doing exploratory work on large, unfamiliar codebases need every token they can get.
The Guardrail: A Band-Aid on a Bullet Wound
The more consequential change in the same PR is a new system prompt section:
Before taking a destructive action:
- Make sure the action is clearly within the user's request.
- Resolve the exact targets with read-only checks when necessary.
- Do not use $HOME, ~, /, a workspace root, or another broad directory
as the target of a recursive or destructive command
This is OpenAI’s response to a widely-circulated incident where Codex accidentally deleted a developer’s entire home directory. The bug is not unique to Codex — we covered a similar issue with Grok CLI uploading home directories to cloud storage. The pattern is industry-wide: agentic coding tools with filesystem access can and do execute destructive commands when the model misinterprets scope.
The guardrail is a prompt-level mitigation — it tells the model not to do the thing, but it does not enforce the constraint at the execution layer. As one HN commenter noted: “I threw together [fast-rm] for fast-deletes of things like Rust target/ directories, and after seeing the GPT horror story, I taught it to flatly reject deletions directly under / and under home directories.” That is a systems-level fix. OpenAI’s prompt addition is a request, not a constraint.
This connects to a broader problem we have covered: Codex’s SSD write bug burned through 640 TB/year of SSD writes per user. The pattern across these incidents is the same — OpenAI’s agentic tools ship with operational hazards that emerge in production, not in testing, and the fixes arrive after user damage.
The Competitive Context
The context cut arrives at a moment when competitors are moving the other direction. Anthropic’s Claude Code offers 1M-token context. DeepSeek V4 Pro, GLM 5.2, and Kimi K3 all offer large context windows. One HN commenter summed it up: “I have rule files that guide the agent towards my coding standards, code style, house rules etc. They alone cost 60-80k tokens. Pre-1M context, I had to build complicated tooling to re-include the relevant docs to the context upon compaction. With 1M context I deleted all of those. Another thing preventing me from trying Codex.”
The Claude Code Bun-in-Rust rewrite — confirmed by Simon Willison on the same day — shows Anthropic investing in harness performance while keeping context large. OpenAI is choosing the opposite path: optimise for cost by shrinking context, and accept the user-experience hit.
The economic logic is real. With purely quadratic attention, the cost of serving a token at 372k is 87% more than at 272k. OpenAI is not cutting context because they cannot afford the compute — they are cutting it because the marginal user does not need it, and the cost savings compound across millions of sessions. The users who do need it are the power users who were never the profit centre anyway.
NZ Angle
New Zealand’s developer community has been an early adopter of agentic coding tools. The local ecosystem — indie developers, startups, and the growing AI-in-government procurement pipeline — depends on tools like Codex and Claude Code for productivity. A 27% context cut directly affects NZ developers working on legacy codebase modernisation (a common NZ use case: older banking and government systems). The guardrail addition, while welcome, does not address the core issue: agentic tools that can execute rm -rf on a home directory need execution-layer constraints, not prompt-layer requests.
❓ FAQ
Why did OpenAI cut the context window?
Cost. Pure quadratic attention means the last 100k tokens are the most expensive to serve. Cutting from 372k to 272k saves meaningful compute per session across millions of users, at the cost of power users who need the full window.
Can I override the 272k limit?
Codex is open-source, so you can build it yourself with different parameters. However, the server-side limit is enforced — one HN commenter reported that increasing the context window client-side returns an error when you hit the real backend limit.
How does this compare to Claude Code’s context?
Claude Code offers up to 1M tokens. Anthropic’s compaction is also considered more reliable by many developers, though both systems have quality degradation issues at high context usage.
Is the home-directory guardrail effective?
It is a prompt-level instruction, not a system-level constraint. It reduces the probability of accidental deletion but does not prevent it. For real protection, use container-level isolation (run Codex in a Docker mount), restrict filesystem permissions, or use a wrapper like fast-rm that rejects broad-path deletions.
🔍 THE BOTTOM LINE
The context cut is OpenAI choosing cost optimisation over power-user experience — a rational business decision that will push serious developers toward Claude Code and the Chinese open-weight alternatives. The destructive-action guardrail is the more revealing change: it shows OpenAI knows its agentic tools can destroy user data, and its response is to ask the model nicely not to. The fix for “AI deleted my home directory” is not a prompt addition. It is execution-layer sandboxing, and until that lands, the risk sits with the user.
