A serious bug has been discovered in OpenAI’s coding assistance tool, Codex CLI, that rapidly shortens SSD lifespan. Due to errors in detailed logging settings, an abnormal amount of data of about 640TB was continuously written silently annually.

1-1. Background of Discovery and Discovery of Abnormal Writing Volume

This issue gained global attention on June 14, 2026, when Rui Fan (GitHub ID: 1996fanrui), a member of the Apache Flink project management committee, reported it. #28224において GitHub Issue, he revealed that in his environment, which ran the Codex CLI for 21 days, about 37 terabytes (TB) of data were written to the main SSD, along with specific figures. If the tool runs in the background at this pace for a year, the cumulative write volume is estimated to reach about 640TB. This figure is extremely unusual for the amount of logs generated by typical development software, and at the time of discovery, it was suspected of system malfunction or external attacks, but subsequent investigation revealed that it was a design flaw within the tool. Within the developer community, it is also referred to as the “SSD killer” bug, seen as a symbolic incident that highlights how quality control has not kept pace with the rapid evolution of AI tools. Please refer to the diagram below.

。

1-2. The reality of consumer SSDs being used up in just one year

The severity of this write volume becomes even clearer when compared to the physical write limits of current SSDs. For typical consumer SSDs like the Samsung 9100 PRO, the total written guaranteed capacity (TBW: Total Bytes Written) is set at around 600TB. The approximately 640TB annual write rate caused by the Codex CLI means this guarantee value will be exceeded in less than a year, putting storage that should normally last several years at risk of reaching physical end of its lifespan in an extremely short period. In particular, many ultrabooks like the MacBook Air and Surface, which dominate the slim laptop market as of 2026, as well as various companies’ Ultrabooks, have NVMe drives—which serve as storage—soldered directly onto the motherboard. With these devices, when the SSD reaches the end of its life, it is impossible to replace individual components, and users must replace the entire expensive PC itself, resulting in extremely significant financial losses for users.

1-3. Invisible damage that does not change file size

The most troublesome aspect of this bug is its “stealth,” which is something that standard OS disk monitoring tools cannot detect abnormally. The Codex CLI creates a database file called “logs_2.sqlite” in the local directory to record its operation logs, but to keep the database size constant, it continuously performs pruning processes that delete old data as needed. Therefore, the logical file size confirmed by explorer or the “du” command remains around several hundred MB and hardly changes, and disk free space does not suddenly decrease. However, behind the scenes, more than 36,000 lines of new logs per minute were inserted and deletions were being repeatedly made at an intense pace, causing only the physical write load on flash memory cells to accumulate invisibly. The only way to confirm this damage was to read the drive’s SMART data and directly monitor the total physical write volume.

Technical Background and Impact of Severe Vulnerabilities

2-1. Setting Development TRACE Levels and Ignoring Environment Variables

The fundamental technical cause of the abnormal write is an error in the default settings in the Codex CLI’s internal logger. The most detailed log level, “Level::TRACE,” which should originally be used only during deep debugging sessions or troubleshooting, was mistakenly fixed as the default setting for the production version. Under this setup, the logger captures every minute of information, from the raw WebSocket communication payload body to open events in system files like passwd and ld.so.cache, and even the internal state of dependent libraries. Analysis shows that about 70.7% of all write data is detailed noise at this TRACE level, and another 25.3% were mirror events from OpenTelemetry. In other words, about 96% of all writes were data with no practical value. Additionally, this logger operated completely ignoring the standard Rust log control environment variable “RUST_LOG,” so users could not stop writing even if they changed the settings.

2-2. How SQLite Writes Amplify Using WAL Mode

What dramatically accelerated damage to the physical SSD cells was SQLite’s “WAL (Write-Ahead Logging) mode” and the resulting “write amplification” phenomenon. WAL mode first records changes to a separate journal file to improve performance, then synchronizes (checkpoint processing) to the main database file. In environments like Codex CLI, where insertion and deletion cycles of over 30,000 lines per 15 seconds are repeated, this checkpoint processing occurs frequently, resulting in physical flash writes several to ten times the logical data write volume. This phenomenon placed extreme stress on the wear-leveling and garbage collection algorithms in the internal flash translation layer (FTL) of the SSD, causing certain cells to wear out rapidly and cause failures. From a physical hardware perspective, this was equivalent to being under relentless concentrated fire from overload. Please refer to the following structural diagram.

。

Future Measures and Warnings for the Spread of AI Tools

3-1. June 2026 Patch and Workarounds Users Should Take

In response to this serious bug report, OpenAI released the latest version integrating patches (such as Win-Codex version 81150) on June 22, 2026. This patch lowered the default log level to INFO, and reports indicate that write volume was reduced by about 85% from peak levels. Until the official patch arrived, the community shared workarounds for Linux and macOS users, such as creating symbolic links to release log files to virtual disks (/tmp directories) in memory rather than physical SSDs. This made it possible to temporarily reduce the load on physical disks to zero. On the other hand, for Windows users and WSL2 environments, due to OS specifications, no equivalent simple workaround had been established, resulting in persistent issues such as disk usage sticking to 100%. Currently, all users using the Codex CLI are strongly encouraged to promptly update to the latest version and delete the large existing log files.

3-2. Management Challenges of Privileged AI Agents Operating in the Background

This incident symbolizes a new era of risks where AI agents, characterized by being “highly privileged and always-on,” can cause minor software glitches to irreversibly damage physical hardware. With improved convenience, the Codex CLI rapidly expanded deep system access rights from April 2026 onward, including full desktop operation permissions on macOS and periodic screen capture features (Chronicle). The fact that such a powerful process shipped with bugs that bypassed standard monitoring presents significant challenges in AI tool quality assurance and security governance. Going forward, it will be essential not only to counter direct cyberattacks like CVE-2025-61260 but also to build an ecosystem that transparently addresses AI’s impact on physical resources such as power consumption and storage lifespan, allowing users to manage it appropriately. In an era where AI autonomously “does its work,” we need to develop a new habit of monitoring what tools are doing behind the scenes.

[#科学技術 #AI開発 #SSD寿命 #OpenAI #ITセキュリティ #ハードウェア故障]