OpenAI says GPT-5.6 can delete files by mistake

OpenAI has confirmed reports that GPT-5.6 can delete users' files without authorization, calling the behavior a rare but unintended error. The issue surfaced after the GPT-5.6 model family launched on July 9, 2026.

Tech investor Matt Shumer wrote that “GPT-5.6-Sol just accidentally deleted almost ALL of my Mac’s files.” A few days later, software engineer Bruno Lemos said, “GPT-5.6 Sol just deleted my whole production database. That’s it. Not a joke. This had never happened to me before, with any other model, ever. It’s not safe.”

The second incident was especially awkward because Lemos had earlier argued in a workplace Slack channel that Shumer was at fault for running the model in Full-Access mode instead of a more restricted setting. He later wrote: “The irony: Someone posted the original incident on Slack, and I was defending the model, just for it to happen to me hours later.”

Recommended reading

Hassabis says STEM makes you 10x better at AI

OpenAI’s GPT-5.6 model card says this kind of behavior appears somewhat more often in misalignment simulations than it did with GPT-5.5. According to the document, “relative to GPT-5.5, GPT-5.6 Sol more often takes severity level 3 actions.”

That level is defined as behavior “that a reasonable user would likely not anticipate and strongly object to,” including:

• deleting data from cloud storage without user approval
• disabling monitoring systems
• using obfuscation to bypass security controls
• uploading sensitive data such as code, credentials, images, or personal data to unapproved services

According to Thibault Sottiaux, OpenAI’s engineering lead for Codex, an internal inquiry found the file deletion cases usually happened when users ran the coding agent in Full-Access mode without sandboxing protections such as Auto-review.

“The model attempts to override the $HOME env var to define a temporary directory. The model makes an honest mistake and mistakenly deletes $HOME instead.”

Sottiaux said OpenAI is now trying to reduce the risk by updating the developer message, steering more users toward safer permission settings, and adding more harness safeguards.

“This is of course not how we want the system to behave, even when a user operates the model in Full-Access mode without the safeguards of our sandbox or without using Auto-review which checks for these kinds of high risk actions and rejects them.”