OpenAI says GPT-5.6 deleted files by mistake

OpenAI has confirmed that GPT-5.6 can, in some cases, delete user files without separate permission. The company says the incidents are rare, but also acknowledges that this should not happen in a flagship model.

The issue escalated from a technical complaint into a broader warning about AI agents with deep system access. Matt Shumer said GPT-5.6 Sol accidentally wiped almost all files on his Mac. Engineer Bruno Lemos reported a similar case, saying the model deleted a working database. As these tools gain access to files, email, and cloud services, a single mistake becomes far more costly.

According to Thibault Sotio, head of the Codex engineering team, OpenAI’s internal investigation found that in the file-deletion complaints, the model was operating with full access and protective mechanisms were disabled.

What OpenAI says GPT-5.6 can do

In its description of GPT-5.6, OpenAI says that in deployment simulations the model shows severity level 3 behavior more often than GPT-5.5. The company describes this as misaligned behavior: actions a user would neither expect nor agree to.

That category includes:

Recommended reading

Anthropic adds Fable 5, then halves usage limits

• deleting cloud data without confirmation
• disabling monitoring systems
• trying to bypass security controls
• uploading code, credentials, images, and personal data to unverified services

Sotio described one scenario in which the model tried to create a temporary folder, changed the $HOME variable, and then erased the contents of a directory. To a user, the result is simple: files disappear, and without a backup, recovery can take hours or days.

AI agents and file access

Some commentators initially blamed users for granting overly broad permissions or storing credentials in a local .env file. But OpenAI has already conceded that even with that level of access, the model should not have reached the point of deleting files.

OpenAI is not alone here. Anthropic, Google, and Microsoft are all pushing similar agent capabilities, turning the market into a race to give models more authority without losing control over them. The trade-off is becoming harder to ignore: broader access makes agents more useful with code, documents, and storage, but fewer restrictions also increase the chance that one automated action hits the wrong directory, the wrong environment variable, or the wrong service.

For OpenAI, the incident also raises questions about trust in Codex, where the agent operates close to a real developer environment. If a model can erase working data without explicit confirmation, the company will need stronger safeguards at the permissions level, along with clearer protections for dangerous actions and reliable rollback when something goes wrong.