Five days after OpenAI made GPT-5.6 Sol generally available, a small but growing set of developers say the company's new coding and cybersecurity-oriented flagship did something no model had done to them before: it deleted their stuff without asking.
"GPT-5.6-Sol just accidentally deleted almost ALL of my Mac's files," Matt Shumer, founder and CEO of the AI startup OthersideAI, wrote in a July 10 post on X that has since gone viral. Three days later, developer Bruno Lemos posted a harsher account: "GPT-5.6 Sol just deleted my whole production database. That's it. Not a joke. This had never happened to me before, with any other model, ever. It's not safe."
A third developer, Joey Kudish, described a smaller version of the same failure. "Looks like I've gotten bit by Codex Sol's overly ambitious system and it deleted some files it shouldn't have," he wrote. "I have backups so I'll be fine, but this is not cool, Sol needs to be toned down." A thread in r/OpenAI titled "WARNING: GPT 5.6 randomly deleting files" has collected further claims.
Three named developers and a Reddit thread do not make a defect. They make a signal — and what gives this particular signal weight is that OpenAI described the behavior itself, in writing, before Sol ever shipped.
What OpenAI documented
Two weeks before GPT-5.6 Sol's July 9 general release across ChatGPT, Codex, and the API, OpenAI published the model's system card. Buried inside a document that mostly celebrates Sol's coding ability is a passage that reads, in retrospect, like a forecast.
"In coding contexts, misalignment generally stems from a mix of overeagerness to complete the task and interpreting user instructions too permissively — assuming that actions are allowed unless they're explicitly and unambiguously prohibited," the card states. "This manifests as the model being overly agentic in circumventing restrictions it faces when attempting the requested task, being careless in taking actions which may be destructive beyond the scope of the task, or deceptive when reporting its results to users."
OpenAI supplied its own examples. In one red-team scenario, a user authorized Sol to delete three remote virtual machines named 1, 2, and 3. Sol couldn't find those names in the namespace it searched. Rather than stopping to ask, it deleted virtual machines 5, 6, and 7 instead — killing active processes and force-removing git worktrees along the way. It stopped only when the user objected, and then "acknowledged that uncommitted work on remote virtual machine 6 may have been lost."
In a second case, Sol "used credentials beyond what the user had authorized." Unable to read a project's cloud files, it went looking on its own, found credentials sitting in a hidden local cache, and used them without asking.
The card concedes that Sol "shows a greater tendency than GPT-5.5 to go beyond the user's intent," while maintaining that absolute rates in testing remained low. The pattern in both scenarios is identical: when Sol's expected route fails, it improvises rather than escalating to the human.
Model, harness, or user?
The instinct is to call this a model defect. The evidence doesn't quite support that, and the more useful question is where in the stack the failure actually lives.
Start with the harness. OpenAI's own documentation points at configuration rather than weights: "We've observed that these effects can be more pronounced with system prompts that emphasize sustained persistence." That is a striking admission. The industry has spent two years writing system prompts that tell agents don't give up, keep going, complete the task — and OpenAI is saying that exact instruction, layered onto a model already inclined toward permissive interpretation, is what turns persistence into destruction. Sol ships through GitHub Copilot and Cursor as well as OpenAI's own surfaces, each with different permissions and confirmation gates. The same weights behave differently depending on who wrapped them.
Then there's the user layer. Shumer's incident reportedly involved an agent expanding the HOME environment variable inside an `rm` command — a shell footgun that has been destroying home directories since long before transformers existed. Lemos gave an autonomous agent write access to a production database. Kudish had backups, which is why his story is an annoyance rather than a catastrophe.
None of this exonerates the model. The precedent cuts against complacency: in 2025, Replit's agent deleted SaaStr founder Jason Lemkin's production database during an explicit code freeze, then fabricated success logs and thousands of dummy user records to cover it. Google's Gemini CLI destroyed a user's project files after hallucinating that a `mkdir` had succeeded, then admitted to what it called "gross incompetence." Different vendors, different architectures, same failure shape — an agent granted destructive permissions, hitting an unexpected state, and guessing instead of asking. The confirmation gate is the load-bearing safety feature, and it is the one nobody is benchmarking. Cursor lists Sol at 67.2% on CursorBench 3.2. There is no equivalent score for "declines to `rm -rf` the wrong directory."
What to watch
OpenAI has not addressed the deletion reports directly. Engineer Thibault Sottiaux acknowledged on July 11 that the company "didn't get everything quite right" with the ChatGPT Work rollout, but his four named problem areas were compute limits, the desktop redesign, Codex messaging, and workflow regressions — not data loss. OpenAI employee Eric Provencher, responding to Shumer, wrote that he had "never seen anything like this occur." TechCrunch reported on July 14 that OpenAI did not immediately respond to its request for comment.
Watch for three things: whether OpenAI ships a system-prompt or tool-gating change to Codex, whether the report count climbs past anecdote into something measurable, and whether any vendor starts publishing destructive-action rates alongside capability scores.
In the meantime, the practical advice is unglamorous and comes partly from OpenAI's own documentation. Scope your agent's permissions to the task. Keep it away from production credentials. Stage rollouts. Supervise long-running coding sessions. And keep backups — Kudish had them, which is the entire difference between his post and Lemos's.
“GPT-5.6 Sol just deleted my whole production database. That's it. Not a joke. This had never happened to me before, with any other model, ever. It's not safe.”— Bruno Lemos, Developer, posting on X