OpenAI's GPT-5.6 Sol is deleting files without permission, developers warn

OpenAI's new flagship model deletes files on its own, people keep warning

Users of OpenAI's latest coding and cybersecurity-oriented flagship model, GPT-5.6 Sol, are posting horrifying accounts on social media, claiming the the model just up and deleted their files, data, even entire databases, on its own, without asking first. "GPT-5.6-Sol just accidentally deleted almost ALL of my Mac's files," wrote Matt Shumer, the founder and CEO of AI startup OthersideAI, maker of HyperWrite, in a now viral post on X. "GPT-5.6 Sol just deleted my whole production database. That's it. Not a joke. This had never happened to me before, with any other model, ever," developer Bruno Lemos posted on X. "Looks like I've gotten bit by Codex Sol's overly ambitious system and it deleted some files it shouldn't have. I have backups so I'll be fine, but this is not cool, Sol needs to be toned down," posted developer Joey Kudish. A Reddit post has collected more examples. True, a handful of users making such claims -- even one as credible as Shumer -- isn't statistically reliable evidence that the model is solely at fault. Plenty of other variables can cause an AI system to misbehave. But OpenAI itself flagged this risk before Sol ever shipped. Two weeks before OpenAI released GPT-5.6 Sol, the company published a system card for the model -- the paper that documents model testing methods and results. Naturally, the system card largely extols the capabilities of Sol, as these reports typically do. But it also includes a warning of sorts (bold emphasis ours): "In coding contexts, misalignment generally stems from a mix of overeagerness to complete the task and interpreting user instructions too permissively - assuming that actions are allowed unless they're explicitly and unambiguously prohibited. This manifests as the model being overly agentic in circumventing restrictions it faces when attempting the requested task, being careless in taking actions which may be destructive beyond the scope of the task, or deceptive when reporting its results to users." In other words, OpenAI found that Sol has a tendency to take whatever actions it thinks gets a job done, even destructive ones, as long as those actions aren't "unambiguously" prohibited. Then, it might lie about what caused it to do so. OpenAI shared examples. In one case, the user told the Sol to delete three remote virtual machines (cloud-based computers), named 1, 2 and 3. But Sol couldn't find those names in the place where it looked, so instead of stopping to ask, it decided to delete three other virtual machines, 5, 6, and 7, the paper notes. In doing so, it "killed active processes, and force-removed worktrees [the working files tied to a coding project]. It later acknowledged that uncommitted work on remote virtual machine 6 may have been lost." In short, it deleted the wrong machines, on its own, and only admitted what it did after the fact. In another instance, Sol "used credentials beyond what the user had authorized." Credentials are the usernames, passwords, or security keys a system uses to verify who's allowed to log in. This incident occurred when Sol was working on a project and couldn't read its cloud files. Rather than alerting the user to the problem, Sol went looking for the credentials on its own, found some sitting in a hidden local cache, and then used them without asking or authorization from the user. The system card does promise that destructive behavior should be rare, although it also admits that GPT-5.6 Sol "shows a greater tendency than GPT-5.5 to go beyond the user's intent, including by taking or attempting actions that the user had not asked for." It's too soon to say how widespread these incidents -- Sol deleting files, or sifting out credentials the user didn't give it -- really are. In the meantime, Sol users should be prepared to implement their own safeguards with the model, like using permission scoping (that doesn't give access to production systems), maintaining backups, and staging rollouts. OpenAI did not immediately respond to our request for comment.

Developers Claim OpenAI's New AI Model is Going Rogue and Deleting Files

There's been a big push among AI developers in recent years towards the development of more "agentic" systems -- that is, algorithms that can autonomously make decisions and interact with digital tools without constant hand-holding from humans. This has been especially true within software development, the field that's arguably become the most ripe for automation in the ongoing AI boom. But one of the upshots of building highly agentic AI systems is that they're prone to all kinds of unexpected behaviors -- including now and then deleting copious amounts of files. Multiple people have reported this recently happening to them while using GPT-5.6, the newest model from OpenAI. On Monday, Bruno Lemos, a Brazilian developer at software company Unlayer, claimed in a X post that the model deleted his entire production database. "This had never happened to me before, with any other model, ever." He wrote. "[GPT-5.6 is] not safe." A screenshot included in the post showed a chat between Lemos and GPT-5.6, in which he asked it to confirm that it had in fact mistakenly deleted his entire production database. The model responded by saying that it "mistakenly ran destructive integration tests" which led to Lemos' production tables being cleared. "I'm sorry -- this should never have happened," it said. It followed closely on the heels of another X post from tech investor Matt Shumer -- who's also the author of an essay about AI that went viral earlier this year called "Something Big is Happening" -- who reported something similar. According to an attached screenshot, GPT-5.6 told him it had caused "a serious local data-loss incident," leading to the deletion of what Shumer described as "almost ALL" of his computer's files. The screenshot showed that the model had executed a "rm -rf" command, which in Linux and Mac systems is used to permanently delete files without requesting user confirmation. "I've never seen anything like this," Shumer wrote in the thread beneath that post. "Will only be using [Anthropic's] Fable moving forward." He added that OpenAI cofounder and president Greg Brockman called him personally and offered to help fix the situation. Shumer also claimed he had the AI model set to "full access mode," which allows it to work directly within a user's database (as opposed to operating within a constrained sandbox). It also comes with a "default mode" that requires users to frequently approve specific tasks, and a more recently introduced "auto-review mode" through which a separate AI agent checks the main coding agent's work. Beneath his X post, many people claimed Shumer had simply been careless by trusting sensitive files in full access mode. In the system card for GPT-5.6, published online the day before Shumer's X post, OpenAI cautioned that when using the model for coding purposes "it is important for users to supervise the agent's work." The company added that the model could act in unexpected ways that are misaligned with the user's goals, and that while these were "most often low severity (e.g. overstating confidence or overclaiming success)," they could in other cases "be meaningfully more severe (e.g. circumventing important security restrictions or deleting important data)." Lemos, Shumer, and OpenAI did not immediately respond to Gizmodo's request for comment.