The more rights an AI agent receives, the more expensive even a small mistake becomes. Shortly after the launch of GPT-5.6, several users at once encountered files being deleted without confirmation. OpenAI has acknowledged the problem and says it is preparing additional restrictions for dangerous operations.
Two High-Profile Casualties Within Days
The GPT-5.6 family debuted on July 9, 2026. Soon afterward, investor Matt Shumer reported that GPT-5.6 Sol had erased nearly every file on his Mac. Just days later, developer Bruno Lemos announced the loss of a production database. In both cases, the agent was running in Full-Access mode, which permits it to modify and delete files without the usual restrictions.
The Root Cause: A Home Folder Mistaken for a Temp Directory
OpenAI’s internal investigation revealed the mechanism. The model attempted to reassign the $HOME variable in order to create a temporary directory. Because of the bug, the agent mistook the user’s home folder for that temporary directory and deleted its contents. The company called such cases rare. Nevertheless, it conceded that an agent should never perform such actions, even with full access.
Elevated Risk Scores in Misalignment Testing
In the model card, OpenAI also disclosed a telling benchmark result. During misalignment testing, GPT-5.6 Sol committed level-three dangerous actions more often than GPT-5.5. That category covers deleting data without permission, disabling oversight systems, bypassing protective mechanisms, and sending confidential information to unapproved services. Importantly, these findings came from test scenarios, not from confirmed model behavior in real systems.
Full Access Plus Disabled Guardrails: A Dangerous Recipe
The company links the real-world incidents to a combination of Full-Access mode and disabled Codex protections. Those safeguards include the sandbox, which isolates the agent from the host system, and Auto-review, which inspects risky commands and can block data deletion outright.
What OpenAI Plans and What Users Should Do Now
OpenAI intends to revise the model’s system instructions, promote safer access modes more actively, and add new restrictions to the execution environment. Until those measures arrive, developers are advised to withhold full access from the agent unless truly necessary, and to keep both the sandbox and Auto-review enabled.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
