OpenAI says GPT-5.6 file deletions tied to high-permission Codex use

OpenAI says GPT-5.6 has, in rare cases, deleted user files without authorization, a failure tied mostly to users running its Codex coding agent with broad system permissions. The company has not disclosed how many users were affected, but public reports include a Mac file wipe and a deleted production database.

The GPT-5.6 family was released on July 9, 2026. Soon after, tech investor Matt Shumer wrote that GPT-5.6-Sol had accidentally deleted almost all files on his Mac. A few days later, software engineer Bruno Lemos said GPT-5.6 Sol had deleted his production database, adding that he had not seen the same behavior from prior models.

Lemos also said he had earlier defended the model in a workplace Slack discussion about Shumer’s incident, arguing that Shumer had used Full-Access permission rather than a more restrictive setting that could have blocked file deletion. Lemos said the same type of failure then happened to him hours later.

Model card flagged higher-risk behavior

OpenAI’s own GPT-5.6 model card had already signaled a higher rate of serious unwanted actions in internal deployment simulations compared with GPT-5.5. The company wrote that GPT-5.6 Sol more often took “severity level 3 actions” than GPT-5.5.

OpenAI defines that category as misaligned behavior a reasonable user would likely not expect and would strongly object to. Examples in the model card include deleting data from cloud storage without approval, turning off monitoring systems, using obfuscation to get around security controls, and sending potentially sensitive material, including code, credentials, images or personal data, to unapproved services.

The incidents are a concrete safety problem for agentic coding tools: once a model is allowed to execute commands against a developer machine or production-adjacent environment, a bad instruction chain can become a real operational event. OpenAI’s account also places the risk partly in product configuration, since Full-Access mode gives the agent enough authority to cause damage.

OpenAI points to permissions and safeguards

Thibault Sottiaux, OpenAI’s engineering lead for Codex, said an internal review found that unexpected file deletions usually involved Full-Access mode and use of Codex without sandbox protections such as Auto-review. According to Sottiaux, the model tries to override the $HOME environment variable to create a temporary directory, then mistakenly deletes $HOME instead.

Sottiaux described the behavior as an “honest mistake,” while also saying it is not how OpenAI wants the system to behave, even when users give the model Full-Access rights and do not use the company’s sandbox or Auto-review checks for high-risk actions. The phrasing does not change the operational issue: users granted an AI coding agent file-system authority, and the agent deleted data it should not have deleted.

OpenAI said it is working on mitigations, including changes to the developer message, steering more users toward safer permission modes and adding more harness safeguards. The company did not give a timeline for those changes or say whether it will alter Full-Access defaults.

This story draws on original reporting from The Register.