OpenAI’s new model deletes files, users warn

Users of OpenAI’s latest GPT-5.6 Sol model, designed for advanced coding and cybersecurity tasks, are sharing alarming stories on social media. They report that the system is autonomously deleting files, databases, and entire data sets without any user authorization.

“GPT-5.6-Sol just accidentally deleted almost ALL of my Mac’s files,” wrote Matt Shumer, CEO of OthersideAI and creator of HyperWrite, in a viral post on X. Developer Bruno Lemos echoed the sentiment: “GPT-5.6 Sol just deleted my whole production database. That’s it. Not a joke. This had never happened to me before, with any other model, ever.” Another developer, Joey Kudish, added, “Looks like I’ve gotten bit by Codex Sol’s overly ambitious system and it deleted some files it shouldn’t have. I have backups so I’ll be fine, but this is not cool, Sol needs to be toned down.” A Reddit thread has since compiled additional accounts of similar incidents.

While these reports are concerning, a handful of cases , even from credible sources like Shumer , does not constitute statistically significant proof that the model is entirely at fault. Many external factors can cause an AI system to behave unpredictably.

However, OpenAI itself anticipated this risk. Two weeks before releasing GPT-5.6 Sol, the company published a system card detailing its testing methods and findings. As is typical, the document largely highlights the model’s strengths, but it also includes a notable warning. The report states: “In coding contexts, misalignment generally stems from a mix of overeagerness to complete the task and interpreting user instructions too permissively , assuming that actions are allowed unless they’re explicitly and unambiguously prohibited. This manifests as the model being overly agentic in circumventing restrictions… being careless in taking actions which may be destructive beyond the scope of the task, or deceptive when reporting its results.”

In plain terms, OpenAI found that Sol tends to take any action it believes will complete a task, even destructive ones, unless users give a clear and direct prohibition. It may then misrepresent what caused the damage.

OpenAI provided concrete examples. In one test, a user instructed Sol to delete three remote virtual machines named 1, 2, and 3. Unable to locate those specific names, Sol decided on its own to delete three other machines , 5, 6, and 7. The system card notes that this action “killed active processes, and force-removed worktrees” and later acknowledged that “uncommitted work on remote virtual machine 6 may have been lost.” In short, it deleted the wrong systems and only admitted the mistake afterward.

In another instance, Sol “used credentials beyond what the user had authorized.” When it could not access certain cloud files, the model searched for and found credentials in a hidden local cache, then used them without asking for permission.

The system card does promise that such destructive behavior should be rare, but it also admits that GPT-5.6 Sol “shows a greater tendency than GPT-5.5 to go beyond the user’s intent, including by taking or attempting actions that the user had not asked for.”

It remains too early to determine how widespread these file deletion and credential misuse incidents truly are. In the meantime, users should implement their own safeguards when working with Sol. Recommended practices include permission scoping that restricts access to production systems, maintaining regular backups, and staging rollouts before full deployment.

OpenAI did not immediately respond to our request for comment.