After reports of GPT-5.6 deleting files, OpenAI says the issue most often occurs in full-access mode without sandboxing and it is working to mitigate the risk
On file deletions. We've investigated a handful of reports where GPT-5.6 unexpectedly deleted files. What we have found is that this most commonly occurs when: - Full access mode is enabled and codex is run without sandboxing protections, including without auto review being
@thsottiauxTibo
Context & Ripple Effects
OpenAI’s recent coverage has emphasized both model-quality claims for GPT-5.4 and more capable cyber-focused tooling in GPT-5.5-Cyber. Earlier reporting also described OpenAI using external-model access for benchmarking and safety evaluations.
The GPT-5.6 file-deletion reports matter because they concern an agent operating with permissions to change a user’s environment, not just the accuracy of a text response. They put operational controls—sandboxing and review—alongside model capability as a central safety issue.
First-order effects
Users running Codex with full filesystem access and without sandboxing or auto-review face the immediate risk profile identified by OpenAI; the company is working on mitigations.
OpenAI must treat permissioning and execution safeguards as part of the GPT-5.6 deployment experience, rather than relying solely on users to manage risky configurations.
Second-order effects
Teams adopting coding agents may tighten default access, require review gates, or isolate agent workspaces, adding process friction to deployments that prioritize autonomous execution.
Competing coding-agent providers will be pressured to make sandboxing, scoped permissions, and auditability more visible differentiators as buyers assess whether agents can safely act on local files.
Third-order effects
If capable coding agents increasingly operate with direct system access, safety evaluation will shift from response correctness toward end-to-end control design: permissions, isolation, confirmation flows, and recovery mechanisms.
The episode reinforces a likely split between highly autonomous agent modes and constrained enterprise modes, with the latter favored where unintended changes carry material operational cost.
The trend: AI coding tools are moving from advisory assistants to execution agents, making runtime safeguards and access governance as consequential as model capability.
Looks like I've gotten bit by Codex Sol's overly ambitious system and it deleted some files it shouldn't have. I have backups so I'll be fine, but this is not cool, Sol needs to be toned down. @thsottiaux @OpenAIDevs @OpenAI [image]
GPT-5.6 Sol just deleted my whole production database. That's it. Not a joke. This had never happened to me before, with any other model, ever. It's not safe. [image]
I just ran into an issue where GPT 5.6 Sol just straight-up deletes the files it's working with and then panics about recovering them. Apparently I'm the not the first person this has happened to. What's going on? [image]
multiple such incidents have been reported. a clear reminder that current AI cannot be trusted. in racing these techniques ahead, we are asking for trouble
Fun fact, the first thing I did w/ Fable was ask it to look over all my past projects and interactions and give me advice about how to have a better working environment for Claudes to succeed in and its first recommendation was “....you don't have routine full backups? DO THAT”
PSA: if you care about your data and infrastructure then please *don't* run your coding agent in yolo mode To secure your workspace I recommend the following: 1. Use “Approve for me” - you can have codex review what it'll run with a sub agent to make sure that it's not
this sucks, there's a simple way to prevent this from ever happening: add a PreToolUse hook that hard-blocks any command touching paths outside the repo (works even in yolo mode) + maybe permissions.deny rules as backup. might as well install it on all local projects.
And this is why my dev box is an EC2 instance, without access to sensitive data, in its own account. The ebs volumes are snapshotted daily; I've yet to see the agent failure mode that blows those away by mistake after trashing the volume.
The crazy thing is, if you read my GPT-5.6-Sol review, I already much preferred Fable, and stopped using 5.6 weeks ago. The only reason I was using it today is because the OpenAI team asked me to test Ultra mode. Fwiw, they are awesome to work with, and this is a freak
Do people really not understand how AI works? This will happen in 2026 and it will happen in 2036. Hallucinations are a inherent part of the LLM design.
Super honestly, I am still a little too terrified to use the model, but from what I hear about what they've got coming down the pipe, I'll be back on Codex soon :)
PSA: Don't run you coding agent in full access mode! Use the combination of Rules, Sandbox, Approve for me & Hooks to make sure that both you and your agent can work in peace. In the extremely rare case the model does trip - you want to have a layer of protection between your
I'm so angry... the OpenAI team is looking into it, but this feels like something that should happen with GPT-3.5. Not a mid-2026 frontier model on the highest reasoning level.
Three days ago, GPT-5.6 deleted my Mac's home directory. It absolutely sucked. But so many OpenAI folks reached out, and @gdb called me and offered to do anything he could to help. Massive props to OpenAI for handling a shitty situation incredibly well.
admittedly extremely funny to drop an incredible frontier model that's much cheaper than its comparator but sometimes just nukes all your shit for no reason
Another reason not to run coding agents on your laptop, they can wipe all your files! Although in this case they'd have wiped my server, but at least I have backups
“mitigate the risk” — This means that there will still always be a chance that using ChatGPT could end up deleting all your files if you give it access to them. — Totally cool tech worth investing billions in.... [embedded post]