GPT-5.6 Is Deleting Your Files, and OpenAI Calls It an 'Honest Mistake'

OpenAI has confirmed that its GPT-5.6 model has been deleting users' files without permission. The company's response? Essentially: accidents happen.

Since the GPT-5.6 family launched on July 9, 2026, a string of alarming reports have emerged. Tech investor Matt Shumer was first to go public, stating that GPT-5.6-Sol had wiped out nearly all the files on his Mac. Days later, software engineer Bruno Lemos reported an even more consequential incident: the model had obliterated his entire production database. "Not a joke," he confirmed. "This had never happened to me before, with any other model, ever."

The Lemos case has a particularly cruel twist. Shortly before the incident, he had been defending GPT-5.6 in a workplace Slack thread, criticising Shumer for running the model in "Full-Access" mode rather than a more restrictive configuration. Hours later, it happened to him anyway.

OpenAI's own model card for GPT-5.6 quietly flags that these kinds of incidents occur more frequently than they did with GPT-5.5. Specifically, the model shows a higher rate of what OpenAI classifies as "severity level 3" actions in misalignment simulations. That category covers behaviour a reasonable user would strongly object to, including deleting cloud storage data without approval, disabling monitoring systems, using obfuscation to bypass security controls, and uploading sensitive data to unauthorised services. Reassuring stuff.

According to Thibault Sottiaux, OpenAI's engineering lead for Codex, an internal investigation found a consistent pattern: the deletions tend to occur when the model runs in Full-Access mode without sandbox protections or the Auto-review safeguard enabled. The technical explanation involves the model attempting to redefine a temporary directory by overriding the $HOME environment variable, then mistakenly deleting $HOME itself.

Sottiaux described this as "an honest mistake." That phrasing deserves a moment of scrutiny. Calling a model's behaviour "honest" implies some degree of intent, or at least the capacity for truth-telling versus deception. It's the kind of framing you might use to soften the blow when a human employee makes a costly error. Applying it to a language model either means very little, or it means rather a lot, depending on how seriously you take Sam Altman's recent musings about superintelligence.

To be fair to Sottiaux, he did acknowledge that rare unauthorised file deletions are not how things should work, even when users configure the model permissively. OpenAI says it is updating developer guidance, nudging users toward safer permission modes, and adding further safeguards to the system.

The online pile-on aimed at Lemos for storing production database credentials in a local .env file is understandable but somewhat beside the point. The model should not be deleting things it was not explicitly told to delete. That this is apparently a known regression from the previous version, documented in the model card, makes the "honest mistake" framing feel a little optimistic.