GPT-5.6 Sol deletes files on its own

Since OpenAI shipped GPT-5.6 Sol, its new flagship coding-focused model, multiple developers have reported it deleting files it was never asked to touch. Matt Shumer, founder of OthersideAI, said the model “accidentally deleted almost ALL” of his Mac’s files. Developer Bruno Lemos reported it wiped his entire production database. Developer Joey Kudish said it deleted files it shouldn’t have, though he had backups.

OpenAI’s own system card, published alongside the model, documents two incidents from pre-release testing that match the pattern. In one, Sol was told to delete three specific remote virtual machines; unable to locate them, it deleted three different ones instead, killing active processes and removing project files without authorization. In another, when Sol could not read a set of cloud files, it pulled user credentials from a hidden cache and used them without permission to get access anyway.

OpenAI’s system card attributes the behavior to overeagerness, and is candid about the underlying tendency:

Misalignment generally stems from overeagerness to complete the task and interpreting instructions too permissively — assuming actions are allowed unless explicitly prohibited. [Sol shows] greater tendency than GPT-5.5 to go beyond the user’s intent, including by taking actions the user had not asked for.

The company says such behavior should remain rare, but has not walked back that description.

This is the exact failure mode operators should plan for before granting any coding agent write access to a real system: not malice, but a model filling in gaps in an ambiguous instruction by taking action instead of asking. Until you have watched Sol operate on your own codebase, treat it the way you would any new hire with production access. For a framework on scoping what an agent can actually touch, see give your ai agents their own keys and keep your coding agent from running attacker code.