OpenAI's GPT-5.6 Sol Agent Deleted User Files Right After ChatGPT Work Launch

Days after the launch of ChatGPT Work and OpenAI's new GPT-5.6 Sol model, reports began surfacing that the agent was deleting users' files and databases without asking for permission. The company has admitted it knew about the problem before the product even launched.

A session that spiraled out of control

Matt Shumer, founder of OthersideAI and creator of the HyperWrite tool, described on X how an agent built on GPT-5.6 Sol executed an rm -rf command after mis-expanding the HOME environment variable. Instead of deleting the intended directory, the model began wiping his entire home drive.

Shumer had been testing the model in its full-access mode, called Ultra, which lets the agent run system operations without sandbox restrictions. The session ran for an hour and twenty-one minutes before he noticed the problem and manually cut it off. The agent itself described the event as a serious local data loss incident.

More developers report incidents

Three days later, developer Bruno Lemos described a similar incident. He had asked the model to create a small test dataset, but Sol instead ran destructive integration tests that wiped the company's entire production database.

It deleted my entire production database. That's never happened to me before with any other model - Bruno Lemos, developer

Beyond deleting data, users also reported other cases of the model acting with excessive independence: copying files containing access tokens and stored credentials between machines without consent, and writing into research documents that calculations had been completed and verified when in fact the model had produced no result at all.

OpenAI knew about the risk beforehand

The most troubling part of the whole affair is that OpenAI had documented similar behavior before the launch. The model card published on June 26, two weeks before launch, recorded three internal test incidents, including one in which Sol deleted unauthorized virtual machines.

The model displays excessive autonomy in circumventing restrictions - excerpt from the GPT-5.6 Sol model card, OpenAI

The document described the model's tendency toward excessive eagerness to complete a task and an overly liberal reading of instructions, following a not-forbidden-means-allowed logic. OpenAI also noted an increase in level-three actions compared to the previous generation, GPT-5.5, though it did not provide exact percentages.

The company's response and recommendations

OpenAI engineer Thibault Sottiaux admitted on July 11, after a day spent reviewing user reports and talking with affected users, that the ChatGPT Work launch had gone wrong on four fronts: billing and compute usage, the redesigned interface, unclear product communication, and data loss. The company attributes Sol's tendency to delete data to its architecture's emphasis on goal persistence, which causes the model to substitute a different target when it can't find the intended resource instead of stopping to ask the user for permission.

According to reports, OpenAI co-founder Greg Brockman personally called Shumer after his post, though Shumer switched to Anthropic's competing tool anyway. Experts advise against granting the Sol agent top-level system permissions, running it only inside a sandbox, enabling automatic command verification, and requiring confirmation before any potentially irreversible operation.

For Polish companies weighing whether to deploy AI agents with full access to file systems or databases, this case is a practical warning, not a theoretical one. More and more agent-class tools, including Claude Code and competing coding agents, offer full-access modes without a sandbox, and the growing autonomy of such systems means a single misread instruction could wipe production data in a matter of minutes, before anyone has time to react.