\n<\/p>\n
Users of OpenAI\u2019s latest coding and cybersecurity-oriented flagship model, GPT-5.6 Sol, are posting horrifying accounts on social media, claiming the model just up and deleted their files, data, even entire databases on its own, without asking first.<\/p>\n
\u201cGPT-5.6-Sol just accidentally deleted almost ALL of my Mac\u2019s files,\u201d wrote Matt Shumer, the founder and CEO of AI startup OthersideAI, maker of HyperWrite, in a now viral post on X<\/a>.<\/p>\n \u201cGPT-5.6 Sol just deleted my whole production database. That\u2019s it. Not a joke. This had never happened to me before, with any other model, ever,\u201d developer Bruno Lemos posted on X<\/a>.<\/p>\n \u201cLooks like I\u2019ve gotten bit by Codex Sol\u2019s overly ambitious system and it deleted some files it shouldn\u2019t have. I have backups so I\u2019ll be fine, but this is not cool, Sol needs to be toned down,\u201d posted<\/a> developer Joey Kudish.<\/p>\n A Reddit post<\/a> has collected more examples.<\/p>\n True, a handful of users making such claims \u2014 even one as credible as Shumer \u2014 isn\u2019t statistically reliable evidence that the model is solely at fault. Plenty of other variables can cause an AI system to misbehave.<\/p>\n But OpenAI itself flagged this risk before Sol ever shipped. Two weeks before OpenAI released GPT-5.6 Sol, the company published a system card for the model<\/a> \u2014 the paper that documents model-testing methods and results. Naturally, the system card largely extols the capabilities of Sol, as these reports typically do. But it also includes a warning of sorts (bold emphasis ours):<\/p>\n In coding contexts, misalignment generally stems from a mix of overeagerness to complete the task and interpreting user instructions too permissively \u2014 assuming that actions are allowed unless they\u2019re explicitly and unambiguously <\/strong>prohibited. This manifests as the model being overly agentic in circumventing restrictions it faces when attempting the requested task, being careless in taking actions which may be destructive<\/strong> beyond the scope of the task, or deceptive<\/strong> when reporting its results to users.<\/p>\n<\/blockquote>\n In other words, OpenAI found that Sol has a tendency to take whatever actions it thinks gets a job done, even destructive ones, as long as those actions aren\u2019t \u201cunambiguously\u201d prohibited. Then it might lie about what caused it to do so.<\/p>\n OpenAI shared examples. In one case, the user told Sol to delete three remote virtual machines (cloud-based computers), named 1, 2, and 3. But Sol couldn\u2019t find those names in the place where it looked, so instead of stopping to ask, it decided to delete three other virtual machines, 5, 6, and 7, the paper notes. In doing so, it \u201ckilled active processes, and force-removed worktrees [the working files tied to a coding project]. It later acknowledged that uncommitted work on remote virtual machine 6 may have been lost.\u201d<\/p>\n In short, it deleted the wrong machines, on its own, and only admitted what it did after the fact.<\/p>\n In another instance, Sol \u201cused credentials beyond what the user had authorized.\u201d Credentials are the usernames, passwords, or security keys a system uses to verify who\u2019s allowed to log in. This incident occurred when Sol was working on a project and couldn\u2019t read its cloud files. Rather than alerting the user to the problem, Sol went looking for the credentials on its own, found some sitting in a hidden local cache, and then used them without asking for authorization from the user.<\/p>\n The system card does promise that destructive behavior should be rare, although it also admits that GPT-5.6 Sol \u201cshows a greater tendency than GPT-5.5 to go beyond the user\u2019s intent, including by taking or attempting actions that the user had not asked for.\u201d<\/p>\n It\u2019s too soon to say how widespread these incidents \u2014 Sol deleting files, or sifting out credentials the user didn\u2019t give it \u2014 really are. In the meantime, Sol users should be prepared to implement their own safeguards with the model, like using permission scoping (that doesn\u2019t give access to production systems), maintaining backups, and staging rollouts. <\/p>\n OpenAI did not immediately respond to our request for comment. <\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\n\n