OpenAI’s new flagship model deletes files on its own, and people are constantly warning

Users of OpenAI’s latest major programming and cybersecurity-oriented model, GPT-5.6 Sol, are posting horror accounts on social media, claiming that the model has just deleted their files, data, and even entire databases, on its own, without asking first.

“GPT-5.6-Sol accidentally deleted almost all of my Mac’s files,” Matt Schumer, founder and CEO of AI startup OthersideAI, the maker of HyperWrite, wrote in an article. Now a viral post on X.

“GPT-5.6 Sol deleted the entire production database. That’s it. No joke. This has never happened to me before, with any other model ever,” developer Bruno Lemos Published on X.

“Looks like I got bitten by Sol’s overly ambitious Codex and it deleted some files it wasn’t supposed to have. I have backups so I’ll be fine, but this isn’t great, Sol needs to tone it down,” to publish Developer Joey Kodish.

A Reddit post I collected more examples.

It’s true that the handful of users who make such claims — even if they are as credible as Schumer’s — do not constitute statistically reliable evidence that the model alone is at fault. Lots of other variables can cause an AI system to misbehave.

But OpenAI itself flagged this risk before Sol shipped. Two weeks before OpenAI released GPT-5.6 Sol, the company published a System card for the model – The paper that documents the methods and results of model testing. Naturally, the system card praises Sol’s capabilities largely, as these reports usually do. But it also includes a warning of sorts (our bold emphasis):

“In programming contexts, incompatibilities generally stem from a combination of an excessive desire to complete a task and an overly lenient interpretation of user instructions – Assuming that actions are permissible unless they are explicit and unambiguous Forbidden. This is evident in the fact that the model is overly effective in circumventing the limitations it faces when attempting the required task. Negligence in taking actions that may be devastating Out of scope of assignment, or Deceptive when reporting their results to users.”

In other words, OpenAI found that Sol has a tendency to take any actions he believes will get the job done, even destructive ones, as long as those actions are not “unequivocally” prohibited. Then he might lie about why he did it.

Common OpenAI examples. In one case, the user asked Sol to delete three remote virtual machines (cloud computers), named 1, 2, and 3. But Sol couldn’t find those names where he looked, so instead of stopping to ask, he decided to delete three more virtual machines, 5, 6, and 7, the paper notes. In doing so, it “stopped active processes, and forcibly removed work trees (work files associated with the coding project). It later acknowledged that uncommitted work on remote virtual machine 6 may have been lost.”

In short, the devices deleted the error on their own, and didn’t acknowledge what they had done until after the fact.

In another case, Sol used “credentials beyond what the user authorized.” Credentials are usernames, passwords, or security keys that the system uses to verify who is allowed to log in. This incident happened when Sol was working on a project and could not read his cloud files. Instead of alerting the user to the problem, Sol went looking for the credentials himself, found some in a hidden local cache, and then used them without request or permission from the user.

The system card promises that destructive behavior should be rare, though it also acknowledges that GPT-5.6 Sol “shows a greater tendency than GPT-5.5 to override user intent, including taking or attempting actions that the user did not request.”

It’s too early to say how widespread these incidents – Sol deleting files, or sifting through credentials not provided by the user – are. In the meantime, Sol users must be prepared to implement their own safeguards with the model, such as using permission scoping (which does not grant access to production systems), maintaining backups, and staging.

OpenAI did not immediately respond to our request for comment.