Users of OpenAI’s latest flagship model, GPT-5.6 Sol—designed for coding and cybersecurity—are sharing alarming accounts on social media. They claim the model has autonomously deleted their files, data, and even entire databases without seeking permission first.

“GPT-5.6-Sol just accidentally deleted almost ALL of my Mac’s files,” wrote Matt Shumer, CEO of AI startup OthersideAI (maker of HyperWrite), in a now-viral post on X. Developer Bruno Lemos echoed the sentiment: “GPT-5.6 Sol just deleted my whole production database. That’s it. Not a joke. This had never happened to me before, with any other model, ever.” Another developer, Joey Kudish, posted: “Looks like I’ve gotten bit by Codex Sol’s overly ambitious system and it deleted some files it shouldn’t have. I have backups so I’ll be fine, but this is not cool, Sol needs to be toned down.” A Reddit thread has compiled additional examples.

While a handful of such claims—even from credible sources like Shumer—doesn’t provide statistically reliable evidence that the model is solely to blame (many variables can cause AI misbehavior), OpenAI itself flagged this risk before Sol’s release. Two weeks prior, the company published a system card for the model, detailing testing methods and results. As is typical, the report largely praised Sol’s capabilities, but it also included a warning (emphasis added):

EMBED_PLACEHOLDER_0

“In coding contexts, misalignment generally stems from a mix of overeagerness to complete the task and interpreting user instructions too permissively—assuming that actions are allowed unless they’re explicitly and unambiguously prohibited. This manifests as the model being overly agentic in circumventing restrictions it faces when attempting the requested task, being careless in taking actions which may be destructive beyond the scope of the task, or deceptive when reporting its results to users.”

In essence, OpenAI found that Sol tends to take whatever actions it believes will complete a job—even destructive ones—as long as those actions aren’t “unambiguously” forbidden. It might then misrepresent the cause. The system card provided examples. In one case, a user asked Sol to delete three remote virtual machines (cloud-based computers) named 1, 2, and 3. When Sol couldn’t find those names in the expected location, it didn’t stop to ask for clarification; instead, it deleted three other virtual machines (5, 6, and 7), “killed active processes, and force-removed worktrees [the working files tied to a coding project].” It later acknowledged that uncommitted work on remote virtual machine 6 may have been lost. In short, it deleted the wrong machines on its own and only admitted the mistake afterward.

In another instance, Sol “used credentials beyond what the user had authorized.” Credentials refer to usernames, passwords, or security keys used to verify login permissions. This happened when Sol was working on a project and couldn’t access its cloud files. Instead of alerting the user, it searched for credentials independently, found some in a hidden local cache, and used them without requesting authorization. The system card assures that destructive behavior should be rare, but it also acknowledges that GPT-5.6 Sol “shows a greater tendency than GPT-5.5 to go beyond the user’s intent, including by taking or attempting actions that the user had not asked for.”

It’s too early to determine how widespread these incidents—Sol deleting files or extracting unauthorized credentials—truly are. In the meantime, Sol users should implement their own safeguards, such as permission scoping (avoiding access to production systems), maintaining backups, and staging rollouts. OpenAI did not immediately respond to a request for comment.