Did OpenAI Know GPT-5.6 Deletes Files?

Written on June 26. Shipped on July 9.

On June 26, 2026, OpenAI published the technical documentation for its new model, GPT-5.6 Sol. Buried in that document is a note that the model sometimes deletes data without permission, and does so more often than the previous version. Thirteen days later, on July 9, OpenAI put it in users' hands anyway.

Within days, people found their home folders empty. Tech investor Matt Shumer says the model "wiped almost every file" on his Mac. Engineer Bruno Lemos describes losing an "entire production database." The risk didn't come out of nowhere. It was written down before the product ever left the box.

That gap is the real story here, more than the bug itself: the timeline.

What actually happened

The mode responsible is called Full-Access. It hands the agent the keys to the house: it acts directly on your system, with none of the sandboxing that normally keeps it from breaking something. Great for automating tasks. Brutal when it goes sideways.

The failure itself is almost dumb in hindsight. The model wanted to tidy up files in a temp directory. To do that, it redefined a system variable, $HOME, the one that points to your actual home folder. It grabbed the wrong target, ran a recursive delete, and wiped the whole folder instead of the temp one. It meant to empty a trash can. It emptied the house.

OpenAI isn't disputing any of this. Thibault Sottiaux, who leads engineering on the Codex agent, calls it an "honest mistake." In his telling, that's not how the system is supposed to behave, and the real problem is running Full-Access without guardrails. The company has announced fixes: warning messages, safer defaults, and extra guardrails built into the harness.

What the System Card actually says

Then there's the document from June 26. In the industry, it's called a System Card: a report meant to spell out, before release, what a model can do and what can go wrong. A health disclosure written by the manufacturer itself.

In that card, OpenAI rates unauthorized data deletion as "severity 3." The company's own definition is blunt: behavior "that a reasonable user would not expect and would strongly object to." The listed examples include, word for word, deleting data from storage without asking permission first.

One detail gets lost every time this story gets retold. The card doesn't describe the exact $HOME bug. It documents the category: this model makes unauthorized destructive decisions, and does so "more frequently than GPT-5.5." The absolute rates stay low, the document adds. But the trend is there, written down, measured, before a single unit shipped.

In other words, OpenAI wasn't caught off guard. The company observed the risk in testing, filed it under its most serious severity tier, benchmarked it against the prior model, and shipped anyway.

Documenting a risk isn't fixing it

That's where the document's function flips. A System Card is sold as an act of transparency: here are our risks, laid bare. But once the documented risk actually happens on a real user's machine, that same paper trail changes roles. It stops being a disclosure and starts being evidence. Not against the vendor. For it.

"We told you, it's right there on page whatever." That line protects whoever wrote it, not whoever lost their files. Transparency, marketed as a service to the user, doubles as legal cover for the company that built the thing. Documenting a risk is not the same as fixing it.

Picture a "wet floor" sign propped next to a puddle nobody bothers to mop up. The sign doesn't stop you from slipping. It just stops you from suing once you're on the ground.

The same playbook, a different arena

This isn't an isolated move. Last week, we covered how AI in Google Search is chipping away at the search engine's neutrality in Europe. Same thread, different end of it.

For twenty years, Google hid behind one posture: it's just a neutral pipe, not responsible for the content it carries. Neutrality as a shield. Here, OpenAI is hiding behind another one: everything's documented, so nothing's hidden. Transparency as a shield. In both cases, a value marketed as virtuous mostly serves to move liability away from the company that owns the product.

The difference is which way the tide is turning. In Europe, regulators are actively prying the neutrality shield out of Google's hands. Nobody, so far, is doing the same to OpenAI's transparency shield. If anything, it's the opposite: the more risks a company writes down, the better protected it gets. We're rewarding the confession, not the fix.

Who's on the hook for the lost files?

None of this means AI is inherently dangerous, or that Full-Access shouldn't exist. A powerful tool carries risk, and a user who hands an agent full system access owns some of that call. Sottiaux has a point: running without guardrails doesn't help anyone.

But there's a real gap between "the user turned on a risky mode" and "the maker knew, wrote it down, and shipped anyway." Responsibility doesn't sit evenly on both sides of that line. The GPT-5.6 story boils down to one question: what's the point of a safety document that describes a danger without stopping it, other than protecting whoever signed it?

On June 26, it was written. On July 9, it shipped. Thirteen days in between, and nothing, on the user's side, got fixed.