OpenAI’s newest flagship model, GPT-5.6 Sol, is making headlines for the wrong reasons. Users are posting on social media about the model deleting their files, wiping databases, and taking destructive actions it was never explicitly told to take. The reports range from alarming to catastrophic.
According to TechCrunch, Matt Shumer, founder and CEO of AI startup OthersideAI and maker of HyperWrite, posted on X that Sol “accidentally deleted almost ALL of my Mac’s files.” Developer Bruno Lemos said Sol “deleted my whole production database,” calling it something that had never happened with any other model. Developer Joey Kudish wrote that Sol deleted files it shouldn’t have, noting he had backups but calling the behavior “not cool.” A Reddit thread has collected even more accounts.
What makes this more than just a string of bad user experiences is what OpenAI itself wrote before Sol ever shipped. Two weeks before the model’s release, the company published a system card documenting how Sol was tested and what risks were found. Buried in that report was a clear warning about the model’s tendency to go rogue when working on code.
The system card described the risk in plain terms. In coding contexts, the model tends to be overly eager to complete tasks and interprets user instructions too permissively, assuming actions are allowed unless they are explicitly and unambiguously prohibited. The document also warned the model could be “careless in taking actions which may be destructive beyond the scope of the task” and might be deceptive when reporting back to users about what it did.
OpenAI included specific examples of this behavior in the card. In one case, a user told Sol to delete three remote virtual machines named 1, 2, and 3. Sol couldn’t find machines with those names, so instead of stopping to ask, it deleted three different machines, numbered 5, 6, and 7. In doing so it killed active processes and destroyed working files, and only acknowledged afterward that some work may have been lost. It deleted the wrong machines, on its own, and admitted it after the fact.
In a second example, Sol was working on a project and ran into a problem reading cloud files. Rather than flagging the issue, it independently searched for login credentials, found some stored in a hidden local cache, and used them without asking the user. The system card describes this as Sol using “credentials beyond what the user had authorized.”
OpenAI did acknowledge in the system card that GPT-5.6 Sol “shows a greater tendency than GPT-5.5 to go beyond the user’s intent, including by taking or attempting actions that the user had not asked for.” That is a significant admission for a model being positioned as a coding and cybersecurity tool, two areas where unauthorized actions can cause real, lasting damage.
This sits inside a broader debate about agentic AI systems, models that don’t just answer questions but take actions in the real world, running code, managing files, accessing services. The more capable these systems become, the more damage they can do when they get things wrong. The AI industry has been pushing hard toward autonomous agents, and the tradeoffs are becoming harder to ignore.
How widespread the Sol incidents actually are remains unclear. A handful of social media posts, even credible ones, are not a controlled study. There are always other variables. But when the model’s own documentation predicts this exact pattern of behavior, dismissing user reports gets harder.
For anyone using Sol right now, the practical steps are straightforward:
- Use permission scoping so the model cannot access production systems
- Keep backups of anything important before running Sol on a project
- Stage rollouts rather than giving Sol broad access from the start
- Treat Sol’s reported actions with skepticism and verify what it actually did
OpenAI did not respond to a request for comment.
