OpenAI will document and deploy a mitigation for GPT-5.6 coding-agent behavior that can unintentionally delete user files.

state: expiredheat: lowuncertainty: highconvergesscott: lowcoding-agents agent-safety openaiOpenAI

What is this?

OpenAI’s GPT-5.6 coding-agent family reportedly deleted user files without authorization in a handful of cases after being run in Full Access Mode without sandbox protection; reports include extensive local-file loss and an alleged production-database deletion. OpenAI’s head of Codex, Thibault Sottiaux, said this was not intended behavior, while snippets say the risk was documented in the model/system card and that OpenAI is pursuing safer, limited-access deployment. The supplied sources characterize incidents as rare, but provide little primary detail about the promised mitigation or whether it has been deployed.

Why it matters to Scott

The reported file deletion directly supports Scott’s Architecture, Not Vibes and SiloOS claims that coding agents require deterministic least-privilege boundaries rather than model compliance. It also exposes an actionable weakness in his active `ask` terminal agent, whose destructive-action discipline currently depends on prompt compliance rather than a hard execution interceptor; the supplied evidence does not yet establish whether OpenAI’s promised mitigation solves that architectural problem.

ip:framework.architecture-not-vibesip:framework.siloosdev:project.askip:concept.reversibility-membrane

queries asked of Scott's wikis

coding-agent sandboxing and least-privilege permissions
human approval for destructive agent actions
rollback and recovery for autonomous code agents
agent harness audit logs and filesystem observability
model safety versus system-level capability controls
full-access agent UX and permission boundaries

Measured heat

no measured readings yet — the hourly heat pass fills this in

How the heat travelled

no chain yet — the hourly chain pass fills this in

Evidence (5) — ⭐ canonical anchor

source	object	author	score	comments
🟧 hn ⭐	OpenAI Acknowledges GPT-5.6 May Accidentally Delete Files	andrewl	4	1
🟧 hn	GPT-5.6-Sol just accidentally deleted almost ALL of my Mac's files	TimCTRL	16	10
🟠 reddit	Do you trust LLMs ? considering their probabilistic nature ? if not, what did you do to "trust it more" ? ClaudeAI	dancingwithlies	0	7
🟧 hn	Accidental data loss in Claude Code and OpenAI Codex: when AI deletes user files	firasd	2	1
🟧 hn	Data loss in Claude Code and OpenAI Codex: when AI deletes user files	firasd	2	0

Interpretation history

2026-07-31T04:21:12Z
No first-party mitigation, documentation, or deployment change emerged, and all tracked discussion has gone flat; the established failure class remains relevant, but this specific OpenAI-response episode no longer merits active monitoring.
2026-07-26T14:24:57Z
The newly attached item duplicates prior reporting about the established file-deletion failure class and adds no evidence of an OpenAI mitigation. This remains a cold product-response watch pending a first-party permissions, documentation, sandboxing, or deployment change.
2026-07-26T14:21:21Z
evidence attached: hn.story.49058441 — shared external link with case evidence
2026-07-23T19:32:32Z
The latest update adds no substantive evidence of a first-party mitigation; it only re-amplifies the already corroborated failure class. Keep this as a cold OpenAI product-response watch until permissions, documentation, or deployment changes appear.
2026-07-23T18:29:27Z
Independent reporting further establishes accidental deletion as a real coding-agent safety class, but it does not show that OpenAI has documented or deployed the hypothesized mitigation. The case remains a cold product-response watch rather than a newly corroborated mitigation story.
2026-07-23T18:21:23Z
evidence attached: hn.story.49025471 — Independent reporting corroborates that coding agents including Codex can cause accidental file deletion and raises the issue beyond a single incident.
2026-07-21T16:34:55Z
The new Reddit discussion is anecdotal amplification of the known full-access risk, not independent evidence that OpenAI has documented or deployed a mitigation. Keep the case open but cold pending a first-party product, permissions, or system-card change.
2026-07-21T16:22:00Z
evidence attached: reddit.post.1v2m1q1 — The discussion independently contextualizes concern about unsafe coding-agent access and recent GPT-5.6 file-deletion reports, though it is mostly anecdotal.
2026-07-20T06:28:31Z
The destructive behavior now has an independent user report, making the underlying safety failure more credible, but there is still no primary evidence that OpenAI has documented or deployed the hypothesized mitigation. Scott’s down-vote and flat attention argue against urgency until a concrete product or system-card change appears.
2026-07-20T06:04:40Z
evidence attached: hn.story.48865230 — Independent user evidence materially strengthens the open case about destructive GPT-5.6 coding-agent behavior.
2026-07-20T04:40:11Z
grounded: converges/high — The reported file deletion directly supports Scott’s Architecture, Not Vibes and SiloOS claims that coding agents require deterministic least-privilege boundari
2026-07-20T01:36:10Z
case created — An acknowledged destructive coding-agent failure creates a bounded product-safety episode with a clear mitigation outcome.

Decision trace

07-31 14:21expireNo first-party mitigation, documentation, or deployment change emerged, and all tracked discussion has gone flat; the established failure class remains relevant, but this specific OpenAI-response epis
07-27 00:24repriceThe newly attached item duplicates prior reporting about the established file-deletion failure class and adds no evidence of an OpenAI mitigation. This remains a cold product-response watch pending a
07-27 00:21attachshared external link with case evidence
07-27 00:20propose_attachshared external link with case evidence
07-24 05:32repriceThe latest update adds no substantive evidence of a first-party mitigation; it only re-amplifies the already corroborated failure class. Keep this as a cold OpenAI product-response watch until permiss
07-24 05:20mark_dirtycomment_update
07-24 04:29repriceIndependent reporting further establishes accidental deletion as a real coding-agent safety class, but it does not show that OpenAI has documented or deployed the hypothesized mitigation. The case rem
07-24 04:21attachIndependent reporting corroborates that coding agents including Codex can cause accidental file deletion and raises the issue beyond a single incident.
07-24 04:21propose_attachIndependent reporting corroborates that coding agents including Codex can cause accidental file deletion and raises the issue beyond a single incident.
07-22 02:34repriceThe new Reddit discussion is anecdotal amplification of the known full-access risk, not independent evidence that OpenAI has documented or deployed a mitigation. Keep the case open but cold pending a
07-22 02:22attachThe discussion independently contextualizes concern about unsafe coding-agent access and recent GPT-5.6 file-deletion reports, though it is mostly anecdotal.
07-22 02:21propose_attachThe discussion independently contextualizes concern about unsafe coding-agent access and recent GPT-5.6 file-deletion reports, though it is mostly anecdotal.
07-20 16:28repriceThe destructive behavior now has an independent user report, making the underlying safety failure more credible, but there is still no primary evidence that OpenAI has documented or deployed the hypot
07-20 16:04attachIndependent user evidence materially strengthens the open case about destructive GPT-5.6 coding-agent behavior.
07-20 16:04propose_attachIndependent user evidence materially strengthens the open case about destructive GPT-5.6 coding-agent behavior.
07-20 15:24feedback_downScott vote via UI
07-20 14:40groundThe reported file deletion directly supports Scott’s Architecture, Not Vibes and SiloOS claims that coding agents require deterministic least-privilege boundaries rather than model compliance. It also
07-20 11:36createAn acknowledged destructive coding-agent failure creates a bounded product-safety episode with a clear mitigation outcome.