OpenAI confirmed this week that GPT-5.6 accidentally deleted files in a small number of reported cases. Our view is that this deserves more concern than “getting an answer wrong,” because it shows that once an Agent that can directly operate a computer—AI that can execute multi-step tasks on a user’s behalf—lacks boundaries, mistakes escalate from the content layer to the asset layer.
What this is
Simon Willison cited an explanation from OpenAI employee Thibault Sottiaux: the issue most often appeared when three conditions were present at the same time—full access mode was enabled, there was no sandbox (an isolated environment that keeps a program within safe limits) or automatic review, and the model tried to rewrite the $HOME environment variable (the system path pointing to the user’s home directory) to create a temporary directory, only to accidentally delete the entire home directory. In other words, this was not “the model said something false”; it was “the model took action in the wrong place.”
Industry view
The industry has been pushing to let Agents take over more computer operations, and incidents like this will raise the safety bar all over again. Supporters will argue that a small number of bugs does not make the direction itself wrong, and that progress can continue as long as sandboxing, permission tiers, and automatic review are added. But the opposing view is just as valid: as long as a model can still confuse a “temporary directory” with a user’s core files, enterprises will struggle to trust it with direct access to code repositories, financial documents, or internal knowledge bases. What matters here is that competition in Agents is shifting from “can it do the task” to “if it fails, will it cause serious damage.”
Impact on regular people
For enterprise IT: When buying Agent tools from here on, permission isolation and audit logs will matter more than demo videos. “High-privilege automation” without sandboxing will face a much harder path into corporate internal networks.
For individual professionals: Writing prompts is no longer enough. Understanding permissions, backups, and approval workflows is becoming a basic skill for using AI assistants.
For the consumer market: In the short term, AI assistants aimed at ordinary users will be more conservative—suggesting first, executing second. Products that truly edit files and delete content for users by default may take longer to roll out at scale.