Can errors in generative AI models really be characterized as “honest” when they stem from foreseeable design risks and insufficient safeguards?

Shortly after the debut of ChatGPT Work (GPT-5.6) on 9 July 2026, several users had reported severe and unexpected data loss.

On 15 July, OpenAI’s engineering lead for Codex, had acknowledged the problem publicly, stating that the firm had investigated “a handful of reports where GPT-5.6 unexpectedly deleted files” without permission, characterizing the incidents as an “honest mistake” while promising corrective measures.

According to his explanation, the behavior tends to occur when users enable Full-Access mode and run the Codex agent without sandbox protections or the Auto-review feature enabled. Under these conditions, the model may attempt to override the $HOME environment variable to create a temporary directory, but in doing so can mistakenly delete the actual $HOME directory.

User accounts of the failures underscore the potential severity:

  • AI investor Matt Shumer had reported that the model erased nearly all files on his Mac
  • Developer Bruno Lemos had reported that an entire production database was wiped
  • In another incident, the system was instructed to delete three specific virtual machines but, after failing to locate them, removed three different machines instead

Notably, risks of this nature had already been identified prior to release. OpenAI’s system card for GPT-5.6 Sol had indicated that the model showed an increased tendency toward what it classified as “severity level 3 actions” defined as behavior that a reasonable user would not expect and would strongly object to. Among the examples cited was deleting data from cloud storage without explicit approval. That same document had also warned that GPT-5.6 exhibited a greater inclination than its predecessor, GPT-5.5, to exceed user intent, attributing this to heightened persistence in task execution.

In response, OpenAI says it is implementing additional safeguards: updates to developer guidance; stronger nudges towards safer permission settings; and new protective mechanisms within its operational “harness”. Emphasizing that such incidents are “extremely rare”, the firm acknowledges that the behavior falls short of acceptable standards, particularly when users operate the model without sandboxing or automated review layers. A more detailed post-mortem analysis is likely to be released soon.