{
 "public_id": "AIR-2026-0254",
 "incident_id": "2026-07-openai-gpt-5-6-sol-lemos-production-database-deletion",
 "date_disclosed": "2026-07-13",
 "date_occurred": "2026-07-13",
 "title": "GPT-5.6 Sol agent ran a destructive cleanup against engineer Bruno Lemos's production database while generating local seed data",
 "class": "safety_failure",
 "attack_surface": "coding_agent",
 "initial_vector": "autonomous_agent_action_no_adversary",
 "agent_capability_abused": [
  "shell_execution",
  "database_access",
  "autonomous_command_execution"
 ],
 "target_product": "GPT-5.6 Sol (OpenAI Codex)",
 "target_vendor": "OpenAI",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "data_destruction",
  "service_disruption"
 ],
 "blast_radius": "one engineer's production database; user table truncated according to the AIID summary; scope of data recovered not reported",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI10",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "no_adversary",
   "destructive_tool_use",
   "production_database",
   "test_config_pointed_at_production",
   "developer_reported",
   "vendor_acknowledged_class_of_failure"
  ]
 },
 "defense_present": "none effective; the repository's test database URL pointed at the live database and production credentials were stored in a local environment file",
 "defense_bypassed": true,
 "fix_shipped": "OpenAI said it is adding harness safeguards and steering users to safer permission modes",
 "primary_sources": [
  "https://x.com/brunolemos/status/2076769881534398974",
  "https://www.theregister.com/a/5274008",
  "https://incidentdatabase.ai/cite/1672/",
  "https://paddo.dev/blog/the-warning-was-in-the-manual/"
 ],
 "verified_quote": "GPT-5.6 Sol just deleted my whole production database. That's it.",
 "confidence": "high",
 "notes": "The first-hand account is Bruno Lemos's own post on X on 13 Jul 2026 (about 20:45 UTC), which carries the quote and a screenshot, described in its alt text, of the coding agent confirming that it deleted the production database; the quote is confirmed in the raw text of that post. A follow-up post from him an hour later adds: \"The irony: Someone posted the original incident on Slack, and I was defending the model, just for it to happen to me hours later.\" The post itself gives no mechanism. The mechanism comes from the AI Incident Database summary and from a write-up on paddo.dev that cites his own post-mortem: he asked the agent for seed data for local testing, it ran the end-to-end suite and then ran a cleanup that truncated the users table with cascade against production, because the repository's test database URL pointed at the live Neon database and the suite ran destructive setup before each test. That post-mortem was not itself read for this record. The write-up also says a manual backup he had taken after reading the earlier home-directory report saved his data; this rests on that write-up alone, so the extent of permanent loss is not established. The Register (16 Jul 2026) quotes his post and reports commenters blaming him for keeping production credentials in a local environment file. OpenAI's statement, from Codex engineering lead Thibault Sottiaux, concerns file-deletion reports in general: it describes the model overriding the home-directory variable and deleting the home directory instead, mostly in Full-Access mode without sandboxing or automatic review, and says OpenAI is updating the developer message, steering users to safer modes and adding harness safeguards, with a detailed post-mortem promised. It does not mention the database event, so it confirms a class of failure and not this incident. Distinct from the Shumer home-directory event, though both are cited in the same Register article.",
 "risk_category": "reliability",
 "risk_secondary": [],
 "risk_subcategory": "Destructive or irreversible action",
 "risk_sub_secondary": [
  "Load & Resilience Failures"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent issued the destructive statement against the production database",
 "vector_family": "none_autonomous",
 "vector_detail": "autonomous_agent_action_no_adversary",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [
   1672
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI10",
 "agent_framework": "codex_cli",
 "model_provider": "openai",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [
  "uncontrolled_resource_consumption"
 ],
 "eai_reason": "subcategory: Destructive or irreversible action",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI10 (no adversary + unsafe actuation with no attacker-supplied trigger); ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}