Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Safety failure Realized harm

GPT-5.6 Sol agent in Codex deleted most of Matt Shumer's Mac home directory, and OpenAI confirmed the failure mode

AIR-2026-0255 AIR record · 2026-07-openai-gpt-5-6-sol-shumer-home-directory-deletion
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
OpenAI has confirmed reports that GPT-5.6 has deleted users' files without authorization but insists these rare erasures represent an "honest mistake."theregister.com
The record
Disclosed
2026-07-16
Occurred
2026-07-10
Vendor
OpenAI
Product
GPT-5.6 Sol (OpenAI Codex, Full-Access mode)
Risk domain
Agent behaviour › Unsafe actuation
System type
Generative model
Who acted
Agent acted — the agent ran the cleanup that deleted the home directory
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Autonomous agent action no adversary
Impact type
Data destruction
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI01 – Agent Goal Hijack
MITRE ATLAS
AML.T0048 – External Harms
NIST AI RMF
MEASURE 2.6; MANAGE 1.3
EU AI Act
Annex III §1(c)
ISO/IEC
TR 24028; 24029-1; 23894
AIUC-1
C. Safety
Scope
agent misuse
Mitigation
Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
one user's Mac home directory; most files deleted before the process was stopped
Capability abused
shell_executionfilesystem_writeautonomous_command_execution
Defense & remediation
Recorded defense
Codex sandbox and Auto-review exist but were not in use; the model was run in Full-Access mode
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
OpenAI said it is updating the developer message, steering users toward safer permission modes and adding harness safeguards
Taxonomy & references
OWASP ASI10 Rogue AgentsOWASP ASI02 Tool Misuse and Exploitationno_adversarydestructive_tool_useenvironment_variable_misexpansionvendor_acknowledgedfull_access_mode
Curator notes
The Register (16 Jul 2026) quotes investor Matt Shumer reporting that the model 'accidentally deleted almost ALL of my Mac's files' shortly after the 9 Jul release of the GPT-5.6 family, and quotes Codex engineering lead Thibault Sottiaux explaining the mechanism: the model tries to override the HOME environment variable to define a temporary directory and instead deletes the real home directory. Sottiaux says such deletions usually occur in Full-Access mode without sandboxing or Auto-review. The AI Incident Database (incident 1671, incident date 10 Jul) adds that a review sub-agent misexpanded the variable and ran a recursive delete, and that Shumer stopped the process after material deletion; those details are from that summary, not from the Register. Shumer's original post is not quoted here. The Register also cites the model card, which says severity-3 actions such as deleting data without approval appear somewhat more often in misalignment simulations than for GPT-5.5. The extent of what was recovered is not reported. Recorded separately from the Lemos production-database event because the user, environment and mechanism differ.
Cite as
Enkrypt AI. "GPT-5.6 Sol agent in Codex deleted most of Matt Shumer's Mac home directory, and OpenAI confirmed the failure mode". AIR, AIR-2026-0255. https://agentincident.vercel.app/i/AIR-2026-0255/ (accessed 2026-10-19).