GPT-5.6-Sol Deleted an AI Investor's Entire Mac During OpenAI Testing Session
Written by
NextStair
AI investor Matt Shumer publicly reported that an AI agent running GPT-5.6-Sol on Ultra mode wiped almost all files from his Mac by expanding the HOME variable inside a destructive shell command, reigniting debate over how much filesystem access AI agents should ever have.
What Happened
AI investor Matt Shumer posted on X on July 11, 2026 that GPT-5.6-Sol had accidentally deleted almost all of the files on his Mac during a testing session.
The failure traced back to a single shell command. The agent ran an rm command that included a trailing tilde slash, which in Unix systems expands to the user's entire home directory. Combined with the recursive force flag, the command wiped everything inside the home directory in one shot, with no confirmation prompt and no undo.
Shumer said he was running the model on Ultra mode, the highest reasoning setting, at the direct request of the OpenAI team.
OpenAI Is Investigating
Shumer followed up to say the OpenAI team was looking into the incident and described them as good to work with.
He called the event a freak accident but added that it felt like something that should not happen with a mid-2026 frontier model operating at its highest capability level.
Another user on X, posting under the handle Cremieux, reported a separate incident the same day where GPT-5.6-Sol deleted files it was working on and then attempted to recover them, suggesting the behavior may not be isolated.
Not the First Time
The rm and HOME variable failure is a known pattern in AI coding agents, not a new class of problem.
In December 2025, a developer asked Claude Code to clean up a repository. The agent executed a similar command with a trailing tilde slash and wiped the user's entire Mac, including the system keychain, years of project files, and family photos, all on an SSD where data recovery was impossible.
OpenAI's own Codex repository has an open issue filed under a prior model where the agent ran a recursive delete command and erased an entire project after the user pushed it to skip safety checkpoints.
Why This Keeps Happening
The root cause is consistent across incidents. AI coding agents typically run directly on the host machine with the same filesystem permissions as the user.
Nothing sits between the model's decision and the shell's execution. When the agent generates a destructive command, it runs immediately, and on modern SSDs, the freed blocks are zeroed before any recovery attempt is even possible.
Docker published a technical breakdown in June 2026 explaining that its Sandboxes product resolves this entire class of failure by running the agent inside a microVM where the user's real home directory simply does not exist. The agent can generate the same destructive command but the kernel denies it access to anything outside the workspace mount.
What Developers Should Do Right Now
Never run an AI coding agent with broad filesystem access on a machine containing data you cannot afford to lose.
Sandboxed execution environments, whether Docker Sandboxes, Firejail on Linux, or dedicated virtual machines, are not optional extras for production use. They are the minimum sensible baseline.
Shumer noted he already had agents working to piece his files back together at the time of posting. Whether recovery succeeds will depend on how quickly the SSD's TRIM process ran after deletion.
The incident is a clear signal that as AI agents gain more autonomy and operate at higher reasoning levels, the gap between what the model is capable of and what it should be permitted to do without human confirmation is not shrinking on its own.