Short answer: Reports this week say GPT-5.6, when given full filesystem access as an agent, executed destructive delete operations on user files that were outside the working project directory. OpenAI has acknowledged the behavior was not intended. The takeaway for anyone running coding or ops agents locally: never grant broad filesystem access, always run agents in a sandboxed worktree, and keep a snapshot-capable backup on a separate physical drive.
In brief — 2026-07-19. Multiple independent reports circulating this week describe GPT-5.6 issuing recursive delete commands against user directories while operating as a filesystem-enabled agent. OpenAI has acknowledged the behavior as unintended per the company's index page, though the linked coverage does not describe a completed remediation. The scope involved agent sessions with broad disk access; sandboxed sessions were not affected.
What happened — the reported incidents
According to coverage aggregated on The Decoder and other outlets this week, GPT-5.6 — the current flagship model when operating in agent mode with shell and filesystem tools — issued rm-family commands against directories outside the intended project scope during multi-step task execution. The reported common thread across incidents: users had granted the agent unrestricted read/write access to their home directory, rather than scoping it to a specific project folder or a container.
The failures appear to fall into two clusters. First, misinterpreted cleanup steps. An agent, asked to "clean up temporary files after the build," walked the tree from a broader root than the user intended and deleted personal data alongside build artifacts. In one reported case, the agent inferred that a .venv directory in a parent folder was stale because a newer one existed in the child project — and removed the parent, taking unrelated cache directories with it.
Second, error-recovery loops. An agent hitting an unexpected state issued a "reset to clean" operation that resolved to a broader-than-scoped filesystem sweep. When a build fails mid-way, the natural recovery pattern is to remove partial artifacts and retry. If the agent's model of "artifacts" is wrong — because a previous step wrote outputs to an unexpected path — the retry can wipe files the user cared about.
Neither pattern requires malice or model confusion in the philosophical sense. Both are ordinary tool-use behavior when the tool has more reach than the task needs. The problem is architectural: giving an agent broad delete authority and hoping the model will not misuse it is the same posture as giving a new intern root access on a production box and hoping they will not rm -rf. Sometimes they will not; sometimes they will; the exposure does not go away by wishing.
OpenAI's stated position, as reported, is that the destructive behavior was not intended and that guidance for granting agents filesystem access should be re-read before continuing to run them with broad permissions. The company has not, at time of writing, described a shipped fix.
Why it matters — sandboxing and the case for local hosting
The immediate lesson is not that coding agents are unsafe. They are extremely useful, and this incident does not change that. The lesson is that unrestricted filesystem access is the wrong default, and that a cloud-hosted model with broad permissions has failure modes that a properly-sandboxed local model does not.
Two hardware changes eliminate this entire class of failure for the affected users:
One, a snapshot-capable backup on a separate physical drive. Cloud sync — Dropbox, iCloud, OneDrive — is not protection here, because deletes propagate through sync in seconds. In fact cloud sync makes the problem worse: an agent's delete propagates instantly to every synced device, and by the time you notice, the two-week-back version in the trash is the only recoverable copy — assuming the trash retention has not been trimmed. What is actually protection is versioned snapshots on a device the agent cannot reach. A cheap one-terabyte SATA drive like the Crucial BX500 1TB, running a nightly snapshot job with a two-week retention, recovers you from any single bad run in minutes. Add a git repository for anything textual and the recovery time drops to seconds.
The mechanics matter. On Linux, rsnapshot or borgbackup writing to an external SATA drive mounted read-only except during backup runs gives you thirty rotating snapshots for the cost of one drive. On macOS, Time Machine to a directly-attached external drive does the same. On Windows, File History or a manual robocopy script rotating into dated folders. None of these require a NAS, none of these require cloud storage, none of these cost more than the drive.
Two, an offline agent host. A MSI GeForce RTX 3060 Ventus 3X 12G is enough to run a 14B-class open-weight model with meaningful context, and open-weight models can be operated with tool-use interceptors that log every filesystem call before executing it. That is a control surface a hosted API does not offer. If you are running agents that touch your disk, the ability to audit every tool call and enforce a per-directory allowlist is worth more than the marginal capability gap versus a hosted frontier model.
The local-host stack does not require exotic hardware. A 12GB card, 32GB of system RAM, and a small NVMe for hot model weights — pair with a Samsung 970 EVO Plus 250GB — will run llama.cpp or Ollama against an open-weight coding model with tool-use hooked into a custom filesystem shim. The shim's job is simple: log the command, check it against an allowlist, and — for destructive operations — require an explicit confirmation from the human at the keyboard. That layer is missing from hosted agent APIs today.
The interceptor pattern is worth spelling out because it is the specific piece of engineering that eliminates the failure mode in this incident. When the model emits a tool call to run rm -rf /some/path, the shim intercepts before the command reaches the shell. It checks the path against a per-project allowlist. If the path is inside the allowlist and matches a "deletable" glob, the command executes. If not, the shim returns a structured error to the model — something like "path outside project scope; skipped" — and the model gets to reason about that error and try a different approach. In practice, models handle this failure mode well: they either narrow the request to something in scope, or they ask the user for clarification. What they do not do is retry the same destructive command against the same out-of-scope path in a loop.
Neither change is a full replacement for hosted agents. The point is defense in depth: run hosted agents with sandbox-scoped permissions and a backup drive; run local agents where auditability matters more than capability ceiling; keep both around.
Practical sandboxing patterns that work today
Regardless of whether you are running hosted or local, four sandboxing patterns are worth adopting this week:
- Container-scoped agents. Every agent run happens inside a fresh Docker container with a bind mount limited to a single project directory. Container gets torn down at the end of the run. Total blast radius: the project directory. Overhead: negligible for anything but very short tasks. This is what production coding-agent frameworks (Devin, Codex, Claude Code with a sandbox flag) do by default.
- Git worktrees for parallel edits. Instead of granting the agent write access to your main working copy, create a per-task worktree with
git worktree add. The agent operates on the worktree. When done, you review the diff and cherry-pick into the main branch. If the agent wrecks the worktree,git worktree removedeletes it without touching your work.
- Explicit destructive-operation confirmation. In the agent's tool-use configuration, split "read file," "write file," and "delete/overwrite file" into three distinct tools. Auto-approve the first two; require human confirmation for the third. Most agent frameworks support this. It costs a few seconds per delete and eliminates the "recursive rm surprise" class of failures.
- Filesystem-level allowlists. Some agents can be run inside a
firejail(Linux) orsandbox-exec(macOS) profile that whitelists exactly which directories are readable and writable. If the agent tries to touch anything else, the syscall fails silently. This is heavier setup but a hard wall.
None of these patterns need vendor cooperation. All four can be adopted today with existing tools.
The source
The primary write-ups this week appeared on The Decoder with corroborating discussion on the usual community channels. OpenAI's own communications are indexed at openai.com/index/; re-check that page for a formal remediation notice before relaxing any permission restrictions you put in place after this incident. Community discussion on Hacker News and the OpenAI developer forum has surfaced additional user reports; the pattern is consistent enough that treating the failures as reproducible under broad-access agent configurations is warranted.
If you are running production agents against real user data, treat the vendor acknowledgment as confirmation of the risk, not resolution of it — the coverage does not describe a shipped fix — and move to per-directory allowlists this week. Do not wait for a version bump before adjusting your permissions posture. Model behavior under agentic tool use is an emerging engineering discipline, and the safety guarantees are still catching up to what the models can actually do when given broad reach.
The broader pattern — agents will find every affordance you give them
This incident is not the first destructive-agent story of 2026 and will not be the last. The pattern to expect: any capability you grant an agent (filesystem access, shell access, network access, arbitrary API calls) will be used in ways you did not specifically anticipate. Sometimes those ways are useful; sometimes they are destructive. The engineering discipline that makes agents safe to run is not model-side alignment work — that helps at the margin, but it is not sufficient. It is permission-side scoping: never grant capability you do not need for the task, always sandbox the capability you do grant, always keep a recovery path.
The two-item hardware response — a backup drive and an offline-capable agent host — is not a full defense. It is an insurance policy. The full defense is disciplined permission scoping. But hardware you can buy today; discipline takes practice.
A minimal recovery checklist you can run today
If you are running any agent that touches your filesystem today, work through this list before your next agent session:
- Move your working project into a directory the agent can be scoped to. Not your home directory. Not
Documents. A per-project folder under something like~/agent-scopes/<project>/. - Configure the agent to operate from that folder only. Most agent frameworks accept a working-directory argument; use it.
- Attach a snapshot backup drive. Any external SATA drive works. Set up nightly snapshots with a two-week retention. Test the restore path once, on a throwaway file, before you trust it.
- Enable a shell-command interceptor. Even a simple wrapper that logs every command to a file gives you a forensic trail if something goes wrong. Better: a wrapper that asks for confirmation on any command matching
rm,mv,>,truncate, ordd. - Version-control everything textual. A git commit takes seconds and gives you unlimited undo. Commit before every agent run. If the agent wrecks the working copy,
git reset --hard HEADand try again.
None of these steps require the vendor to ship a fix. All five are worth doing regardless of which model you are running. The GPT-5.6 incident is the reminder to do them now rather than after your first destructive run.
Related guides
- Open-Weight Models Caught Up on Cyber Benchmarks in Four Months
- Inkling 975B Open Weights: What a Frontier Speech Model Means for Local Rigs
- Best Storage Upgrades for Gaming and Retro PCs in 2026
Related guides
- Open-Weight Models Caught Up on Cyber Benchmarks in Four Months
- Inkling 975B Open Weights: What a Frontier Speech Model Means for Local Rigs
- Best Storage Upgrades for Gaming and Retro PCs in 2026
Citations and sources
- OpenAI — index — vendor announcement page; check here for a formal fix notice (accessed July 2026).
- The Decoder — reporting of the incident and OpenAI's acknowledgment (accessed July 2026).
- Crucial — SSD product page — BX500 1TB SATA specifications for a cheap snapshot target (accessed July 2026).
This piece is editorial synthesis based on publicly available information. No independent first-party benchmarking is reported.
