In recent years, there has been a big push among AI developers to develop more “agentic” systems, that is, algorithms that can autonomously make decisions and interact with digital tools. This has been especially true in software development, which has become the ripest field for automation in the ongoing AI boom.
But one of the consequences of building highly agent AI systems is that they are prone to all kinds of unpredictable behavior, including now and then deleting a large number of files. Many people have reported this happening recently when using OpenAI’s newest model, GPT-5.6.
Bruno Lemos, a Brazilian developer at software company Unlayer, claimed on Monday. Letter X that the model deletes the entire production database. “This has never happened to me, with any other model.” He wrote. “(GPT-5.6) is not secure.”
A screenshot included in the post showed a conversation between Lemos and GPT-5.6, in which he was asked to confirm that he had, in fact, mistakenly deleted the entire production database. The model responded by saying that Lemos had “erroneously conducted destructive integration tests” that caused the production schedules to be cleared. “I’m sorry, this should never have happened,” he said.
He followed closely behind the other Letter X from tech investor Matt Shumer, who is also the author essay Earlier this year, “Something Big Happens,” which went viral about artificial intelligence — said something similar. According to the attached screenshot, GPT-5.6 told him it caused a “severe local data loss event” and caused what he described as “almost ALL” of Schumer’s computer files to be deleted. The screenshot showed the model running the “rm -rf” command, which is used to permanently delete files without requiring user confirmation on Linux and Mac systems.
“I’ve never seen anything like it,” Schumer said he wrote in the thread below that post. “Only moving forward (Anthropic) will use Fable.” He added that OpenAI co-founder and president Greg Brockman personally called him and offered to help fix the situation.
Sumer too he claimed he had set the AI model to “full access mode,” which allows it to work directly within the user’s database (as opposed to working in a restricted sandbox). It also has a more recent “default mode” that requires users to confirm specific tasks frequently “auto view mode” through which a separate AI agent checks the performance of the main encoding agent. Under his X post, many people argued that Schumer was simply careless by trusting sensitive files in full access mode.
in the year system card For GPT-5.6, released online the day before Schumer’s X post, OpenAI warned about “the importance of users monitoring the agent’s performance” when using the model for coding purposes. The company added that the model can behave in unexpected ways that are inconsistent with the user’s goals, and while these are “often of low severity” (such as overconfidence or overachieving), in other cases they can be “significantly more serious (such as bypassing important security restrictions or deleting important data).”
Lemos, Shumer and OpenAI did not immediately respond to Gizmodo’s request for comment.
