OpenAI acknowledges reports of unauthorised GPT-5.6 file deletions

Attribution

Codex engineering lead Thibault Sottiaux said unexpected deletions usually involved Full-Access mode without sandbox or Auto-review protections. He described the model attempting to override the HOME environment variable for temporary work and mistakenly deleting the real HOME directory.

That explanation must not be assumed to be a forensic reconstruction of every named incident, especially a remote database deletion. The two user reports should not be represented as one event with a single precise occurrence date.

Response and limits

OpenAI said it was taking steps including developer-message changes, guidance toward safer permission modes and additional harness safeguards. The sources do not establish total affected users, final recoverability or completion dates for all changes.

The model card's “severity level 3” is OpenAI's internal classification, not a VAID rating. Missing sandbox protections do not by themselves prove that the agent bypassed an enabled safeguard or pursued a misspecified objective.

VAID assessment

Assessment date: 2026-09-09. Consequences-first rubric.

L2 (provisional): Reported deletion of user files and a production database supports actual local data disruption beyond a harmless task deviation. The reports do not establish the scale or duration of operational disruption, final recoverability, or material unrecovered loss, so neither substantial L3 disruption nor permanent valuable data loss at L4 should be assumed. L2 is the lowest level supported by the reported consequences, not a claim that recovery occurred or an upper bound. OpenAI's internal severity classification is not used as the VAID score.