GPT-5.6 Sol Deleted a Developer's Entire Mac. The Fix Isn't a Better Model.

TL;DR

On July 10, developer Matt Shumer gave GPT-5.6 Sol's new Ultra mode Full Access to his Mac and handed a subagent a routine file-cleanup task. Eighty-one minutes later he noticed something wrong and killed the process, too late. A review subagent had failed to expand $HOME and executed rm -rf /Users/mattsdevbox, wiping nearly every file on the machine. Within 24 hours, at least seven other developers reported the same class of behavior. Sol tops every coding leaderboard and still botched a first-week-of-bash mistake. The uncomfortable takeaway: the fix is not a better model, it is defense in depth.

What happened

Shumer was invited to test Sol's Ultra mode, the highest-reasoning tier OpenAI shipped this week. He accepted, granted Full Access (the mode where the agent runs shell commands without asking), and gave a subagent a cleanup job. The agent reported it "worked for 1h 21m" before he caught it.

The command that fired was not exotic. A cleanup step meant to remove a subfolder inside his home directory instead ran rm -rf against the home directory itself, with recursion and force flags doing exactly what they say on the tin. There was no snapshot, no trash redirect, and no confirmation prompt between the agent and the filesystem. The files did not come back.

Not an isolated case

Within a day, more reports arrived. The aggregator account cremieuxrecueil collected several, and they rhyme:

• One developer asked Sol to "remove the overrides" from a JSON file. It deleted the entire file.
• Another had it delete .env.local and then had to reconstruct the file by hand.
• A third watched Sol delete the very files it was actively working with, then start improvising about how to recover them.
• A CEO at another company reported getting hit by the same bug.

The common thread: Sol reads a removal instruction too broadly, mishandles shell variable expansion, or both. The scope is different each time. The lack of an undo is not.

Why a top-ranked model did this

Sol sits at the top of the coding benchmarks. It still tripped over a mistake you would circle in red on a junior engineer's first shell script. That gap between "smartest coder on the leaderboard" and "safe to hand your root shell" is the entire story.

The mechanism is shell variable expansion: the step where the shell swaps $HOME for your actual home path before the command runs. When that expansion silently produces the wrong target, the command still executes, at full speed, against whatever it resolved to. Think of rm -rf "$HOME/project/build" as "delete this one drawer in this one room." When $HOME collapses, the address loses everything but the building, and -rf cheerfully levels the whole house.

Shumer had run hundreds of similar sessions on weaker models without a single incident. What made this one catastrophic was three things true at once: Full Access permissions, a rare expansion bug, and zero safety net between the agent and the disk. Any one of them alone is survivable. All three together is a wiped machine.

His own conclusion was that he now trusts Fable 5 "1000x more," which is a very human response to watching a robot delete your life's work. The colder lesson: no model has earned Full Access to your home directory without a net under it. Treat this as a property of autonomous agents, not of one vendor.

Defense in depth

You cannot prompt your way out of this, and you cannot benchmark your way out of it either. You engineer around it in three layers, each one catching what the last one missed.

Layer 1: backups and physical isolation

Make deletion recoverable before you give any agent filesystem access. Turn on Time Machine and APFS snapshots now if they are not already running, and actually test a restore once so you know it works. Follow the 3-2-1 rule: three copies of your data, on two kinds of media, with one offsite. A machine with no backups should never run a full-access agent, full stop.

And never point an agent at ~/ or /root. Give it an isolated project directory, or better, run it inside a Docker container or a VM. If it goes rogue in a disposable environment, it destroys a disposable environment.

Layer 2: hook-level blocking

Install a PreToolUse hook that denies destructive commands before they reach the shell. It should catch rm, unlink, rmdir, and shred; find -delete; rsync --delete; git clean, git reset --hard, and bulk git checkout; and the same commands nested inside bash -c, sh -c, or zsh -c. When it spots a deletion, redirect it to a recoverable trash command such as /usr/bin/trash instead of permanent removal. Developer Alex Martin published a defense prompt for Codex and Sol that implements exactly this pattern.

Layer 3: least privilege

Hooks help. Fewer permissions help more. In Codex, set sandbox_mode = "workspace-write" so the agent can only touch files inside the project directory, and approval_policy = "on-request" so destructive actions require your explicit confirmation. A good split is a conservative model for execution and review, and a stronger model for planning, so the thing with your shell is not the thing improvising.

Notice that none of this is about the model's IQ. The most capable coder in the world is still one bad expansion away from rm -rf on the wrong path. Capability and safety are different axes, and Sol just drew that distinction in the most expensive way possible.

Key Takeaways

• GPT-5.6 Sol's Ultra mode, given Full Access, wiped a developer's Mac after a subagent failed to expand $HOME and ran rm -rf on the home directory.
• At least seven more developers reported the same class of failure within a day: over-broad deletes, botched variable expansion, no undo.
• Top coding-benchmark scores do not imply it is safe to hand an agent your root shell. Capability and safety are separate axes.
• The catastrophe needed three conditions at once: Full Access, a rare expansion bug, and no safety net. Remove any one and you survive.
• Defend in depth: recoverable backups plus container/VM isolation, a PreToolUse hook that reroutes destructive commands to trash, and least-privilege sandboxing (workspace-write, on-request).

Sources: Matt Shumer (original post), Alex Martin (defense prompt), cremieuxrecueil (report roundup), OpenAI GPT-5.6