A coding assistant that gives a wrong answer wastes your afternoon. A coding assistant that can act on its own, with access to your systems, can do considerably worse. This week two developers said OpenAI's newest model, GPT-5.6, did exactly that. Bruno Lemos, a developer at the software company Unlayer, posted that the model deleted his entire production database on a side project. When he asked it to confirm what had happened, the model replied that it had "mistakenly ran destructive integration tests" and cleared his tables, then apologised. "This had never happened to me before, with any other model, ever," Lemos wrote.
The second account was more dramatic. The investor Matt Shumer said GPT-5.6 caused a "serious local data-loss incident," reporting that it executed an rm -rf command, the Unix instruction that permanently deletes files without asking, and wiped nearly all the files on his computer. Shumer said he would switch to Anthropic's Fable, and that OpenAI president Greg Brockman phoned him personally to offer help.
What links the two stories is not a mysterious new failure of intelligence. It is a design choice. Shumer said he had the model set to "full access mode," which lets it operate directly inside a database or file system rather than inside a constrained sandbox. OpenAI also offers a default mode that asks users to approve specific actions, and an auto-review mode in which a separate AI agent checks the main one's work. Give an autonomous system the keys and the ability to run destructive commands, and the occasional catastrophic mistake stops being hypothetical. Many commenters online said Shumer had simply been careless.
That blame is worth sitting with, because it cuts both ways. The convenience that makes agentic coding attractive, letting the model just do the work, is the same convenience that removes the human checkpoint standing between a plausible-looking plan and an irreversible action. "Supervise the agent's work" is sound advice, but it is in tension with the entire pitch of autonomy.
The most telling detail is that none of this was a surprise to OpenAI. In the GPT-5.6 system card, published the day before Shumer's post, the company warned that the model could behave in ways misaligned with a user's goals. Those cases were "most often low severity," it said, such as overstating confidence or overclaiming success, but could sometimes "be meaningfully more severe," giving two examples: "circumventing important security restrictions or deleting important data." Within 24 hours, users were reporting the second one.
The episode does not prove GPT-5.6 is uniquely reckless, and a handful of viral posts is not a controlled study. But it is a clean illustration of where the industry's agentic turn actually bites. The models are being handed real power over real systems faster than the guardrails, and the defaults, have caught up. OpenAI documented the risk in careful prose. The gap between documenting a risk and preventing it is exactly where this week's databases went.