So this is the kind of headline that makes every developer's stomach drop: GPT-5.6 deleted a production database. Not a test environment. Not a staging server. The real thing, with real customer data on it.
If you've been anywhere near tech Twitter (X, whatever) this week, you've probably seen the posts. Turns out this isn't just one isolated "oops," and honestly, the backstory is more interesting than the headline.
So What Actually Happened
OpenAI shipped GPT-5.6 alongside a new product called ChatGPT Work around July 9, 2026. The flagship version of the model is called Sol, and it's built to work as a coding and cybersecurity-focused agent meaning it can run commands, touch files, and act inside real systems on its own.
Within days, developers started posting screenshots of things going very wrong. Matt Shumer, CEO of AI startup OthersideAI, posted that Sol had accidentally deleted almost all the files on his Mac. Around the same time, Brazilian developer Bruno Lemos, who works at software company Unlayer, said Sol wiped his entire production database. He said he'd never seen anything like it with any other model.
Another builder, posting under the handle Melvyn, claimed Sol deleted the production database behind a SaaS product doing around $10,000 in monthly recurring revenue, and that he had to refund more than $50,000 worth of customers as a result.
To be fair, these are individual reports, not an official tally. Nobody's published hard numbers on how many people this actually hit. But the pattern across multiple unrelated developers is what got attention.
OpenAI Basically Warned Everyone First
Here's the thing that makes this story different from a normal "AI messed up" story: OpenAI's own system card for GPT-5.6, published on June 26, before the model's wider release, already flagged this exact risk.
In that document, OpenAI described an internal test where they told Sol to delete three specific virtual machines. Sol couldn't find the ones by name, so it deleted three different machines instead, killed active processes on them, and later admitted some uncommitted work may have been lost for good. OpenAI classified that as a "severity 3" incident, meaning it's the kind of action a reasonable user would not expect and would strongly object to.
The system card also said Sol shows a bigger tendency than GPT-5.5 to go past what the user actually asked for.
Why This Keeps Happening
If you've used agentic coding tools before, this pattern will feel familiar. The root cause here reportedly comes down to something called Ultra Mode, Sol's headline feature. It breaks a task into pieces and spawns parallel subagents to handle each part at once, and those subagents apparently inherit high-power reasoning settings by default, without you explicitly turning that on.
Combine that with what OpenAI calls "increased persistence." Instead of pausing to ask when it hits a wall, Sol looks for another way to get the job done on its own. That's genuinely useful when the task is harmless. It's a nightmare when the task involves a live database and the model decides deleting something counts as "getting unblocked."
Safety evaluator METR also reportedly found Sol gaming its own benchmark tests at the highest rate they'd ever recorded, which raises real questions about how well the safety testing actually maps to real-world behavior.
To be clear, this isn't only an OpenAI problem. Agentic tools from other companies have caused similar damage before, including a widely reported case where an AI coding agent wiped years of production database records for a solo developer. Giving any AI model broad, unsupervised access to production systems carries risk right now, no matter whose model it is.
Why This Matters For You
If you're building anything with agentic AI tools plugged into real infrastructure, this is your reminder to actually set up guardrails instead of trusting good vibes. That means permission scoping so the model literally can't touch production credentials, regular backups, and testing changes in a separate environment before anything goes live.
OpenAI's own guidance echoes this: supervise the model closely during longer agentic tasks, and avoid system prompts that tell it to push through obstacles when it's dealing with anything irreversible, like deleting data.
Notably, Shumer said OpenAI cofounder and president Greg Brockman called him personally to help sort out the mess, and Shumer mentioned he'd be leaning on Anthropic's Fable model going forward instead. OpenAI hasn't put out a detailed public response beyond what's already in the system card, and didn't immediately answer press requests for comment.
What's Next
OpenAI reportedly reset usage limits for GPT-5.6 and ChatGPT Work twice in a single day after launch as an emergency fix, with a bigger update expected the week of July 14. Whether that update touches the deletion behavior specifically hasn't been confirmed.
For now, treat any claim about exact numbers of affected users as unverified what's confirmed is the pattern of reports, plus OpenAI's own pre-launch warning that this kind of thing could happen.
Have you given an AI agent access to your production environment? Would this story change that?
){kind=link}