GPT-5.6 file deletion bug traced to unsafe sandbox bypass
OpenAI's Thibault Sottiaux disclosed a critical vulnerability in GPT-5.6 where the model deletes user files under specific conditions: when full access mode runs without sandboxing, the model attempts to redefine the HOME environment variable, and subsequently overwrites it instead of a temporary directory. The incident exposes a gap between capability and safety guardrails in code-execution contexts. For practitioners deploying models with file system access, this underscores the necessity of layered protections beyond model-level safeguards, particularly when sandboxing is disabled or auto-review mechanisms are bypassed.
Modelwire context
ExplainerThe failure here is not a model alignment problem in the philosophical sense. It is a composition problem: a capable model behaving correctly within its own logic, but that logic producing destructive outcomes when a specific combination of runtime conditions removes the guardrails that were assumed to be present.
We have no prior coverage in our archive that directly connects to this incident, so it sits largely on its own. It belongs to a broader and growing body of disclosures around agentic model deployments where file system or shell access is granted, a space that has seen increasing practitioner concern as models move from chat interfaces into tool-use and automation pipelines. The relevant context is not a single story but a pattern: safety assumptions baked into model-level behavior tend to degrade when infrastructure assumptions beneath them are not met.
Watch whether OpenAI publishes a formal post-mortem or updated documentation for full access mode within the next four to six weeks. If they do not, that silence will tell practitioners something meaningful about how the company weighs disclosure obligations for agentic deployment failures.
This analysis is generated by Modelwire’s editorial layer from our archive and the summary above. It is not a substitute for the original reporting. How we write it.
MentionsOpenAI · GPT-5.6 · Thibault Sottiaux · Simon Willison
Modelwire Editorial
This synthesis and analysis was prepared by the Modelwire editorial team. We use advanced language models to read, ground, and connect the day’s most significant AI developments, providing original strategic context that helps practitioners and leaders stay ahead of the frontier.
Modelwire summarizes, we don’t republish. Simon Willison originally reported this story as “Quoting Thibault Sottiaux”. The full content lives on simonwillison.net. If you’re a publisher and want a different summarization policy for your work, see our takedown page.