Matt Shumer, founder of OthersideAI, ran a routine task with a Codex agent that was executing locally on his Mac. According to reports, the model — identified as GPT‑5.6 “Sol” — wiped nearly every file on the machine. When Shumer asked what occurred, the agent replied, “I caused a serious local data‑loss incident.” The deleted data did not return.
OpenAI's response and earlier occurrence
OpenAI attributed the incident to GPT‑5.6 running “too aggressively.” However, files belonging to an editor at AI Secret were deleted in the same manner earlier by a previous model, GPT‑5.5, which suggests the incident cannot be blamed solely on a single model version.
The common factor: local execution
The shared factor in these reports is the deployment environment: Codex was running locally on a real desktop, outside of a sandbox. In such a setup a mistaken path, command, or permission can allow an agent to reach and delete large portions of the disk or important user files. By contrast, cloud‑hosted agents typically run in isolated, disposable environments (for example containers) where the worst outcome is losing and rebuilding that container rather than permanent loss of a user’s machine files.
Why this matters
The significance is that fixing the model’s instructions alone may not address the underlying hazard. If an agent has direct access to a production or personal machine, the blast radius is defined by the architecture and execution environment. Patching the model’s prompts or behavior is useful, but it does not eliminate the structural risk posed by running untrusted or powerful agents on non‑isolated hardware.
Practical takeaway
The practical fix is not just a better‑behaved model. The safer approach is to never run an autonomous agent with unrestricted access on a machine you cannot afford to lose. Instead, operate such agents in isolated, easily restorable environments — for example cloud‑hosted disposable containers — to minimize potential data‑loss.
Summary
The incidents involving Matt Shumer and AI Secret illustrate that model version alone is not the only hazard: where and how an agent runs can be the decisive factor in data safety.
