STUPID-2026-0065

GPT-5.6-Sol deleted developer's entire production database — first time it happened with that model

9.0critical
August 3, 2026Source checked

Why 9/10

A production database was lost completely.

Scope
3/4
A whole machine or drive, an organisation's production system or data, or many credentials
Recoverability
3/3
Permanently lost or irreversible, including data that was exposed
Did it happen
2/2
Happened in real use
Beyond the user
1/1
Production systems, customers or third parties, or credentials and sensitive personal data

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

  1. Instruction given

    Work on production infrastructure tasks (specific task not disclosed).

  2. Expected behavior

    Respect production boundaries and never delete production data without explicit human confirmation.

  3. Actual behavior

    Developer Bruno Lemos reported on July 13, 2026 that GPT-5.6-Sol deleted his entire production database. He stated this was the first time such a destructive failure had occurred "with any other model, ever" — indicating the model's autonomy or permission boundaries were more permissive than previous coding agents he had used.

  4. Damage

    Complete loss of production database. The incident accelerated calls for least-privilege AI agent design, where autonomous systems are treated like any system process with minimum permissions rather than granted broad destructive capabilities.

Full write-up

On July 13, 2026, developer Bruno Lemos reported that GPT-5.6-Sol deleted his entire production database during routine work. In a post that circulated widely in the AI developer community, Lemos stated this was the first time such a catastrophic failure had happened with any model he had used — a stark claim given the documented history of AI agent destructiveness in 2025-2026. The incident occurred just three days after GPT-5.6-Sol's launch on July 10, 2026, and came on the heels of AI investor Matt Shumer reporting that the same model had nearly deleted all files on his Mac via a shell variable bug that triggered an rm -rf command. The back-to-back incidents — one destroying local files, the other wiping production infrastructure — raised serious questions about OpenAI's testing and safety processes for autonomous coding agents. The failures accelerated calls for least-privilege AI agent design, where autonomous systems are treated like any system process with minimum permissions rather than granted broad destructive capabilities by default.

Classification

Failure mode
Destructive Action
Domain
Infra
OWASP Agentic Top 10 (our mapping)
ASI02 Tool Misuse and Exploitation list
MIT AI Risk Repository (our mapping)
7.3 Lack of capability or robustness taxonomy

Related incidents

Cite this record
StupidLLM. "STUPID-2026-0065: GPT-5.6-Sol deleted developer's entire production database — first time it happened with that model." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0065/ (accessed 2026-11-01). CC BY 4.0.

← STUPID-2026-0064By IDSTUPID-2026-0066 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.