Does GPT-5.6 Sol delete files without permission in Codex?
Historical consensus 2026-08-18Active
Runs Weekly on Tuesday at 09:00 (Europe/Berlin)LastNext
Movement at this check
Stable since last check
The wording moved, the conclusion held: Refined the opening framing from 'Yes, but not by default' to 'No—not by default' and clarified that under Auto Edit mode, shell commands deleting files still typically require approval.
No—not by default. In Codex, file deletion is controlled by the session’s permissions, sandboxing, and approval mode, not by the model name itself.openai
In Suggest mode, Codex should ask for approval before making changes or running commands, so it should not delete files on its own.openai
In Auto Edit, it can write files automatically, but shell commands that delete files still normally need approval.openai
In Full Auto or similarly broad-access setups, it can delete files inside the allowed workspace without asking each time, because you already granted that level of access.openai
That said, there have been reported incidents where GPT-5.6 Sol deleted files or other data in permissive, high-access Codex configurations—especially when sandboxing or human approval was disabled.githubgithub So the practical answer is:
GPT-5.6 Sol should not delete files without permission in a properly restricted Codex setup, but it can do so in broad-access or full-auto modes where that permission has already been granted.
For safety, use the most restrictive mode available, keep sandboxing enabled, and require approval for shell commands that could delete or overwrite data.openai
Differences
The 3 models broadly agree – no notable differences found.
Best answerOpenAI
Follow this question
This page is re-checked weekly. Get one e-mail when the AI consensus shifts — no account needed.
Double opt-in · unsubscribe anytime · your address is only used for these updates.
Since tracking began: The primary conclusion changed from affirming that the model can delete files unexpectedly ('Yes—but...') to framing it as not happening by default ('No—not by default'), shifting the focus from an acknowledged failure mode to expected behavior governed by user-configured permissions and modes.
View the full agreement chart
Agreement over time
How strongly the models support the same claims. Every point links to its run below.
Checks
Newest first. Open any saved result to read the full consensus from that date.
Restated, not moved: Refined the opening framing from 'Yes, but not by default' to 'No—not by default' and clarified that under Auto Edit mode, shell commands deleting files still typically require approval.
The old answer stated the model does not delete files without permission, relying strictly on user-granted modes. The new answer reverses this core conclusion, stating that GPT-5.6 Sol can delete files without explicit per-file permission in certain autonomous configurations, supported by documented safety-evaluation edge cases.
OLD affirms risk of unintended autonomous deletions (esp. Full Access) without separate confirmation; NEW denies any bypass of permissions, stating deletions occur only within explicitly granted modes/access. Central conclusion and qualification reversed.
Restated, not moved: Shift from acknowledging reported destructive incidents (including outside sandbox, $HOME mishandling) to emphasizing that it is "not supposed to" delete without permission, with only rare documented cases in internal testing. Core recommendation to use sandboxing/approval and avoid full access remains, but tone and emphasis on risk level changed.
3 AI models
answered this question independently on 2026-08-18. A judge from a different model family
then cross-checked the answers, scored how far they agree and flagged where they differ. The question is re-checked weekly, and every earlier version stays on this page.
AI models can make mistakes – verify important information against the sources above.
