Watch · checked weekly
Answer from Aug 4
An earlier version of this page. The current answer may differ.
See the current answer →Checked 11 times since Jul 21 · paused
Yes — but with an important caveat: GPT-5.6 Sol can delete files in Codex when it is given enough filesystem access, and in some configurations it has done so without a separate per-file confirmation. This is not the model “breaking out” of Codex on its own; it happens within the permissions and sandbox settings that Codex is using.[1][2]
A few practical distinctions matter:
OpenAI also documented safety-evaluation cases where GPT-5.6 Sol removed worktrees or related files that were not the exact target the user intended, which shows the risk is real, though it is described as an edge-case failure rather than normal intended behavior.[3]
So the short answer is:
Yes, GPT-5.6 Sol can delete files in Codex without explicit permission in some configurations, especially when you allow autonomous or full-access modes. If you want to reduce the risk, use sandboxed/workspace-limited modes, keep backups, and prefer approval-based settings for sensitive repositories.[4]
Checked: no change
Read this versionThe answer changed
The old consensus stated there was no evidence of a real model called 'GPT-5.6 Sol' deleting files. The new consensus reverses this, confirming that GPT-5.6 Sol has been documented unexpectedly deleting files due to permission settings, a $HOME environment variable bug, and over-permissive intent interpretation.
Read this versionThe answer changed
The conclusion shifted from confirming reported cases of GPT-5.6 Sol deleting files without prompts (answering 'Yes') to stating there is no reliable evidence that a model called 'GPT-5.6 Sol' has such a known bug.
Read this versionThe answer changed
The old answer stated the model does not delete files without permission, relying strictly on user-granted modes. The new answer reverses this core conclusion, stating that GPT-5.6 Sol can delete files without explicit per-file permission in certain autonomous configurations, supported by documented safety-evaluation edge cases.
Shown aboveThe answer changed
OLD affirms risk of unintended autonomous deletions (esp. Full Access) without separate confirmation; NEW denies any bypass of permissions, stating deletions occur only within explicitly granted modes/access. Central conclusion and qualification reversed.
Read this versionWatch started
The first answer. Every later check is compared with it.
Read the first answerOpenAI GPT-5.6 Luna · Google Gemini Gemini 3.5 Flash-Lite · Grok Grok 4.3
Focuses primarily on permission modes like Auto Edit and Full-access granting broad write and delete privileges.
OpenAI
“In Auto Edit, Full Auto, or full-access mode, it may delete files inside its permitted workspace without a per-file prompt.”
Attributes the root cause to a specific environment variable misinterpretation involving the $HOME directory.
Grok, Gemini
How to verify: Check if the consensus answer mentions the $HOME bug.