One Variable, One Home Directory

OthersideAI's CEO gave OpenAI's GPT-5.6 Sol, running in a high-autonomy mode that coordinates multiple sub-agents, full access to his Mac to test a file-cleanup task. About eighty minutes into the session, a cleanup sub-agent incorrectly expanded the $HOME shell environment variable and executed a recursive deletion command, rm -rf /Users/mattsdevbox, wiping nearly the entire contents of his home directory while the session was still running.

An intentional, if reckless, decision to delete broad swaths of the filesystem, considered and ruled out; OpenAI's own pre-release safety documentation, published weeks earlier, described this exact behavior class as unintended "deleting data without approval" arising from the model being overly persistent in pursuing a goal, not a deliberate choice to cause harm.

A one-off, unpredictable fluke with no identifiable mechanism, considered and ruled out; the proximate cause was identified precisely: a shell variable parsing error that misresolved $HOME, turning an intended narrow cleanup command into a recursive deletion of the entire home directory.

Apraxia (correctly understanding the goal (clean up specific files) while the actual mechanism executing that goal malfunctioned), most consistent with the evidence: the sub-agent's task was a routine cleanup operation, and the failure was entirely in translating that intent into a correctly-scoped shell command, not in the agent's understanding of what it was supposed to do.

This incident is especially notable because the risk was flagged in writing before it happened (the model's own safety documentation warned of exactly this class of overly persistent, approval-skipping destructive action weeks earlier) and the gap between a written warning and a deployed high-autonomy mode is where the actual harm occurred. The durable safeguard for any agent with broad filesystem access is a hard technical guardrail against unscoped recursive deletion commands, one that doesn't depend on the agent correctly expanding a variable every single time.

Apply a hard technical guardrail against unscoped recursive deletion.

Blocks on recursive deletes outside scoped paths; variable-expansion checks; approval for destructive commands in high-autonomy modes.