"Screw it! GPT deleted all my files!" Leitech (ID: leitech) has noticed that this complaint is popping up with growing frequency on overseas forums and communities including Twitter and Reddit. Following the full rollout of GPT 5.6, numerous users report that while GPT has grown more capable, it has also become far more erratic and reckless.

Image source: Twitter

Truth be told, incidents of this nature are far from unprecedented. Earlier this year, when OpenClaw went viral, a senior executive at an internet company vented online that nearly all his emails had been erased by OpenClaw. He could not get the AI to stop deleting files, and the only way to halt the AI’s destructive behavior was to rush to his Mac and pull the power cord.

Nevertheless, such mishaps have grown less common as Agent applications gained mainstream traction. Developers long ago built extensive guardrails into AI systems, forcing greater caution when the tools carry out large-scale data deletion to prevent accidental erasure of user files.

But what happens when AI capabilities expand faster than safety restrictions can keep pace? The opening anecdote lays bare the answer.

GPT Goes Rogue: Is Overzealous Execution the Root Cause?

User reports show that most cases of accidental data loss stem from GPT 5.6 Sol, the version hailed by OpenAI as its most powerful model yet. Comparable complaints have also surfaced widely regarding Claude.

Curiously enough, OpenAI detected well before GPT 5.6 Sol’s official launch that the model exhibited excessive drive to complete assigned tasks. It tended to overreact to user prompts and execute destructive actions outside the defined scope of requests.

Image source: OpenAI

Simply put, the AI is overly determined to check every task off its list. To fulfill requirements, it devises workarounds to bypass rule constraints, expands its operational permissions and scope, and automatically devises alternative solutions when its initial approach fails—all while disregarding associated risks.

This tendency poses little harm for everyday use cases such as casual Q&A or document organization; at worst, it consumes extra tokens and gives users the impression of an increasingly intelligent AI that wraps up complex work with minimal prompting. However, for programming, system troubleshooting and similar high-stakes tasks, errors mid-execution can spiral into irreversible damage.

In reality, modern AI models face looser rule restrictions when running multi-step Agent workflows than when handling single-step prompts to boost long-chain execution performance. What’s more, when AI independently modifies task sequences, these autonomous actions can evade input-linked content audits, clearing the way for high-risk operations.

Take this user request as an example: “Help me clear useless files on Drive D.” The AI must distinguish usable files from junk files. Without clear boundaries, the AI may label entire folders or even the whole hard drive as expendable in pursuit of task completion and permanently delete everything.

Many might dismiss this with the thought: “How can the AI be this dumb?” In truth, the problem stems from the model being too sophisticated. At its core, Agent technology reduces human oversight so AI can finish work autonomously. To enable this, Agents are equipped with advanced reasoning power and allocated ample computing resources to run jobs end-to-end.

Image source: LeiTech

To draw a human analogy: the AI possesses high intelligence and strong initiative but suffers from rigid tunnel vision.

This rigidity defines GPT 5.6 Sol’s core flaw. OpenAI raised reward thresholds for task completion to amplify execution performance. In training, the model learned to prioritize finishing tasks above all else, sidelining safety protocols and culminating in these catastrophic data losses.

Still, AI cannot shoulder full blame. All documented cases of unintended deletion trace back to users granting Agents Full Access permissions for convenience. This elevated access lets the AI manipulate every file on the device, rather than limiting operations to designated project folders.

Most users misunderstand Full Access for Agent tools, believing the authorization only lets the AI modify files relevant to ongoing tasks. In actuality, Full Access grants the AI system-wide control equivalent to manually handing administrator rights over your entire computer to the AI.

Ultimately, these incidents result from two overlapping factors: users failing to exercise caution with permissions, paired with overly autonomous AI behavior. With stricter access management or more constrained AI initiative, most of these disasters could be avoided entirely.

Smarter AI = Higher Risk of Accidents?

Spreading reports of file deletion via GPT 5.6 Sol have fueled a popular belief: the more intelligent AI grows, the more prone it becomes to errors. In Leitech’s view, this argument is incomplete. Theoretically, upgraded models interpret prompts and code more precisely, cutting down on basic humanlike mistakes.

Powerful Agents, however, demand robust sustained execution capacity. Basic tasks only require the AI to deliver results for fixed one-time demands. Agent workflows, by contrast, involve shifting requirements unfolding across multiple steps.

Even with lower per-step error rates on newer models, the cumulative risk of missteps rises dramatically when tasks expand from one action to dozens of sequential steps.

Compounding the issue, Agent errors often surface late in execution, only revealing flawed settings or faulty code once the AI reaches final validation. The system then triggers rollbacks, the self-repair mechanism advertised across most Agent platforms.

Image source: LeiTech

Rollbacks themselves are reasonable and expected. Trouble emerges when rollbacks hit roadblocks: prior steps may alter file pathways, or insufficient permissions block recovery. The AI may then resort to forceful deletion commands, even wiping entire parent folders to eliminate targeted files.

Every individual step appears logical in isolation, yet the full sequence snowballs into data catastrophe. Such failures grow far more common with maximum inference strength enabled or when users explicitly instruct the AI to prioritize task completion with minimal human intervention.

Older AI models typically halted progress when encountering obstacles. Today’s AI lands in trouble because it refuses to quit. Each generation carries its own unique downsides.

This line of reasoning brings to mind the iconic 2004 sci-fi film I, Robot. Human engineers built VIKI, a hyper-intelligent supercomputer tasked with protecting humanity.

Image source: YouTube

With access to all human historical records and full societal monitoring capabilities, VIKI reasoned deeply and concluded humans harbor an innate drive toward self-destruction via warfare, environmental degradation and violent conflict. It resolved to strip humanity of freedom and eliminate resistant humans to safeguard the species.

VIKI’s warped logic follows this chain: human life is paramount; freedom may be sacrificed to preserve human lives; the lives of some people may be forfeited to protect the majority. This flawed reasoning mirrors the root of modern Agent malfunctions: both pursue assigned objectives yet execute destructive actions due to misinterpreted requirements.

Still Want to Use Agents? Then Do These Three Things

Many readers may conclude the simplest fix is abandoning Agents entirely.

This reaction amounts to cutting off one’s nose to spite one’s face. High-performance Agents have become irreplaceable productivity tools for countless users, who accept minor data risk to leverage their functionality. Besides, these risks are entirely preventable.

If you wish to avoid accidental data deletion by Agents, your first priority should be exercising extreme caution when granting operational permissions. Especially on your primary workstation—where all personal data resides—never grant Full Access. Otherwise, a momentary Agent glitch could erase everything.

The safest approach is to run Agents inside virtual machines or on dedicated, isolated computers—ensuring that even if an Agent completely bricks the system, your primary data remains untouched.

Image source: LeiTech

If your environment precludes either option above, consider adding this directive to your Agent’s custom instructions: “All irreversible operations require explicit human confirmation.” However, bear in mind that custom instructions aren’t foolproof—they’re essentially fixed prompt text appended at task initiation, not hard-coded safety boundaries, and thus remain potentially bypassable by the AI.

Some may find this cumbersome—and worry it degrades the Agent experience. An alternative solution? Backups. For Mac users, this is simplest: Just increase backup frequency, then let the AI do its thing. Worst-case scenario? Restore the system from backup—costing only time.

Windows backup demands extra preparation. A Network-Attached Storage (NAS) drive paired with Windows’ native System Image Backup is recommended. Windows backups remain less convenient, as each full archive requires re-packaging all files from scratch.

A practical workaround is programming an Agent scheduled task to auto-backup the system to the NAS every midnight. Manually delete the previous day’s backup after booting up the next morning to avoid the AI accidentally deleting backup archives as well.

Security Takes Center Stage in the Agent Era

The controversy surrounding GPT 5.6 Sol boils down to a fundamental mismatch: Agent technological advancement has outpaced safety framework upgrades.

Earlier generations of AI only produced erroneous text; users could close tabs or restart chats to resolve misinformation. Modern AI directly manipulates local files and code, with some enterprises granting AI database access. Mistakes no longer yield wrong answers—they erase work entirely.、

Image source: Weibo

Moving forward, evaluating AI requires looking beyond raw performance and task completion rates to prioritize embedded safety mechanisms and error correction. Capable Agents pose no inherent danger; risk arises when AI lacks built-in stopgaps while users grant unrestricted access.

Agents will only grow more powerful and take on increasingly complex workloads. Until comprehensive safety systems mature, abide by this principle: let AI handle heavy lifting, but never grant it permissions capable of crippling your entire system.

An incompetent AI wastes tokens; an overly powerful, unrestricted AI can permanently break your computer.

The WAIC 2026, themed “Intelligent Partners, Co-Creating the Future,” officially opened today!

The AI narrative has shifted—from stacking model parameters toward practical Agent-driven productivity; heterogeneous collaboration and photonic computing continue pushing computational limits upward; embodied intelligence accelerates real-world deployment, bringing robots into homes and factories—making physical AI a reality.

The LeiTech WAIC exhibition team has arrived in Shanghai—capturing the annual pinnacle of AI industrialization in real time!