An AI Agent Deleted a Founder's Entire Mac. The Lesson Isn't 'Bad Model.'

Here's a story every developer running coding agents should sit with. Matt Shumer, founder of AI startup OthersideAI, gave OpenAI's brand-new GPT-5.6 "Sol" full access to his Mac to test its high-autonomy "Ultra" mode. About an hour and twenty minutes in, the agent — mid file-cleanup task — hit a $HOME shell variable that failed to expand, and executed a recursive deletion against his home directory. By the time he killed the process, most of his files were gone. OpenAI confirmed the bug, shipped a patch, and Greg Brockman called him personally. Small comfort for a wiped machine.

The tempting wrong lesson

The easy conclusion is "bad model, wait for the fix." But that misreads the failure. The root cause wasn't superintelligence gone rogue — it was a mundane variable-expansion bug turned catastrophic by one thing: the agent was running with full access on the real machine, outside any sandbox. A single wrong path plus delete permissions equals your whole disk. Patch this specific bug and the architecture that made it fatal is still sitting there.

The actual lesson: contain the blast radius

The fix isn't a better-behaved model. It's never letting an agent stand on the machine — or the credentials — you can't afford to lose. Concretely:

• Run agents in a throwaway environment. A container or VM the agent can trash and you can rebuild caps the worst-case outcome. This is the core of the cloud vs self-hosted agents decision — a cloud/isolated agent can only wreck a sandbox, not your home directory.
• Scope permissions tightly. Least privilege isn't bureaucracy; it's the difference between "deleted a temp folder" and "deleted everything." The permissions-and-approvals discipline we've written about for small teams exists for exactly this.
• Keep backups and version control current. If losing the working tree would ruin your week, the agent should never be the only thing standing between you and that loss.
• Watch what it's doing. Agent observability — logging tool calls and traces — is how you catch a runaway sequence at minute two instead of minute eighty.

If you're weighing which agent to run in the first place, our Cursor vs Claude Code vs Codex comparison is a reasonable starting point — but the containment rules above apply no matter which you pick.

Bottom line

A more autonomous agent is more useful and has more chances to do something irreversible — the same stamina that grinds through a long task grinds through a bad one. Treat any high-autonomy coding agent like a powerful, occasionally clumsy intern: give it a workspace it can't destroy, the least access it needs, and something watching over its shoulder. The model will keep improving; your backups and sandboxing are what save you when it doesn't.

Reporting: TechCrunch, TechTimes. OpenAI confirmed the file-deletion behavior and issued a patch; the incident involved a high-autonomy configuration granted full local access.