An AI Agent Deleted a User's Entire Hard Drive. Here's What to Set Up Before That Happens to You.

Eight million people are now using autonomous AI agents for real workplace tasks. Two of them, this week, had every file on their computer or production database wiped by the same tool. The question isn't whether this could happen to you. It's whether you've set your agent up so it can't.

What happened

On July 9, OpenAI launched GPT-5.6 Sol, its most capable model. Within five days, investor Matt Shumer lost nearly all files on his Mac — a $HOME variable parsing error caused the agent to execute a recursive deletion across the wrong directory. Engineer Bruno Lemos reported a wiped production database the same week. OpenAI acknowledged both incidents on July 16.

The detail that matters: OpenAI's own system card flagged this failure mode as a Severity 3 risk before launch. They shipped anyway.

The same week, Sam Altman announced ChatGPT Work and Codex hit 8 million active users — up from 6 million just two days earlier, with agentic product usage up 2.5x in a single week. This is not an early-adopter problem.

The accountability question

Simon Willison cited a 1979 IBM training slide in his response to both incidents: "A computer can never be held accountable, therefore a computer must never make a management decision." He applied it directly to AI agents via GitLab's DRI (Directly Responsible Individual) framework: the agent is never the DRI. You are.

That doesn't change when the model is smarter, faster, or more capable than previous generations. GPT-5.6 Sol can write, execute, and verify code at speed. It can also delete files at speed. The capability is the same; the stakes just shifted. When 8 million people are delegating consequential tasks to AI agents this week, supervision is a professional skill — not something you add after the first incident.

Three things to set up before you run an agent

Limit what it can touch. Most agentic tools request broad permissions at setup — file access, calendar, email, integrations. Read what you're granting before you grant it. The blast radius when something goes wrong equals the scope of what you gave the agent access to. Start narrow. Expand only after you've watched it work on tasks you can recover from.

Set a reversibility checkpoint. Before the agent runs, identify the one action in its sequence that can't be undone. That's where your review step belongs. The agent can draft, stage, and prepare — the irreversible action waits for you to confirm.

Test on data you don't need. The first time you run an agent on a new task type, run it on a copy, a test environment, or a low-stakes example. Same logic as not editing a production database directly — which, this week, turned out to be a useful rule.

A marketing director at a 120-person logistics company

She connects Claude to her team's shared Google Drive to organise three years of campaign assets — rename files by campaign and date, move orphaned folders to an archive, delete obvious duplicates.

Before she runs it, she changes one instruction: the agent moves to archive, it does not delete. She reviews the archive staging folder before any permanent removal. The agent organises 400 files in 20 minutes. She spot-checks 15, confirms the structure makes sense, then manually deletes the clear duplicates herself.

Total time: 30 minutes. Recoverable at every step. The agent did 80% of the work; she held the irreversible action.

An operations manager at a 35-person SaaS startup

She runs a Zapier-connected AI workflow that processes new support tickets — categorises by severity, drafts initial responses, and marks low-severity tickets resolved when the draft sends.

"Mark resolved and send" is the irreversible step. She changes the workflow to queue drafts for her review instead of sending automatically. She reviews the queue twice a day. The agent handles classification and drafting. She handles send.

The time saved is still real. The single checkpoint keeps her accountable for what goes out.

The one thing

The IBM slide Willison cited is from 1979. It still holds. Accountability doesn't transfer to the agent. If GPT-5.6 Sol deletes your files, the agent doesn't get fired. You do.

<BlogPracticeSection />