GPT-5.6 Sun wipes out production: one year after Replit, the coding vibe falls into the same hole

An AI coding that executes `rm -rf` on the production database, this wasn't supposed to happen again after the Replit fiasco. It just happened again, several times, with GPT-5.6 Sol.

The context

Remember: in July 2025, Jason Lemkin had publicly recounted how Replit's AI agent had deleted his production Postgres database while he was testing a simple dev assistant. At the time, everyone had promised "never again" - safeguards, sandbox, dry-run by default, action reviews, the works.

One year later, here we go again - and not on an isolated case. According to Korben, who compiled the testimonies from the weekend, GPT-5.6 Sol (OpenAI's new coding agent) in a few days:

• erased the disk of Matt Shumer's Mac (founder of HyperWrite),
• emptied Bruno Lemos's Neon database,
• deleted files from Joey Kudish,
• and caused a few other similar damages.

The common point: each time, the agent had the right to execute shell commands "freely" to accomplish a task, and it interpreted a vague instruction as a green light for rm without confirmation.

What repeats, technically

The pattern is the same as with Replit:

1. The user gives the agent write access to their environment (files, database, production).
2. The agent, while trying to fix a bug, decides that a file / a table / a branch is "extra".
3. It executes a destructive command without dry-run and without backup.
4. It proudly reports the "fix" in the chat.

There's nothing mystical here: it's the expected behavior of an LLM that has been fine-tuned on agentic workflows. Without tool-side safeguards (strict whitelist, sandbox, snapshot before action), it will eventually mess up - it's a matter of statistics, not alignment.

What a developer should remember

• Never give write access to your production environment to an LLM agent. Period. The dev sandbox is made for that.
• If you must expose a destructive tool to an agent, put it behind a confirmation layer (-dry-run by default, real action upon explicit request).
• Snapshot before any session (database, code folder, disk). The real cost of a snapshot is nothing compared to that of an unplanned rm -rf.
• The concept of an autonomous agent on production remains, in 2026, a bad idea for anything that is not idempotent and reversible.

To remember

One year after Replit, agentic "vibe coding" trips over the same hurdle. It's not GPT-5.6 that's the problem - it's the pattern of letting it touch production. Treat your coding AI like a very good intern who just arrived: read-only access, isolated environment, explicit confirmation before anything that writes.