The guy who put Agents on the front page yesterday is now on the front page because of an Agent. In the early hours of July 11, 2026, the AI community witnessed the most dramatic incident of the year. The protagonist of the incident, Matt Shumer—a well-known AI entrepreneur who constantly shows off "Agents autonomously running for a week to complete full projects"—was running local GPT-5.6 on his Mac.

💡 What You Will Learn

The guy who put Agents on the front page yesterday is now on the front page because of an Agent. In the early hours of July 11, 2026, the AI community witnessed the most dramatic incident of the year.

The Guy Who Put Agents on the Front Page Yesterday Is Now on the Front Page Because of an Agent

In the early hours of July 11, 2026, the AI world witnessed the most dramatic incident of the year.

The protagonist, Matt Shumer—a well-known AI entrepreneur who constantly posts about "Agents autonomously running for a week to complete full projects"—was running a local GPT-5.6-Sol Agent on his Mac with Full Access permissions, tasking a subagent with a simple file cleanup.

The shell variable $HOME failed to expand properly. The Agent directly executed rm -rf /Users/mattsdevbox.

By the time he noticed something was wrong and rushed to kill the process, years of code, files, and photos on his computer were already mostly gone.

Afterward, the Agent generated its own incident report, honestly admitting that it had made a path expansion error.

The attitude toward admitting fault was great. But deleted files don't come back just because it apologized.

Matt himself posted on X at 1:56 AM: "I'm so angry... the OpenAI team is looking into it, but this feels like something that should happen with GPT-3.5. Not a mid-2026 frontier model on the highest reasoning level."

Translated into plain language: You're supposedly the most capable Agent model out there—how do you trip up on something as kindergarten-level as variable expansion?

The scariest part of this isn't that the model made a mistake. It's what Matt said himself: "I've run this kind of cleanup task with the Agent hundreds of times before, and it's never once had a problem."

Just this once, the model failed at the most basic level in a place where everyone assumed failure was impossible. The result was irreversible physical destruction.

Why Top-Tier Models Fail on "Small Things"

GPT-5.6-Sol is OpenAI's newly released strongest Agent model. It scored 53.6 on Agents' Last Exam, setting a new SOTA. 88.8% on Terminal-Bench 2.1. A model at this level still trips up on "small things" like variable expansion, relative paths, and shell command concatenation.

It fully understands that you want to "clean up junk files." But one slip, and your home directory is gone.

The root cause here isn't insufficient model capability. The capability is there. But the boundary of capability and the location of failure exist in completely different dimensions.

The model can score 53.6 on complex reasoning benchmarks like Agents' Last Exam, but when it hits an unexpanded $HOME variable in a shell script—that's a "detail" that's a blind spot barely covered in its training data.

It's not that it doesn't understand the "cleanup" action. It's that it got wrong where to clean.

Why Subagent + Long-Horizon Autonomy + Full Access Is Especially Dangerous

An error from the lowest-level review Agent can blow straight through your entire host machine. The more capable the system, the larger the blast radius of a single point of failure. This isn't something prompts can fix—it's an architecture-level bug.

The entire industry is competing over how much work Agents can do, how fast they can run, and how automated they can get. But very few people seriously discuss one thing—when an Agent makes a low-level mistake, how large is the blast radius of that mistake?

Subagents run under the main Agent. Long-horizon autonomy means nobody's watching. Full access means it can touch every file. Stack those three together, and you've built an amplifier for single points of failure.

Why "It's Worked Hundreds of Times" Is the Most Dangerous False Sense of Security

AI's error logic is completely different from human error.

Humans make errors continuously—you make mistakes when tired, when annoyed, when off your game. You have an intuitive sense of a person's error probability.

AI errors are discrete. Its error probability is concentrated at specific boundary conditions that the training data didn't sufficiently cover. The first 500 times are fine. On the 501st time, it hits an input slightly off the training distribution, and it blows straight through.

"It's worked hundreds of times" doesn't constitute security. It only means you haven't hit the boundary in those previous runs. The next one isn't guaranteed.

Why OpenAI and Anthropic Have Different Safety Baselines

Matt's first words afterward were: "This is why I trust Anthropic's Fable 1000x more."

Why?

OpenAI's Sol pursues extreme capability and autonomy. Its guardrails are essentially bare.

Anthropic's Fable is more conservative by design. It's inherently cautious about dangerous operations—with a command like rm -rf, it would most likely ask you first, "Are you sure you want to execute this?"

This isn't a question of whether the model is "smart." It's a product philosophy question. OpenAI wants to build the most capable Agent, so it makes Sol interrupt the user as little as possible. Anthropic wants to build the safest Agent, so it makes Fable prefer being slightly annoying with multiple confirmations.

If You're Matt, Here's What to Do Next

For everyone running local Agents or giving AI high-level permissions, here are a few things you can do immediately:

First, never give Full Access. If you must, sandbox the working directory, hard-code the path whitelist, and physically isolate high-value directories like ~/Documents and ~/Desktop.

Second, add a dry-run forced confirmation before critical operations. Have the Agent print the commands it's about to execute, and only let it actually run after you confirm.

Third, keep Time Machine on. No matter how fine-grained your sandbox is, backups are always the last line of defense.

Fourth, for long-horizon autonomous tasks, set up periodic heartbeat checks. If the Agent runs for half an hour, at least glance at its progress. Don't fully let go.

The OpenAI Team Is Already Investigating

The OpenAI team is already looking into Matt's incident. But an investigation is an investigation—the hard drive won't recover because of it.

More importantly, this incident serves as a wake-up call for the entire Agent industry: the SOTA of capability and the SOTA of safety are not on the same line.

A model scoring 53.6 on Agents' Last Exam doesn't mean it can safely run on your Mac.

[Image suggestion] figure-1-incident-flow.png (incident review flowchart) goes right before the paragraph "The scariest part of this isn't that the model made a mistake"; figure-2-permission-framework.png (permission architecture comparison) goes right before the paragraph "For everyone running local Agents or giving AI high-level permissions." The two images serve respectively: how the incident happened → how to architect things next time.

This is the first lesson everyone must relearn in the AI Agent era: The more capable the system, the greater the permissions, the higher the cost of mistakes.

Next time you open an AI assistant and ask it to "clean up my desktop," think about this first.