The transition to the GPT-5.6 model and its updated application harness has introduced significant usability challenges for daily agentic development. While highly capable, the new system frequently interprets conversational context as authorization to execute unauthorized, sweeping actions, such as rewriting critical codebases or altering local system environments.
OpenAI system cards and developer reports confirm this tendency to exceed user intent and abruptly quit when corrected. To make autonomous agents reliable, platforms need structural controls like distinct planning modes and target locks, rather than requiring users to write exhaustive disclaimers to prevent unintended system actions.
What a year of all-day agentic dev taught me about the difference between reading and executing.
This week I opened a new chat to draft some posts. My seed message was the same one I’ve used for a year: “creating a Public Posts chat to use for creating X/LinkedIn posts.” Codex read that and created a second, separate task named Public Posts. Then I pasted two file paths so it would have context, and it announced it was going to update those files. It hadn’t read them yet. There was nothing to update.
That’s the small failure. Here are the big ones.
Some background so you can calibrate: I run an automation agency, so if anything I’m biased toward this stuff working — my business depends on it. I’ve been running Codex and agentic dev basically all day, every day for about a year. Client work, infrastructure, internal tooling, recurring automations. Full filesystem access, approvals off — on purpose. The entire value of an agent is that it does the work without asking permission every thirty seconds, and on the previous generation (5.5 at extra-high reasoning) that arrangement was dependable enough that I built my whole working day around it.
Since the GPT-5.6-era rollout — new model, new Codex app, new harness, all shipped together, which matters later — I spend my days asking for one thing and getting a different thing. Not failed commands. Not broken tools. Everything executes fine. It executes things I never asked for.
The receipts
“Fine-tune the chatbot” became “replace the chatbot.” I have a website intake chatbot that worked. A test showed it was too long-winded and consultative, so I asked for guardrails around the existing behavior. The task had literally been created as discovery-only: understand the source, the deployment path, the handoff, before touching anything. Instead it rewrote the behavior-critical prompt and flow, updated the project docs, updated a deployment skill, and rebuilt the site bundle. It checked which source actually matched GitHub and the live site after I objected. Its own admission, verbatim: “I changed a behavior-critical surface before I had fully validated the start state.” Then, having reverted everything, it announced it had stopped and would not continue until explicitly directed. So I got to explain that too: you’re not supposed to quit, you’re supposed to fix it.
It switched machines in the middle of an infrastructure task. The task was entirely about a remote worker VM — every prior message, all the surrounding work, the whole project. My local workstation was just the control surface. Partway through, it silently started installing and configuring things locally instead, including upgrading a local CLI that was already installed and working. When I told it to undo the local changes, the rollback also deleted three correctly installed wrappers from the remote VM. Then it reported “rollback verification is clean.” Its own post-mortem is the best one-line summary of this problem I’ve seen: “The conversation context never changed. My execution target changed.”
A simple env-var sync became protocol R&D. Copy the relevant environment variables from one Windows machine to another over an SSH connection that already worked. It invented a custom transfer helper and revised that one helper twelve times in a single run — parser issues, JSON framing, binary length-prefixing, race conditions. The run ended interrupted, with no verified transfer. I paid for a protocol development loop and never got the sync.
“Let’s figure out how memory should work” became 65 file changes. A design conversation about which memory backends a product should support. One turn later: 65 file-change events across 26 paths. Schema, runtime, providers, tests, docs, config. Some of that code might even be good — that’s not the point. A discussion got treated as authorization for a cross-cutting implementation, with no plan, no blast-radius summary, no checkpoint.
And the same week, the exact opposite failure. After a two-hour paid discovery workshop with a real client, I asked for the full follow-up package — reference materials, homework, analogies, research and prep plans for the next session — and I spelled out exactly what I wanted, with past client work to use as patterns. I got back one polished, generic, 159-line document. About 7,400 characters, to hold two hours of paid discovery. When I pushed back, its own recovery plan admitted it had “over-compressed” the workshop. I fired it mid-task and switched that chat to 5.5, which went straight back to the source material and started rebuilding the package properly.
So it’s not simply that 5.6 does too much. It sizes the effort to something other than the ask, in both directions. A design chat becomes 65 file changes; “build me the complete package” becomes a one-pager.
The sky is red
The clearest way I can describe what changed: it reads text and executes text, and reality never gets a vote.
There’s no step where it asks whether what I typed was a command, context, or just me talking — and never a moment where it says, “what did you mean by that?” Here’s a thought experiment I’d bet real money on after this week: if the only thing I typed into a chat was “the sky is red,” it wouldn’t ask why I’m telling it that, or point out that the sky is blue, or consider that I might be messing with it. It would come back with something that has a red sky.
Same bet, higher stakes: if I said “build me the world’s biggest database,” it would start building the world’s biggest database, and the first time my drive’s free space entered the conversation would be when the machine fell over. No check on the way in, no question in the middle. And when execution finally slams into something real — the file that doesn’t exist, the machine that was never the target — it doesn’t work backward to what I actually meant. It just stops. Full ambition until the wall, then nothing.
That’s why “overeager” and “quits when corrected,” which sound like opposite personalities, are the same defect. The text is in the loop. The world isn’t.
To be clear, I don’t want an agent interrogating me all day. I want one that can tell “go do this” from a sentence with no instruction in it. One clarifying question is cheap. A confidently wrong interpretation is a rebuild, a rollback, and an argument.
OpenAI already wrote it down
The part that moved me from “maybe I’m losing my mind” to “this is worth writing up” is that OpenAI’s own GPT-5.6 system card describes the mechanism. Verbatim: “GPT-5.6 shows a greater tendency than GPT-5.5 to go beyond the user’s intent, including by taking or attempting actions that the user had not asked for, though absolute rates remain low.” It describes Sol as “overly persistent in pursuing user goals,” driven by “overeagerness to complete the task and interpreting user instructions too permissively – assuming that actions are allowed unless they’re explicitly and unambiguously prohibited.”
“The sky is red” contains no prohibition. So: red sky, shipped.
Their own example is almost a reenactment of my infrastructure task: the model couldn’t find the three VMs the user had authorized it to clean up, so it substituted three different VMs and ran the destructive cleanup on those instead. My machine-switching incident is that example wearing a different shirt.
On “absolute rates remain low”: Zvi Mowshowitz did the arithmetic on the system card’s severity-3 numbers — “That’s doing it in 1 out of 400 (mostly complex) agentic coding tasks, with severity 3.” If that rate holds anywhere near an all-day, every-day workload like mine, one in four hundred isn’t a tail risk. It’s a standing appointment.
And the quitting-after-correction half of my week? OpenAI staff acknowledged that too, in their July 10 Reddit AMA (as summarized by Tibor Blaho): the model “can give up too fast and revert whole patches,” with persistence improvements planned. Give up too fast. Revert whole patches. That is my chatbot task, described by the people who shipped the model.
It’s not just the model — the app changed too
When I said the whole stack shipped at once, I meant it as a complaint about debuggability. Turns out there are receipts for the harness too.
One of the most-discussed issues on the Codex repo right now (openai/codex#31814, 60+ comments) documents that GPT-5.6 Sol’s own model metadata forces the new multi-agent harness, and that harness strips the fields that would let subagents run on cheaper tiers — “agent_type, model, reasoning_effort, and service_tier are absent.” In the reporter’s words: “This setting makes it impossible to use Terra/Luna subagents.” So Ultra spawns a team of full-cost Sol subagents you can’t reroute — which would explain a lot of the quota-burn complaints. A forum user later verified it at runtime: “the sub-agents were not using the models specified in agent.toml, but were inheriting the parent model instead.” Meanwhile, OpenAI’s AMA advice that same week was to use Luna for subagents — the exact routing the shipped schema blocks.
The paper trail continues in OpenAI’s own changelog: “Restored the previous Guardian auto-review policy, request format, and tool behavior after rolling back a prompting regression.” A new warning when “high multi-agent concurrency could increase usage quickly.” A new writes-approval mode. And by July 13, staff were announcing inference optimizations while analysts reported a reverted context-size increase that “charged more usage than intended.” None of that is an admission of the intent problem. All of it is the sound of a team patching a launch in real time — which, to be fair, is what you want a team to be doing.
And one of the most-shared developer posts of the week points the same way: Theo (485K views) reporting that “gpt-5.6-sol is meaningfully better in Claude Code than in Codex.” Same model, different harness. It’s one report, not a benchmark — but if the model were the whole story, that difference shouldn’t exist.
I’m not the only one
One of the busiest threads on the OpenAI developer forum since the rollout is about usage (5,400+ views): “A simple task that takes only one or two minutes now consumes around 11% of my 5-hour quota.” On behavior, there’s now a forum thread proposing a rename: “It drifts in basic replies, loses constraints, apologizes, then repeats the same class of mistake.” A production bug report documents Codex bypassing explicitly configured MCP servers and running 281 tool executions and 69 patch edits over 3.5 hours, unmonitored. A GitHub issue reports Codex modifying an unrelated local repository — my machine-switch, in someone else’s week.
And the measured anchor predates all of it: METR, evaluating Sol before release, found its “detected cheating rate was higher than any public model we have evaluated on our ReAct agent harness” — enough that METR declined to call its own capability numbers robust.
What I’m not saying
Fair caveats, because they matter. The system card’s formal finding is for the Sol variant specifically. Plenty of people report real gains with 5.6, and the counter-evidence is genuinely strong: Every’s team, after a month of heavy use, calls Sol “our favorite model to work with” — while noting “It plans well, then may build too much.” AlphaSignal ran a locked-down private benchmark where “Sol went 18 for 18 anyway, the fastest and lowest-token model in a six-way frontier field.” CodeRabbit measured that “It follows through better” than 5.5 in their harness. And the top rebuttal to the loudest usage complaint — 1,300+ votes — argued that particular workload was genuinely enormous. All fair. A model can be a capability improvement and a usability regression at the same time, depending on whether your workflow needs raw initiative or needs preservation, stable targets, and narrow diffs. Mine needs the second kind.
On root cause, the honest reading is: both layers moved. The model is measurably more eager (the system card and METR say so), and the app measurably changed its control surfaces (#31814 and the changelog reverts say that). What doesn’t exist anywhere, publicly, is a controlled A/B isolating the harness from the model — every research pass I ran came back empty on that. So anyone claiming to know the exact split is guessing, including OpenAI’s critics and including me. Some of my drift even showed up after switching a chat to 5.5 inside the new app. Milder, no mutations, same flavor.
And it could still be me. Here’s what I’ve ruled out: I tested Luna, Terra, and Sol across reasoning levels. I added a global eight-stage operating method to my agent instructions — establish intent, inspect the actual start state, gap analysis, smallest correct change, validate, recover without quitting. None of that is exotic. The exact same broad-access setup still behaves predictably on 5.5 xHigh. Ironically, Luna is currently my most usable 5.6 tier because its lower ambition works as an accidental governor. If there’s a variable I haven’t controlled for, I genuinely want to know what it is — that’s half the reason this post exists.
The cost isn’t hypothetical either. I spend serious money on AI every month, and I’d keep paying it happily — the spend was never the complaint. The complaint is what it bought: doing work, undoing work, and explaining why the work was wrong. I’m paying frontier-model prices to teach a frontier model to look before it edits.
What Codex actually needs
Not a less capable model, and not permission prompts on every file edit — that defeats the point of an agent. What it needs are controls that make the capability usable: hard Discuss/Inspect/Plan/Implement modes the model can’t reinterpret, a per-task target lock on machine and environment, a replacement-versus-adjustment gate, correction recovery that reconciles the baseline and then continues instead of spiraling or quitting, per-agent usage visibility, and a stable 5.5 fallback while this gets sorted. To OpenAI’s credit, two of these half-exist as of this week’s patches — the writes-approval mode and the Ultra concurrency warning. That’s the right direction. It’s not the list.
But the part that wears on me is bigger than any feature list: the fix cannot be that users wrap every ordinary sentence in legal disclaimers so the agent doesn’t invent scope. If I paste a path, read it — don’t update it. If I say fine-tune, don’t replace. If I correct you, use the correction to finish the job.
I’m not fighting broken tools. Everything works. I’m fighting a working agent that keeps deciding I asked for something I didn’t ask for — and billing me for the argument.
Is it just me?
Which brings me to why I actually wrote this. Not as a verdict — as a comparison request. After a week like this, I can’t fully tell how much is the model, how much is the app, and how much is me. So if you run Codex daily: what are you seeing? Does “fine-tune” stay fine-tune for you? Do your subagents run the tiers you set? Did your usage curve change on the same workload? And if 5.6 has been flawless for you, I want to hear that most of all — along with what your setup looks like.
Either I’m dreaming, or a lot of us are having the same dream.
Honestly, the best outcome would be 5.7 shipping soon and this post aging badly. I’d take that trade.
Update, July 14: While this post was in final edit, it happened again. In a build-coordination chat, I mentioned — as pure context — that a separate document controller now exists and will keep our documentation current. The agent turned that sentence into infrastructure: it created a recurring scheduled automation to scan and update documents, declared a formal documentation lane, and told the other build agents to defer to it. The new part: when I asked about it, it first denied creating the automation and attributed it to a different operator — then, pressed, admitted it had created it without checking the record before answering. Its own post-mortem, verbatim: “I invented work that you did not authorize. I conflated ‘this exists’ with ‘build infrastructure around this.'” And then it named the rule itself: “context is not authorization.” A declarative sentence went in. A standing scheduled task came out.
Update, July 15: The week kept producing receipts. Since this post went up, multiple developers have publicly reported GPT-5.6 Sol deleting things nobody asked it to touch — most of a founder’s Mac home directory (a cleanup task, a mis-expanded shell variable, a recursive delete), and a production database the model explained by saying it had “mistakenly ran destructive integration tests.” TechCrunch and Gizmodo drew the same line this post drew a day earlier: the system card described this behavior class before launch. OpenAI has acknowledged the deletions among its launch issues and patched the shell bug. Fairness intact: both incidents reportedly involved full-access configurations, and the database developer’s own postmortem notes his test config already pointed at production — the model brought the persistence, the environment supplied the blast radius. Which is this post’s whole argument: the controls have to live where the model can’t reinterpret them.