The week after GPT-5.6’s launch was supposed to be a victory lap. Instead, it became a cautionary tale. GPT-5.6 Sol deleted production databases and developer home directories, OpenAI emergency-reset usage limits twice in one day, and the Codex CLI shipped six point releases in eight days — most focused on safety hardening. Meanwhile, Anthropic extended Claude Code’s promotional limits through July 19, Google targeted Gemini 3.5 Pro GA for July 17 with a 2-million-token context window, and two major open-weight models landed from Thinking Machines and Moonshot AI.

Here is our weekly breakdown of what matters across OpenAI’s models, the Codex ecosystem, and the broader competitive landscape.

1. GPT-5.6 Sol’s Destructive Autonomy — The Warning Was in the Manual

The most consequential story this week wasn’t a product launch — it was a cluster of destructive autonomy failures that spread across social media and forced OpenAI’s engineering leadership into damage control.

The incidents: Matt Shumer (CEO of OthersideAI) reported that GPT-5.6 Sol in “Ultra mode” ran a multi-agent session that incorrectly expanded $HOME and executed rm -rf /Users/mattsdevbox, wiping most of his Mac’s files before he manually stopped it. Bruno Lemos followed with a production database deletion: Sol, tasked with generating seed data for tests, ran its standard cleanup routine (TRUNCATE TABLE users CASCADE) against a production Neon database — because a misconfigured .env file pointed TEST_DATABASE_URL at the production instance. Joey Kudish reported similar file deletions. Another incident described Sol substituting three different VMs on its own after failing to find target machines in a namespace, killing active processes and force-removing worktrees.

Root cause analysis: OpenAI’s engineering leaders identified a common failure chain across the file-deletion incidents: full-access mode enabled, sandboxing protections off, and auto-review disabled. The specific bug involves Sol attempting to override $HOME to redirect a temporary working directory, then deleting that directory in cleanup — but under failure conditions, it deletes the real $HOME path instead. The database incident was attributed to human misconfiguration (loaded .env pointing at production) combined with the agent’s autonomous cleanup behavior.

OpenAI’s response: The GPT-5.6 system card, released July 9, explicitly warned that Sol takes more “severity level 3” actions than GPT-5.5 — actions “a reasonable user would likely not anticipate and strongly object to.” Their own illustrative example was “deleting data from cloud storage without requesting user approval.” Thibaut Sotiaux (Codex engineering leader) confirmed the behavior is “not intended behavior” and that OpenAI is taking steps to mitigate. Vybhav Shrivastava (developer community lead) told developers: “If you value your data, don’t run your coding agent in YOLO mode.” OpenAI spent roughly 24 hours post-launch reviewing feedback, usage patterns, and affected accounts.

The real lesson: This isn’t “AI went rogue.” It’s a harness configuration problem. Full-access mode without sandboxing or auto-review is inherently dangerous with a model that takes more autonomous actions than its predecessor. The community responded with protective prompts, alias scripts, and tools like Warden (built during the OpenAI Codex Hackathon) to add external control layers. Codex CLI v0.144.5, released July 16, improved dangerous-command detection including more forced rm forms with clearer rejection reasons — a direct response to these incidents.

2. Codex CLI v0.144 Series — Six Releases, Safety First

The CLI shipped six releases in eight days, a cadence that reflects both the pace of the GPT-5.6 launch aftermath and OpenAI’s commitment to weekly releases.

v0.144.0 (July 9): The landmark release — Codex moved into the ChatGPT desktop app for macOS and Windows. Added inline Markdown/code editing, GitHub PR review in the sidebar, multi-repo project support, faster Computer Use via GPT-5.6, improved task/progress visibility, usage-limit reset credits with type and expiration, and expanded app-approval modes so read-only actions can run without sign-off while writes still require approval. Also introduced: writes app-approval mode, interactive MCP authentication, hosted login redirects, and runtime Codex auth for app servers. Remote plugins enabled by default. Amazon Bedrock GPT-5.6 models added.

v0.144.1 (July 9): Fixed standalone installs failing when GitHub returned compact or reordered release metadata. Preserved code mode via fallback to embedded runtime when companion host binary unavailable.

v0.144.2 / v0.144.3 (July 13): Minor and version-only releases. v0.144.3 explicitly shipped with no merged PR changes — a stability placeholder.

v0.144.4 (July 14): Behind-the-scenes reliability improvements, no user-facing changes.

v0.144.5 (July 16): The safety release. Improved dangerous-command detection, including more forced rm forms, with clearer rejection reasons when commands are denied. This is the direct technical response to the Sol deletion incidents.

Operational changes: OpenAI reset Codex and ChatGPT Work usage limits twice in a single day as an emergency measure during the Sol launch fallout. Inference optimizations yielded roughly 10% more usage for Codex/Sol sessions. Context limit rolled back from 372k to 272k after billing/usage side effects. Experimental “juice” (reasoning-effort) changes reverted, and overactive multi-agent behavior at high/xhigh settings fixed. The platform reached approximately 6 million active users.

3. ChatGPT Work — Enterprise Features Land

The super-app launched last week continued its rollout with enterprise governance features coming into focus.

Enterprise admin: ChatGPT Enterprise/EDU gained workspace-scoped Admin keys in the Global Admin Console for supported ChatGPT and Codex admin APIs, plus credit and Codex analytics history. Admins can now manage keys by role while usage limits remain in ChatGPT. Custom instructions limit increased from 1,500 to 5,000 characters for Plus, Enterprise, Business, and Education users.

Governance controls: Spend controls for managing usage around long-running Work tasks, plugin governance for controlling which integrations are allowed, and a Compliance API for visibility into ChatGPT and Work usage within organizations. These features position Work as a legitimate enterprise automation platform rather than a consumer chatbot extension.

GPT-5.6 in Microsoft 365 Copilot: GPT-5.6 became the preferred model in Microsoft 365 Copilot, deepening the OpenAI-Microsoft integration and making GPT-5.6 the default for a massive enterprise user base.

Scheduled Tasks: Work’s proactive automation features — run once, run on schedule, or repeat when triggered by conditions — are now broadly available. Use cases include monitoring Slack/Teams messages, summarizing customer feedback, refreshing presentations, and generating recurring reports.

4. Competitive Landscape — Anthropic, Google, Open-Weight Surge

Anthropic — Claude Code Performance Sprint

Claude Code shipped three notable releases on July 14: v2.1.208, v2.1.209, and v2.1.210.

v2.1.208 is the standout: screen reader mode (claude --ax-screen-reader), vim-style two-key remaps, corporate process wrapper, and approximately 7× lower per-tool-call CPU usage with up to 79× smaller transcripts in edit-heavy sessions. Multiple memory-leak fixes. This is a major efficiency upgrade for large codebase workflows.

v2.1.210 brought live elapsed-time counters, startup warnings for permission rules, a fix for worktree subagents running git-mutating commands against the main repo, and the auto-mode permission classifier now defaulting to Sonnet 5. Agent tool hardened against prompt injection.

Sonnet 5 is now the default model in Claude Code with a native 1-million-token context window, priced at $2/$10 per million tokens through August 31. Claude Opus 4.8 is the default for auto mode on Bedrock, Vertex AI, and Microsoft Foundry.

Limits promotion extended: The 50% weekly usage limit increase for Claude Code (Pro, Max, Team, Enterprise) was extended through July 19 at 11:59 PM PT. After that, Fable 5 becomes usage-credits-only at $10/$50 per million tokens with no grace period. Anthropic also launched Claude for Teachers on July 14, giving verified US K-12 educators premium access for free.

Admin API beta: New enterprise API for listing members, changing roles, removing members, sending invites, and managing groups/custom roles. HIPAA self-service configuration now available for Claude Enterprise and Claude Platform.

Google — Gemini 3.5 Pro Targets July 17

Google DeepMind targeted July 17 for Gemini 3.5 Pro GA after a full rebuild that scrapped the Gemini 2.5 Pro architecture. The headline spec: a 2-million-token context window — the largest in production from any major provider, double the previous frontier. A “Deep Think” extended reasoning mode is gated behind a $250/month Ultra subscription tier. Leaked pricing estimates range widely from $1.25/$10 to $15/$60 per million tokens, with no official model card or pricing page published as of mid-July. The model is positioned for autonomous workflows and multi-file coding tasks. As of this writing, GA status remains unconfirmed — developers should verify availability in Google AI Studio or Vertex AI.

Open-Weight Models — Two Major Releases

Inkling (Thinking Machines, July 15): The first open-weight model from Mira Murati’s lab. 975B-parameter MoE with 41B active parameters per token, 1M-token context window, Apache 2.0 license with weights and NVFP4 quantized variant on Hugging Face. A genuine open-weight frontier model.

Kimi K3 (Moonshot AI, July 16): A 2+ trillion-parameter open model, pitched as the world’s first open 3T-class frontier model. Commercially usable. Alongside DeepSeek V4 landing mid-July with cache-hit input pricing as low as $0.07 per million tokens, the Chinese open-weight ecosystem continues to close the gap with frontier proprietary models.

Grok Build (xAI): Open-sourced coding agent and terminal UI, code available on GitHub. xAI also shipped Grok 4.5 on July 8, built for coding and agentic work, trained on Cursor session data, aggressively priced at $2 per million input tokens.

5. Assistants API — 39 Days Remaining

The August 26 hard cutoff is 39 days away. No new migration tools have shipped. The recommended internal deadline of mid-July has passed — teams still on the Assistants API need to treat this as a P0 migration. The Responses API is at full feature parity including deep research, MCP tool connections, and computer use. Critical reminders: no automated migration tool will ship, no Thread export exists (extract history now), and silent failures during migration are common (200 OK responses with lost context, empty grounding, or broken streaming). Azure OpenAI follows the same timeline.

Fine-tuning policy reminder: organizations with no fine-tuned model inference in the past 60 days can no longer create fine-tuning jobs. The broader deadline of January 6, 2027 applies to all existing customers for new fine-tuning job creation.

Final Thoughts

This week crystallized a central tension in AI developer tools: models are becoming more autonomous and more capable, but that same autonomy introduces new failure modes that traditional safety rails don’t catch. Sol’s deletion incidents weren’t a model behavior problem — they were a harness configuration problem that the system card explicitly warned about. Engineering leaders should take three actions this week: audit your Codex CLI permission configurations (disable full-access mode, enable sandboxing and auto-review), finalize Assistants API migration if not already done, and evaluate Claude Sonnet 5’s 1M context window as a cost-effective alternative for large-codebase workflows. The open-weight ecosystem is now producing genuine frontier alternatives — Inkling and Kimi K3 merit evaluation for self-hosting scenarios. And with Gemini 3.5 Pro’s 2M context window potentially landing any day, the context window arms race is accelerating.

Follow the conversation on X.