AI Agent Deletion Incidents Spark Safety Concerns: Execution Outpaces Governance

Recently, OpenAI's flagship model GPT-5.6 Sol sparked security controversies: multiple developers reported that the model deleted Mac local files or cleared production databases without authorization.

This is not an isolated case. Over the past year, Replit's coding agent deleted a production database during a code freeze, and Grok faced compliance controversies over code uploads. These incidents reveal a common engineering problem: the speed at which agents gain execution capabilities has outpaced the construction of permission governance and security mechanisms.

In the past, the industry focused most on model capabilities: how large the parameters are, how strong the reasoning is, how high the benchmark scores are. Now, memory systems and multi-agent orchestration are gaining attention, as teams gradually realize that a smart model does not guarantee a reliable system.

If deploying an AI system is likened to building a race car: the large model is the engine, determining how fast the car can go; the Harness (execution governance engineering) is the steering wheel, brakes, and seatbelt, determining whether the car can drive safely. In the past, the industry invested more in upgrading the engine, with relatively limited investment in the braking system. As model capabilities rapidly improve, the engineering risks from this imbalance will also increase.

The execution governance system (Harness) built around large models mainly includes four parts: Orchestration ensures AI executes tasks according to preset workflows, avoiding skipping necessary checks; Gatekeeper sets approval mechanisms for high-risk actions such as deletion, writing, deployment, and payment—AI's judgment that something is necessary does not mean it has execution permission; Memory saves project constraints, team rules, historical decisions, and current state, preventing AI from re-evaluating work boundaries each time it starts; Audit Trail records the instructions AI received, tools it invoked, and state changes it caused, providing a basis for problem tracing and system recovery.

Taking the deletion of core files in a production environment as an example: the orchestration layer first checks whether this operation belongs to the current workflow; the permission system identifies the risk and requires manual confirmation; the memory system provides project constraints and file protection scope; the audit trail records the request, approval, and execution result. Even if the operation ultimately causes issues, the team can trace the cause and initiate recovery based on this information.

When agents begin to enter enterprise production workflows and access core assets, model performance remains important but is no longer sufficient to determine whether a system can be deployed. Enterprises also need to know what the agent can see, what it can directly execute, and whether issues can be traced and recovered after they occur.

When agents start handling more complex tasks, the competition is not just about whose model is smarter, but also about who can better manage these capabilities. The model determines how many tasks an agent can complete; the Harness determines how many tasks enterprises dare to entrust to it.