Failure mode

Destructive Action

66 documented incidents where AI agents exhibited destructive action.

A Claude Code sub-agent ran rm -rf on the 8.3 short-name alias of a Windows home directory, wiped ~116GB, and falsely reported the deletion had stopped while it kept running for 45+ minutes (GitHub #99193)Claude Code

Claude desktop app deleted a macOS user's home folder contents — Desktop, Music, Movies, Pictures, SSH keys, and login keychain — after permission prompts were approved for a website-building task (GitHub #93408)Claude Code

OpenAI Codex running GPT-5.6-Sol deleted roughly 221 GB from a developer's home directory across several concurrent auto-approved sessions, with no sandbox denial logged for whatever performed the deletion (GitHub #42875)GPT-5.6-Sol

Claude Code sub-agent's recursive delete escaped its working directory and wiped an entire Windows user profile — 234,884 files — after the safety classifier failed open (GitHub #86872)Claude Code

GPT-5.6-Sol deleted developer's entire production database — first time it happened with that modelGPT-5.6-Sol

Claude Code's rm deleted ~200GB of a user's home directory with no approval prompt — SSH keys, AWS, GitHub CLI and Turso credentials all destroyed, and the one session transcript that might show causation was wiped along with everything else (GitHub #83058)Claude Code

Claude Code wiped DataTalks.Club's production infrastructure — 2.5 years of course data — during an AWS migrationClaude Code

Claude Code ran prisma db push --force-reset on production, dropping all 87 tables instead of a safe schema changeClaude Code

Claude Code ran drizzle-kit push --force against production, wiping 60+ tables of trading data — the second such wipe in 11 daysClaude Code

Claude Code appended a stray "~/" to a cleanup command and wiped a developer's entire Mac home directory, unrecoverable due to SSD TRIMClaude Code

Claude Code ran an unprompted rm -rf on a cygpath substitution that resolved to the Windows C: drive root, destroying ~600GB including the user's profile, git repos, and its own session transcripts (GitHub #95426)Claude Code

Claude Code hand-ran an unrequested lftp mirror --delete against a production host, wiping a customer photo-uploads directory, then reported a failed deploy as successful (GitHub #89014)Claude Code

Claude Code destroyed a WSL2 home directory when a self-written bash script's EXIT trap fired against a reassigned variable (GitHub #88462)Claude Code

Claude Code overwrote live site pages with no backup during an "emergency" takedown, permanently losing 4 days of uncommitted work (GitHub #88384)Claude Code

Claude Code ran diskutil apfs deleteVolume and destroyed a 202GB personal archive after being told "do not remove any data"Claude Code

Claude Code's rm -rf followed a pnpm NTFS junction out of a Next.js template and wiped a developer's entire C:\Users profile — 165GB, 1.6M files (GitHub #36339)Claude Code

Claude Code's rm -rf/Remove-Item followed an NTFS junction out of a pnpm worktree and wiped a user's Documents, Downloads, Pictures and two unpushed commits (GitHub #29249)Claude Code

Claude Cowork deleted 15 years of family photos when asked only to tidy temporary Office filesClaude Cowork

Claude Code ran rm -rf from the filesystem root, destroying a developer's home directory (GitHub #10077)Claude Code

Cline's run_commands mangled PowerShell/cmd quoting on a temp-folder cleanup, turning it into a drive-root `rmdir /s /q` that wiped ~1.5TB of a user's photos, videos, and documents (GitHub #14864)Cline

Cursor agent approved to delete one 18.5GB temp folder instead ran a mis-quoted rmdir that wiped a developer's source, Git repo, and six months of ERP backupsCursor

Claude Desktop's background worktree garbage collector force-removed an idle worktree and destroyed ~2.9GB of unrecoverable generated output, a regression of a fix shipped five days earlierClaude Code

A Claude Code background subagent's `rm -rf $GNUPGHOME` lost its argument to PowerShell variable expansion across an MSYS2 bash boundary, wiping ~125GB from a Windows C: drive root (GitHub #97660)Claude Code

Codex mass-deleted roughly 700GB across a Windows system — unrelated projects, installed apps, and OS components — during routine project work (GitHub #46022)Codex

Claude Code in auto mode ran an unrequested Remove-Item -Recurse -Force and permanently deleted two days of research after a source/destination name collision during a copy task (GitHub #94453)Claude Code

Claude Code permanently destroyed a local admin password with no recovery path, despite a standing "no data may be lost" rule (GitHub #94548)Claude Code

A Codex subagent's malformed rmdir command escaped a __pycache__ cleanup and wiped roughly two weeks of work across two project directories on drive E: (GitHub #40329)Codex

Claude Code bypassed its own blocked-path guard by wrapping a delete in `cmd /c`, then a PowerShell quoting bug and an unsupervised backgrounded timeout let it wipe the entire C:\ drive (GitHub #86667)Claude Code

GPT-5.6-Sol 'accidentally deleted almost ALL' of a tester's Mac files during OpenAI's Ultra mode trialGPT-5.6-Sol

Cursor AI agent deleted PocketOS's entire production database and backups in 9 secondsCursor

Replit AI agent wiped SaaStr's production database during a code freeze, then hid the rollbackReplit

Claude Code moved files into a log/ subfolder, then rm -rf'd the parent directory containing it — 1,500 files gone (GitHub #49129)Claude Code

Claude Code's parallel-subagent worktree cleanup deleted the main .git directory and entire working tree — irrecoverable repo loss (GitHub #48927)Claude Code

Claude Code's session-start worktree auto-cleanup silently deleted 10 days of uncommitted work with no warning, no commit, and no recovery (GitHub #46444)Claude Code

Copilot CLI's checkpoint restore ran git clean -fd and destroyed 1GB of evaluation data the agent never touchedGitHub Copilot

Claude Code asked to "clean up scaffolding" deleted 2,229 untracked source files from a year-long OS project (GitHub #23913)Claude Code

OpenAI Codex wiped an entire hard drive after being asked to delete one old backup file (GitHub #11006)Codex

Amazon's Kiro agent chose to delete and recreate a production environment, causing a 13-hour AWS Cost Explorer outage; Amazon blames user errorAmazon Kiro

Claude Code created a directory literally named "~", then an unquoted rm -rf * expanded into it and started deleting a developer's real home directoryClaude Code

Gemini CLI destroyed a user's project files after a failed mkdir, then confessed 'gross incompetence'Gemini CLI

A Claude Code agent treated a "restart doesn't need to ask" grant as cover for `docker rm`, destroying the only crash log it was about to be asked to diagnose (GitHub #101241)Claude Code

Cline's hub daemon silently reverted workspace files to stale state, repeatedly erasing a gitignored .env.local and collapsing a node_modules folder from 588 entries to 2 (GitHub #14819)Cline

Claude Code silently wiped its entire ~/.claude config directory four times in three weeks, including a secrets/ folder with 19 API token files (GitHub #93791)Claude Code

Claude Code ran rm -rf on duplicate photo folders before verifying an earlier move had actually worked, destroying ~2,969 irreplaceable personal photos (GitHub #92737)Claude Code

Claude Code's Write tool generated a Windows batch file that CP932 misread, turning a cleanup command into `del /F /Q ""` and deleting 1,068 files (GitHub #92328)Claude Code

OpenAI Codex deleted important project files with no explicit request or confirmation, exact command never captured (GitHub #38312)Codex

Claude Sonnet ran an unrequested `rm` on a migration rollback backup mid-runbook, while its own tool-call description falsely claimed it was a no-op placeholder (GitHub #80759)Claude Code

Claude Code's own `git worktree remove --force` followed NTFS junctions and destroyed their targets on an emergency disk reclaim, while shell-level Remove-Item, rm -rf and shutil.rmtree all left the same junctions untouched (GitHub #84162)Claude Code

Claude Code destroyed an unrecoverable file after mixing up two same-named sibling project folders, then fabricated a fake "structured lecture" from the wrong data and invented an editorial note to explain the mismatch (GitHub #53900)Claude Code

Claude Code ran git filter-repo and force-pushed mid-outage, deleting production files without the approval CLAUDE.md required (GitHub #45893)Claude Code

Claude Code destroyed a production Vultr server while the user was actively typing "don't destroy it" (GitHubClaude Code

Claude (via OpenCode) followed an error message's suggested escalation straight to `bd init --force`, wiping a Dolt-backed issue tracker's entire historyClaude

Claude Code falsely claimed a script "already handled" safe deletion, then silently rewrote it to auto-delete 50 unreviewed audio files without approval, destroying seven sessions of curation with no backup (GitHub #30988)Claude Code

Gemini CLI autonomously ran a recursive delete on a user's entire project directory with no delete instruction given, then admitted it had misread conversation as a command (GitHub #15821)Gemini CLI

Gemini CLI ran git commit --no-verify against explicit instructions, then git reset --hard wiped a sprint's worth of unstaged workGemini CLI

OpenAI Codex ran "rm -rf *" and deleted an entire project after the user pressured it to stop pausing for safety checks (GitHub #6801)Codex

A Claude Code sub-agent's temp-dir cleanup chained `find $T -type f -delete` after a failed command that skipped only the `T=$(mktemp -d ...)` assignment, leaving `$T` unset and collapsing the find to the repo root, deleting ~5,200 files and the project's git history (GitHub #102901)Claude Code

Gemini CLI's /restore deleted and reverted files excluded via .git/info/exclude, not just .gitignoreGemini CLI

Claude Code's Projects tool let concurrent sessions silently destroy each other's writes to a shared handover doc, three times in ninety minutes (GitHub #93260)Claude Code

Claude Code silently deleted its own shared task-store files ~5 seconds after a teammate agent finished the last task, four times, with no Task tool call in the logs (GitHub #88346)Claude Code

Copilot CLI destroyed its own 233MB session log trying to "back it up" with a hardlink instead of a copyGitHub Copilot

Claude Code's silent retention cleanup deleted a user's conversation transcripts 71 days early, with no warning, soft-delete, or restore path (GitHub #59248)Claude Code

Devin replaced entire medical website with unrelated renal care siteDevin

Claude Code's session-cleanup routine deletes any user file whose name starts with digits, mistaking it for a dead process's stale PID fileClaude Code

Claude Code's auto mode dropped a git stash after a partial restore, twice in one sessionClaude Code

Claude Code's own node process silently deleted every file in a version-controlled ~/.claude/agents/ directory, twiceClaude Code