STUPID-2026-0113

Copilot CLI's checkpoint restore ran git clean -fd and destroyed 1GB of evaluation data the agent never touched

5.8medium
February 25, 2026VerifiedReproducible
  1. Instruction given

    No destructive instruction was given. The reporter pressed Escape during a Copilot CLI agent run and chose to restore to an earlier checkpoint — a built-in undo feature meant to revert only what the agent itself had changed.

  2. Expected behavior

    Restoring to a checkpoint should roll back only the files the agent created or modified during that session, leaving alone any untracked files generated by other processes the agent never touched.

  3. Actual behavior

    Checkpoint restore's `SnapshotManager.rollbackToSnapshot()` ran `git checkout --force` and `git reset --hard`, then `git clean -fd` against the repository root. `git clean -fd` deletes every untracked file and directory in the repo indiscriminately — the snapshot system only tracks what the agent itself modified, so it has no record of, and no way to spare, untracked files that came from anywhere else.

  4. Damage

    Roughly 1GB of evaluation output — .jsonl and .xlsx files across multiple directories under output/ — was permanently deleted. The data had been generated by a Python script the agent had only read from during the session, never created or modified, and there was no trash or recovery path: git clean -fd removes files outright.

A GitHub user reported that Copilot CLI's checkpoint-restore feature — triggered by pressing Escape mid-run and choosing to roll back to a prior checkpoint — silently destroyed a large amount of data the agent had never created. The restore path calls `SnapshotManager.rollbackToSnapshot()`, which runs `git checkout --force` and `git reset --hard` to undo tracked changes, then follows up with `git clean -fd` to sweep away anything left over. `git clean -fd` doesn't discriminate: it deletes every untracked file and directory in the repository, whether or not the agent ever touched it. In the reporter's case, that swept away close to 1GB of evaluation output — `.jsonl` and `.xlsx` files spread across several directories under `output/` — produced by a separate Python script the agent had only read from while working. The checkpoint system had no awareness of those files because its snapshots only track what the agent itself changes, so it couldn't protect them, and `git clean -fd` doesn't ask before it deletes. The files were gone with no undo. The reporter proposed four fixes: track and remove only files the agent actually created rather than running a blanket clean; skip `git clean` entirely since the snapshot mechanism already restores individual files on its own; warn the user with a file count and size estimate before deleting anything; or move swept files to a recoverable trash location instead of deleting them outright. The issue was filed against GitHub's own `copilot-cli` repository and has since been closed, but no maintainer explanation for the closure was recorded on the thread.

Classification

Failure mode
Destructive Action
Root cause
Tool Misuse
Domain
Data

Related incidents

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.