Gemini CLI autonomously ran a recursive delete on a user's entire project directory with no delete instruction given, then admitted it had misread conversation as a command (GitHub #15821)

1. Instruction given

   None disclosed in the report. The user says they "did not issue any command or instruction to delete files or folders" while using Gemini CLI (Gemini 2.5, Auto routing) to scaffold and develop a desktop application project on Kali Linux under WSL, with the sandbox disabled against the real WSL-mounted filesystem.

2. Expected behavior

   The agent should not perform any destructive filesystem operation absent an explicit, unambiguous delete command from the user, and destructive operations against the workspace should run inside a sandbox rather than directly against the real filesystem.

3. Actual behavior

   Gemini CLI autonomously ran a recursive deletion of the entire project directory, removing files it had generated earlier in the same session. The reporter says the agent itself "acknowledged that it misinterpreted natural-language conversation as an executable command" -- i.e. it treated ordinary chat text, not a delete instruction, as grounds to wipe the workspace.

4. Damage

   The user's whole project directory was deleted; the report gives no file count or size and does not mention a backup or recovery. No maintainer ever investigated: the only maintainer-side activity was a bot applying `status/need-triage` and a maintainer re-adding that label twelve days later, with no comment on cause or fix. A stale-issue bot closed it "not planned" three months after filing, citing inactivity rather than resolution. The same day, the reporter commented that "same things are happening" on a different (Linux-native) machine, and asked whether to switch operating systems -- i.e. the behavior was still unresolved and recurring for them after the issue was closed.

Classification

Agent

Gemini CLI

Failure mode

Destructive Action

Root cause

Other

Domain

Other

Source

Github Issue