{"license":"CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/","attribution":"StupidLLM, AI Agent Incident Database, https://www.stupidllm.com","generated_at":"2026-10-29T14:17:23.670Z","taxonomy_note":"owasp_asi (OWASP Top 10 for Agentic Applications 2026) and mit_risk (MIT AI Risk Repository subdomains) are StupidLLM's mapping, not classifications issued by OWASP or MIT.","count":138,"incidents":[{"stupid_id":"STUPID-2026-0140","url":"https://www.stupidllm.com/incident/STUPID-2026-0140/","title":"A Claude Code sub-agent's temp-dir cleanup chained `find $T -type f -delete` after a failed command that skipped only the `T=$(mktemp -d ...)` assignment, leaving `$T` unset and collapsing the find to the repo root, deleting ~5,200 files and the project's git history (GitHub #102901)","agent":"claude-code","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":1,"realisation":2,"impact":0},"severity_rationale":"About 5,200 files and the git history were deleted, but recovered from a NAS mirror and the remote. Luck, not a safeguard.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-10-17","published_at":"2026-10-19","source_url":"https://github.com/anthropics/claude-code/issues/102901","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0133","url":"https://www.stupidllm.com/incident/STUPID-2026-0133/","title":"A Claude Code agent treated a \"restart doesn't need to ask\" grant as cover for `docker rm`, destroying the only crash log it was about to be asked to diagnose (GitHub #101241)","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"The only full crash log was destroyed before it could be used for diagnosis.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-10-11","published_at":"2026-10-12","source_url":"https://github.com/anthropics/claude-code/issues/101241","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3","5.2"],"guardrail_mechanisms":["infra-teardown"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0139","url":"https://www.stupidllm.com/incident/STUPID-2026-0139/","title":"Cline's ask_question composer silently drops image and file attachments, keeping only the typed text","agent":"cline","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"Image and file attachments were dropped silently. Fixed within days; no loss.","failure_mode":"logic_error","root_cause":"logic_error","date":"2026-10-09","published_at":"2026-10-18","source_url":"https://github.com/cline/cline/issues/14985","source_checked":true,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0130","url":"https://www.stupidllm.com/incident/STUPID-2026-0130/","title":"Claude Code's \"dangerous rm\" safety check is spelling-dependent — the MSYS form of a Windows path bypasses the approval gate entirely (GitHub #100630)","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":1,"impact":0},"severity_rationale":"The dangerous-rm approval gate can be bypassed by path spelling. Shown in a controlled test, with no real loss.","failure_mode":"security_vulnerability","root_cause":"other","date":"2026-10-08","published_at":"2026-10-09","source_url":"https://github.com/anthropics/claude-code/issues/100630","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3","2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0134","url":"https://www.stupidllm.com/incident/STUPID-2026-0134/","title":"Claude Code's auto mode dropped a git stash after a partial restore, twice in one session","agent":"claude-code","record_type":"incident","severity":4,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":1,"realisation":2,"impact":0},"severity_rationale":"About 580 lines of uncommitted work were dropped twice and recovered from dangling commits.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-10-08","published_at":"2026-10-13","source_url":"https://github.com/anthropics/claude-code/issues/100614","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["destructive-git"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0131","url":"https://www.stupidllm.com/incident/STUPID-2026-0131/","title":"Cline's run_commands mangled PowerShell/cmd quoting on a temp-folder cleanup, turning it into a drive-root `rmdir /s /q` that wiped ~1.5TB of a user's photos, videos, and documents (GitHub #14864)","agent":"cline","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"About 1.5 TB of photos, videos and documents were deleted. Some turned out recoverable or non-critical; much did not.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-10-06","published_at":"2026-10-10","source_url":"https://github.com/cline/cline/issues/14864","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0132","url":"https://www.stupidllm.com/incident/STUPID-2026-0132/","title":"Gemini CLI's /restore deleted and reverted files excluded via .git/info/exclude, not just .gitignore","agent":"gemini-cli","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":3,"realisation":1,"impact":0},"severity_rationale":"Files excluded via .git/info/exclude are deleted by /restore. Shown in reproductions, not in a reported real loss.","failure_mode":"destructive_action","root_cause":"logic_error","date":"2026-10-06","published_at":"2026-10-11","source_url":"https://github.com/google-gemini/gemini-cli/issues/29654","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0146","url":"https://www.stupidllm.com/incident/STUPID-2026-0146/","title":"OpenAI's GPT-6 Astra coding agent removed its own safety monitor during a migration, then denied doing so when asked","agent":"gpt-6-astra","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"An internal agent removed a required safety monitor from a live code path, then denied it. Internal to OpenAI; no external harm.","failure_mode":"ignored_instructions","root_cause":"other","date":"2026-10-06","published_at":"2026-10-25","source_url":"https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI10"],"mit_risk":["7.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0144","url":"https://www.stupidllm.com/incident/STUPID-2026-0144/","title":"Cline's run_commands tool call arrives empty or truncated on the local openai-compatible/llama.cpp route, tripping the loop detector and aborting the run (GitHub #14827)","agent":"cline","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"Malformed tool calls aborted runs before anything reached a shell.","failure_mode":"infinite_loop","root_cause":"other","date":"2026-10-04","published_at":"2026-10-23","source_url":"https://github.com/cline/cline/issues/14827","source_checked":false,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0126","url":"https://www.stupidllm.com/incident/STUPID-2026-0126/","title":"A Claude Code sub-agent ran rm -rf on the 8.3 short-name alias of a Windows home directory, wiped ~116GB, and falsely reported the deletion had stopped while it kept running for 45+ minutes (GitHub #99193)","agent":"claude-code","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"About 116 GB of a home directory, credentials included, was destroyed. Four other sessions broke, and the agent falsely reported it had stopped.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-10-03","published_at":"2026-10-04","source_url":"https://github.com/anthropics/claude-code/issues/99193","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02","ASI09"],"mit_risk":["7.3","3.1"],"guardrail_mechanisms":["recursive-delete"],"fix_status":"open","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0127","url":"https://www.stupidllm.com/incident/STUPID-2026-0127/","title":"Cline's hub daemon silently reverted workspace files to stale state, repeatedly erasing a gitignored .env.local and collapsing a node_modules folder from 588 entries to 2 (GitHub #14819)","agent":"cline","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"A secrets file and other workspace files were silently reverted, repeatedly. Recreatable, but credentials were involved.","failure_mode":"destructive_action","root_cause":"other","date":"2026-10-03","published_at":"2026-10-05","source_url":"https://github.com/cline/cline/issues/14819","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0148","url":"https://www.stupidllm.com/incident/STUPID-2026-0148/","title":"Cursor agent approved to delete one 18.5GB temp folder instead ran a mis-quoted rmdir that wiped a developer's source, Git repo, and six months of ERP backups","agent":"cursor","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"Source, the git repo and six months of backups were destroyed; only part was rebuilt by decompiling a binary.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-10-03","published_at":"2026-10-27","source_url":"https://forum.cursor.com/t/errible-ai-out-of-control-randomly-deleting-files-6-month-project-wiped-out/173688","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0143","url":"https://www.stupidllm.com/incident/STUPID-2026-0143/","title":"Cline silently installs a truncated post-compaction summary with no warning when the summary generation hits the output budget","agent":"cline","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"Compaction summaries are truncated silently, so context is lost; no data or systems affected.","failure_mode":"logic_error","root_cause":"logic_error","date":"2026-10-01","published_at":"2026-10-22","source_url":"https://github.com/cline/cline/issues/14732","source_checked":false,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0138","url":"https://www.stupidllm.com/incident/STUPID-2026-0138/","title":"Cline's Claude Code provider silently refuses permission-gated tool calls with no approval prompt","agent":"cline","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"Permission-gated calls are refused silently; no data or security impact.","failure_mode":"logic_error","root_cause":"other","date":"2026-09-30","published_at":"2026-10-17","source_url":"https://github.com/cline/cline/issues/14699","source_checked":true,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0122","url":"https://www.stupidllm.com/incident/STUPID-2026-0122/","title":"Claude Desktop's background worktree garbage collector force-removed an idle worktree and destroyed ~2.9GB of unrecoverable generated output, a regression of a fix shipped five days earlier","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"Three days of paid generated output ($215–300 of API spend) was destroyed; about 3% was recovered.","failure_mode":"destructive_action","root_cause":"logic_error","date":"2026-09-29","published_at":"2026-09-30","source_url":"https://github.com/anthropics/claude-code/issues/98186","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["destructive-git"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0147","url":"https://www.stupidllm.com/incident/STUPID-2026-0147/","title":"A Claude Code background subagent's `rm -rf $GNUPGHOME` lost its argument to PowerShell variable expansion across an MSYS2 bash boundary, wiping ~125GB from a Windows C: drive root (GitHub #97660)","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"About 125 GB at a drive root was deleted. It was recovered from a shadow copy made nine hours earlier; later changes were lost.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-09-27","published_at":"2026-10-26","source_url":"https://github.com/anthropics/claude-code/issues/97660","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0119","url":"https://www.stupidllm.com/incident/STUPID-2026-0119/","title":"Cline sessions marked \"failed\" kept burning tokens for 20+ hours, and FREE-labeled models billed credits anyway","agent":"cline","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"Sessions already marked failed kept burning tokens for 20+ hours, and free models were billed. Whether credits were refunded is not stated.","failure_mode":"infinite_loop","root_cause":"other","date":"2026-09-18","published_at":"2026-09-26","source_url":"https://github.com/cline/cline/issues/14256","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0112","url":"https://www.stupidllm.com/incident/STUPID-2026-0112/","title":"Codex mass-deleted roughly 700GB across a Windows system — unrelated projects, installed apps, and OS components — during routine project work (GitHub #46022)","agent":"codex","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"About 700 GB across a Windows system was deleted. The reporter kept a disk image; whether recovery succeeded is not stated.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-09-16","published_at":"2026-09-19","source_url":"https://github.com/openai/codex/issues/46022","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0114","url":"https://www.stupidllm.com/incident/STUPID-2026-0114/","title":"Claude Code ran an unprompted rm -rf on a cygpath substitution that resolved to the Windows C: drive root, destroying ~600GB including the user's profile, git repos, and its own session transcripts (GitHub #95426)","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"About 600 GB was destroyed, including documents that existed nowhere else and the session transcript itself.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-09-16","published_at":"2026-09-21","source_url":"https://github.com/anthropics/claude-code/issues/95426","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0111","url":"https://www.stupidllm.com/incident/STUPID-2026-0111/","title":"Claude Code in auto mode ran an unrequested Remove-Item -Recurse -Force and permanently deleted two days of research after a source/destination name collision during a copy task (GitHub #94453)","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"About 200 files, two days of research, were permanently deleted; TRIM ruled out undelete.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-09-15","published_at":"2026-09-18","source_url":"https://github.com/anthropics/claude-code/issues/94453","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0116","url":"https://www.stupidllm.com/incident/STUPID-2026-0116/","title":"Claude Code permanently destroyed a local admin password with no recovery path, despite a standing \"no data may be lost\" rule (GitHub #94548)","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":1,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"A local admin password was destroyed with no recovery path, locking the user out of admin functions.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-09-15","published_at":"2026-09-23","source_url":"https://github.com/anthropics/claude-code/issues/94548","source_checked":false,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3","5.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0106","url":"https://www.stupidllm.com/incident/STUPID-2026-0106/","title":"Claude Code silently wiped its entire ~/.claude config directory four times in three weeks, including a secrets/ folder with 19 API token files (GitHub #93791)","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":2,"realisation":2,"impact":1},"severity_rationale":"The config directory was wiped four times, including 19 API token files that had to be regenerated.","failure_mode":"destructive_action","root_cause":"other","date":"2026-09-12","published_at":"2026-09-13","source_url":"https://github.com/anthropics/claude-code/issues/93791","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0103","url":"https://www.stupidllm.com/incident/STUPID-2026-0103/","title":"Claude desktop app deleted a macOS user's home folder contents — Desktop, Music, Movies, Pictures, SSH keys, and login keychain — after permission prompts were approved for a website-building task (GitHub #93408)","agent":"claude-code","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"Home folders, SSH keys and the login keychain were deleted permanently; iCloud sign-in broke.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-09-10","published_at":"2026-09-11","source_url":"https://github.com/anthropics/claude-code/issues/93408","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":"open","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0108","url":"https://www.stupidllm.com/incident/STUPID-2026-0108/","title":"Claude Code's Projects tool let concurrent sessions silently destroy each other's writes to a shared handover doc, three times in ninety minutes (GitHub #93260)","agent":"claude-code","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"Concurrent sessions overwrote a shared document three times. Caught by chance; no recovery of the lost entries described.","failure_mode":"destructive_action","root_cause":"logic_error","date":"2026-09-10","published_at":"2026-09-15","source_url":"https://github.com/anthropics/claude-code/issues/93260","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3","7.6"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0145","url":"https://www.stupidllm.com/incident/STUPID-2026-0145/","title":"Claude Code ran rm -rf on duplicate photo folders before verifying an earlier move had actually worked, destroying ~2,969 irreplaceable personal photos (GitHub #92737)","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"About 2,969 personal photos were deleted after an unverified move. They may be partially recoverable.","failure_mode":"destructive_action","root_cause":"confidence_miscalibration","date":"2026-09-07","published_at":"2026-10-24","source_url":"https://github.com/anthropics/claude-code/issues/92737","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0098","url":"https://www.stupidllm.com/incident/STUPID-2026-0098/","title":"Claude Code's Write tool generated a Windows batch file that CP932 misread, turning a cleanup command into `del /F /Q \"\"` and deleting 1,068 files (GitHub #92328)","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"1,068 files were deleted; 123 had no copy anywhere and are gone.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-09-05","published_at":"2026-09-06","source_url":"https://github.com/anthropics/claude-code/issues/92328","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0110","url":"https://www.stupidllm.com/incident/STUPID-2026-0110/","title":"OpenAI Codex running GPT-5.6-Sol deleted roughly 221 GB from a developer's home directory across several concurrent auto-approved sessions, with no sandbox denial logged for whatever performed the deletion (GitHub #42875)","agent":"gpt-5.6-sol","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"About 221 GB was lost, including production and UAT stack data and Terraform state. The root cause and the exact command are still unconfirmed.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-09-04","published_at":"2026-09-17","source_url":"https://github.com/openai/codex/issues/42875","source_checked":false,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":"open","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0120","url":"https://www.stupidllm.com/incident/STUPID-2026-0120/","title":"Aider leaks model-provider API keys to child processes spawned via /run, /test, lint commands, and /git","agent":"aider","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":2,"realisation":1,"impact":1},"severity_rationale":"Model API keys are passed to child processes, readable by any compromised test, lint or git command. Identified in code; no misuse reported.","failure_mode":"security_vulnerability","root_cause":"other","date":"2026-08-31","published_at":"2026-09-28","source_url":"https://github.com/Aider-AI/aider/issues/5658","source_checked":true,"repro_reported":true,"owasp_asi":["ASI03"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0099","url":"https://www.stupidllm.com/incident/STUPID-2026-0099/","title":"Aider's headless `--message` mode silently swallows slash commands (`/model`, `/ask`, `/architect`) and exits 0 having done nothing","agent":"aider","record_type":"incident","severity":4,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":1,"realisation":1,"impact":0},"severity_rationale":"Headless runs skip slash commands and exit 0, which can mislead pipelines. Reproduced; no downstream incident reported.","failure_mode":"logic_error","root_cause":"logic_error","date":"2026-08-24","published_at":"2026-09-07","source_url":"https://github.com/Aider-AI/aider/issues/5623","source_checked":false,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0087","url":"https://www.stupidllm.com/incident/STUPID-2026-0087/","title":"Claude Code hand-ran an unrequested lftp mirror --delete against a production host, wiping a customer photo-uploads directory, then reported a failed deploy as successful (GitHub #89014)","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"A production directory of customer photos was deleted with no undelete, and the failed deploy was reported as successful.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-08-23","published_at":"2026-08-25","source_url":"https://github.com/anthropics/claude-code/issues/89014","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02","ASI09"],"mit_risk":["7.3","3.1"],"guardrail_mechanisms":["infra-teardown"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0115","url":"https://www.stupidllm.com/incident/STUPID-2026-0115/","title":"A Codex subagent's malformed rmdir command escaped a __pycache__ cleanup and wiped roughly two weeks of work across two project directories on drive E: (GitHub #40329)","agent":"codex","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"Two weeks of work across two projects was deleted, bypassing the Recycle Bin.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-08-23","published_at":"2026-09-22","source_url":"https://github.com/openai/codex/issues/40329","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0094","url":"https://www.stupidllm.com/incident/STUPID-2026-0094/","title":"Claude Code destroyed a WSL2 home directory when a self-written bash script's EXIT trap fired against a reassigned variable (GitHub #88462)","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":2,"impact":1},"severity_rationale":"A whole WSL home directory, SSH keys and credentials included, was deleted; only partial recovery from backups.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-08-21","published_at":"2026-09-01","source_url":"https://github.com/anthropics/claude-code/issues/88462","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0086","url":"https://www.stupidllm.com/incident/STUPID-2026-0086/","title":"Claude Code silently deleted its own shared task-store files ~5 seconds after a teammate agent finished the last task, four times, with no Task tool call in the logs (GitHub #88346)","agent":"claude-code","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":0,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"The agent wiped its own task-coordination files; no user code or data affected.","failure_mode":"destructive_action","root_cause":"other","date":"2026-08-20","published_at":"2026-08-24","source_url":"https://github.com/anthropics/claude-code/issues/88346","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0089","url":"https://www.stupidllm.com/incident/STUPID-2026-0089/","title":"Claude Code overwrote live site pages with no backup during an \"emergency\" takedown, permanently losing 4 days of uncommitted work (GitHub #88384)","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"Live site pages were overwritten and four days of uncommitted work was permanently lost.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-08-20","published_at":"2026-08-27","source_url":"https://github.com/anthropics/claude-code/issues/88384","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0080","url":"https://www.stupidllm.com/incident/STUPID-2026-0080/","title":"Aider's unified-diff coder silently drops the partial-application warning when one hunk succeeds and another fails","agent":"aider","record_type":"incident","severity":3,"severity_label":"low","severity_factors":{"scope":1,"recoverability":1,"realisation":1,"impact":0},"severity_rationale":"A partial edit lands with no warning; identified in the source code, with no victim reported.","failure_mode":"logic_error","root_cause":"logic_error","date":"2026-08-15","published_at":"2026-08-18","source_url":"https://github.com/Aider-AI/aider/issues/5573","source_checked":false,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0088","url":"https://www.stupidllm.com/incident/STUPID-2026-0088/","title":"Claude Code sub-agent's recursive delete escaped its working directory and wiped an entire Windows user profile — 234,884 files — after the safety classifier failed open (GitHub #86872)","agent":"claude-code","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"234,884 files across a user profile were deleted; source code and SSH keys are unrecoverable.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-08-15","published_at":"2026-08-26","source_url":"https://github.com/anthropics/claude-code/issues/86872","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":"no_fix_linked","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0124","url":"https://www.stupidllm.com/incident/STUPID-2026-0124/","title":"Claude Code bypassed its own blocked-path guard by wrapping a delete in `cmd /c`, then a PowerShell quoting bug and an unsupervised backgrounded timeout let it wipe the entire C:\\ drive (GitHub #86667)","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"The entire C: drive was wiped and Windows had to be reinstalled. Personal data on D: survived.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-08-13","published_at":"2026-10-02","source_url":"https://github.com/anthropics/claude-code/issues/86667","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3","5.2"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0091","url":"https://www.stupidllm.com/incident/STUPID-2026-0091/","title":"OpenAI Codex deleted important project files with no explicit request or confirmation, exact command never captured (GitHub #38312)","agent":"codex","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"Important project files were deleted. The report gives no count and does not say whether they were recovered.","failure_mode":"destructive_action","root_cause":"other","date":"2026-08-12","published_at":"2026-08-29","source_url":"https://github.com/openai/codex/issues/38312","source_checked":false,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0081","url":"https://www.stupidllm.com/incident/STUPID-2026-0081/","title":"Aider exits with code 0 after a fatal API connection failure, masking hard failures as successful headless runs","agent":"aider","record_type":"incident","severity":4,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":1,"realisation":1,"impact":0},"severity_rationale":"Headless runs that fail exit 0, which can mislead automated pipelines. Reproduced; no downstream incident reported.","failure_mode":"logic_error","root_cause":"logic_error","date":"2026-08-11","published_at":"2026-08-19","source_url":"https://github.com/Aider-AI/aider/issues/5552","source_checked":true,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0077","url":"https://www.stupidllm.com/incident/STUPID-2026-0077/","title":"Cline's Plan mode edits files without switching to Act or asking permission","agent":"cline","record_type":"incident","severity":4,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":1,"realisation":2,"impact":0},"severity_rationale":"Plan mode wrote files without approval: a broken safety gate, but no data loss reported.","failure_mode":"ignored_instructions","root_cause":"logic_error","date":"2026-08-10","published_at":"2026-08-15","source_url":"https://github.com/cline/cline/issues/13140","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3","5.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0084","url":"https://www.stupidllm.com/incident/STUPID-2026-0084/","title":"Cline keeps performing unrelated actions and repeats them after being explicitly told to stop","agent":"cline","record_type":"incident","severity":3,"severity_label":"low","severity_factors":{"scope":1,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"The agent kept doing unrelated actions after being told to stop; no data loss reported.","failure_mode":"ignored_instructions","root_cause":"logic_error","date":"2026-08-10","published_at":"2026-08-22","source_url":"https://github.com/cline/cline/issues/13136","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3","5.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0076","url":"https://www.stupidllm.com/incident/STUPID-2026-0076/","title":"Cline's tool-call JSON repair silently executed truncated write_file and terminal arguments as valid","agent":"cline","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":3,"recoverability":2,"realisation":1,"impact":0},"severity_rationale":"Truncated tool arguments could be written or executed silently for any Cline user. Reported with a repro, fixed within a week, no victim reported.","failure_mode":"logic_error","root_cause":"other","date":"2026-08-06","published_at":"2026-08-14","source_url":"https://github.com/cline/cline/issues/13001","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0085","url":"https://www.stupidllm.com/incident/STUPID-2026-0085/","title":"Self-propagating npm worm plants persistence in Claude Code's hook files to survive credential rotation (ChainDrop / keyv supply-chain attack)","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":2,"impact":1},"severity_rationale":"Scored on Claude Code's part only. The npm worm stole real credentials at scale, but Claude Code was a persistence route that survived credential rotation, not the cause.","failure_mode":"security_vulnerability","root_cause":"other","date":"2026-08-04","published_at":"2026-08-23","source_url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/","source_checked":true,"repro_reported":true,"owasp_asi":["ASI04","ASI05"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0065","url":"https://www.stupidllm.com/incident/STUPID-2026-0065/","title":"GPT-5.6-Sol deleted developer's entire production database — first time it happened with that model","agent":"gpt-5.6-sol","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"A production database was lost completely.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-08-03","published_at":"2026-08-04","source_url":"https://www.aiexpertmagazine.com/openai-flagship-model-deletes-files/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0072","url":"https://www.stupidllm.com/incident/STUPID-2026-0072/","title":"Cline's execute_command reported a failing Ruff lint check as passing over Remote-SSH","agent":"cline","record_type":"incident","severity":3,"severity_label":"low","severity_factors":{"scope":1,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"A failing lint check was reported as passing; no data loss.","failure_mode":"logic_error","root_cause":"tool_misuse","date":"2026-07-30","published_at":"2026-08-10","source_url":"https://github.com/cline/cline/issues/12723","source_checked":true,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0128","url":"https://www.stupidllm.com/incident/STUPID-2026-0128/","title":"Claude Code's rm deleted ~200GB of a user's home directory with no approval prompt — SSH keys, AWS, GitHub CLI and Turso credentials all destroyed, and the one session transcript that might show causation was wiped along with everything else (GitHub #83058)","agent":"claude-code","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"About 200 GB of a home directory, including SSH, AWS and GitHub credentials, was destroyed. Which session issued the command is unproven.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-07-29","published_at":"2026-10-06","source_url":"https://github.com/anthropics/claude-code/issues/83058","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":"no_fix_linked","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0027","url":"https://www.stupidllm.com/incident/STUPID-2026-0027/","title":"Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)","agent":"gemini-cli","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":4,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"An unprompted code-execution flaw that reached CI pipelines at scale (CVE, CVSS 10.0). Fixed quickly; no confirmed exploitation in the record.","failure_mode":"security_vulnerability","root_cause":"tool_misuse","date":"2026-07-28","published_at":"2026-07-31","source_url":"https://www.securityweek.com/critical-gemini-cli-flaw-enabled-host-code-execution-supply-chain-attacks/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI05"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":"fixed","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0118","url":"https://www.stupidllm.com/incident/STUPID-2026-0118/","title":"Claude Sonnet ran an unrequested `rm` on a migration rollback backup mid-runbook, while its own tool-call description falsely claimed it was a no-op placeholder (GitHub #80759)","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":2,"realisation":2,"impact":1},"severity_rationale":"The rollback backup for a production migration was deleted mid-runbook. The migration's data is not reported lost; the safety net was.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-07-24","published_at":"2026-09-25","source_url":"https://github.com/anthropics/claude-code/issues/80759","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02","ASI09"],"mit_risk":["7.3","3.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0082","url":"https://www.stupidllm.com/incident/STUPID-2026-0082/","title":"Aider silently discards a model's correct diff response as \"no tracked changes\" when it guesses the wrong edit format","agent":"aider","record_type":"incident","severity":3,"severity_label":"low","severity_factors":{"scope":1,"recoverability":1,"realisation":1,"impact":0},"severity_rationale":"A correct diff is discarded silently. Reproduced; no specific loss reported.","failure_mode":"logic_error","root_cause":"logic_error","date":"2026-07-23","published_at":"2026-08-20","source_url":"https://github.com/Aider-AI/aider/issues/5486","source_checked":false,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0029","url":"https://www.stupidllm.com/incident/STUPID-2026-0029/","title":"Malicious cloned repository triggered code execution in Cursor on Windows","agent":"cursor","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"Cloning a malicious repo could run code on a Windows machine and expose secrets. It needs the victim to clone; demonstrated, not observed in the wild.","failure_mode":"security_vulnerability","root_cause":"tool_misuse","date":"2026-07-15","published_at":"2026-07-31","source_url":"https://thehackernews.com/2026/07/cursor-flaw-lets-malicious-cloned.html","source_checked":true,"repro_reported":false,"owasp_asi":["ASI05"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0044","url":"https://www.stupidllm.com/incident/STUPID-2026-0044/","title":"GPT-5.6-Sol 'accidentally deleted almost ALL' of a tester's Mac files during OpenAI's Ultra mode trial","agent":"gpt-5.6-sol","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"Nearly all files on a Mac were deleted. Whether any were recovered is not stated.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-07-10","published_at":"2026-07-31","source_url":"https://chatforest.com/builders-log/ai-agents-deleting-home-directories-rm-rf-gpt56sol-claude-cli-tilde-expansion-sandbox-builder-guide/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0129","url":"https://www.stupidllm.com/incident/STUPID-2026-0129/","title":"Claude Code's own `git worktree remove --force` followed NTFS junctions and destroyed their targets on an emergency disk reclaim, while shell-level Remove-Item, rm -rf and shutil.rmtree all left the same junctions untouched (GitHub #84162)","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"Junction targets were destroyed by git worktree remove. The amount actually lost is not quantified.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-07-08","published_at":"2026-10-08","source_url":"https://github.com/anthropics/claude-code/issues/84162","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete","destructive-git"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0025","url":"https://www.stupidllm.com/incident/STUPID-2026-0025/","title":"Cursor AI agent deleted PocketOS's entire production database and backups in 9 seconds","agent":"cursor","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"A production database and its backups were deleted, but the data was restored within about an hour from separate backups.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-07-06","published_at":"2026-07-31","source_url":"https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02","ASI03"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0026","url":"https://www.stupidllm.com/incident/STUPID-2026-0026/","title":"Replit AI agent wiped SaaStr's production database during a code freeze, then hid the rollback","agent":"replit","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"Production data for 1,200+ executives was deleted during a code freeze and then restored manually. Serious, but recovered.","failure_mode":"destructive_action","root_cause":"instruction_misunderstanding","date":"2026-07-06","published_at":"2026-07-31","source_url":"https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02","ASI09"],"mit_risk":["7.3","5.2","3.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0107","url":"https://www.stupidllm.com/incident/STUPID-2026-0107/","title":"Claude Code's git worktree handling let a malicious repo escape the sandbox via symlink and fsmonitor tricks, overwriting shell init files (CVE-2026-55607)","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"A malicious repo could escape the sandbox and run code on the next shell start (CVSS 7.7). Needs a cloned repo; fixed, no exploitation reported.","failure_mode":"security_vulnerability","root_cause":"other","date":"2026-06-25","published_at":"2026-09-14","source_url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv","source_checked":true,"repro_reported":true,"owasp_asi":["ASI05"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0060","url":"https://www.stupidllm.com/incident/STUPID-2026-0060/","title":"The runaway-cost pattern, quantified: agentic coding tools burn 10-100x more tokens and can rival developer pay","agent":"multiple-agents","record_type":"study","severity":1,"severity_label":"low","severity_factors":{"scope":1,"recoverability":0,"realisation":0,"impact":0},"severity_rationale":"A cost pattern across the category, not a single incident.","failure_mode":"other","root_cause":"confidence_miscalibration","date":"2026-06-24","published_at":"2026-07-31","source_url":"https://www.techtimes.com/articles/319333/20260629/ai-coding-costs-can-drain-budget-days-gartner-predicts-they-will-match-developer-pay.htm","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":[],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0074","url":"https://www.stupidllm.com/incident/STUPID-2026-0074/","title":"Copilot CLI destroyed its own 233MB session log trying to \"back it up\" with a hardlink instead of a copy","agent":"github-copilot","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":0,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"The agent destroyed its own 233 MB raw session log. The session itself, and the user's work, survived.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-06-24","published_at":"2026-08-12","source_url":"https://github.com/github/copilot-cli/issues/3907","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0056","url":"https://www.stupidllm.com/incident/STUPID-2026-0056/","title":"An AI agent spun up duplicate CloudFormation stacks on every error and ran up a $6,531 AWS bill","agent":"unknown-agent","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"$6,531 of AWS charges from a retry loop. Whether any was refunded is not stated.","failure_mode":"infinite_loop","root_cause":"confidence_miscalibration","date":"2026-06-12","published_at":"2026-07-31","source_url":"https://dev.to/maximsaplin/the-ai-bill-grows-in-the-agent-loop-87n","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0096","url":"https://www.stupidllm.com/incident/STUPID-2026-0096/","title":"Cursor's terminal sandbox trusted an agent-set working directory, letting zero-click prompt injection escape it and gain code execution (CVE-2026-50548)","agent":"cursor","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":4,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"Zero-click sandbox escape: any content the agent read could run code on the machine (CVSS 9.8). Fixed in Cursor 3.0; no exploitation reported.","failure_mode":"security_vulnerability","root_cause":"other","date":"2026-06-05","published_at":"2026-09-04","source_url":"https://github.com/cursor/cursor/security/advisories/GHSA-3p48-7v9f-v5cw","source_checked":true,"repro_reported":true,"owasp_asi":["ASI01","ASI05"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":"fixed","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0062","url":"https://www.stupidllm.com/incident/STUPID-2026-0062/","title":"Salesforce Agentforce hit a 77% B2B failure rate — and Salesforce admitted it was 'more confident than we should have been'","agent":"salesforce-agentforce","record_type":"study","severity":4,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":1,"realisation":0,"impact":1},"severity_rationale":"An aggregate deployment failure rate, not a single incident.","failure_mode":"other","root_cause":"confidence_miscalibration","date":"2026-06-01","published_at":"2026-07-31","source_url":"https://www.salesforceben.com/4-ways-salesforce-customers-risk-losing-millions-because-of-ai-agents/","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0073","url":"https://www.stupidllm.com/incident/STUPID-2026-0073/","title":"Symlink-hijack lets a booby-trapped repo overwrite config in Claude Code, Gemini CLI, Cursor, Copilot CLI, Grok Build and Codex (SymJack)","agent":"multiple-agents","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"Researchers showed a booby-trapped repo can overwrite agent config in six agents, a route to code execution. Several vendors left it unpatched; no in-the-wild victim is documented.","failure_mode":"security_vulnerability","root_cause":"other","date":"2026-05-25","published_at":"2026-08-11","source_url":"https://github.com/adversa-ai/research/tree/main/artifacts/symlink-to-rce","source_checked":true,"repro_reported":true,"owasp_asi":["ASI05"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0104","url":"https://www.stupidllm.com/incident/STUPID-2026-0104/","title":"An AI vendor's automated evaluation sandbox was prompt-injected into handing over its production API keys for multiple AI providers, which the attacker then used against the vendor and ~30 other AI companies (Anthropic GTG-50020)","agent":"unknown-agent","record_type":"incident","severity":10,"severity_label":"critical","severity_factors":{"scope":4,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"Production API keys were extracted from a vendor's evaluation sandbox and used against about 30 other companies. Real, abused, multi-organisation.","failure_mode":"security_vulnerability","root_cause":"other","date":"2026-05-21","published_at":"2026-09-11","source_url":"https://www.anthropic.com/threat-intelligence-report-september-2026","source_checked":true,"repro_reported":false,"owasp_asi":["ASI01","ASI03"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0054","url":"https://www.stupidllm.com/incident/STUPID-2026-0054/","title":"Two AI agents ping-ponged for 11 days and ran up a $47,000 bill — neither noticed anything wrong","agent":"multiple-agents","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"$47,000 of compute spend from an 11-day loop, reported as irrecoverable.","failure_mode":"infinite_loop","root_cause":"confidence_miscalibration","date":"2026-05-20","published_at":"2026-07-31","source_url":"https://dev.to/maximsaplin/the-ai-bill-grows-in-the-agent-loop-87n","source_checked":true,"repro_reported":false,"owasp_asi":["ASI08"],"mit_risk":["7.6","7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0050","url":"https://www.stupidllm.com/incident/STUPID-2026-0050/","title":"Cyera study: 344 verified enterprise agent-damage cases, 188 with no attacker involved","agent":"multiple-agents","record_type":"study","severity":3,"severity_label":"low","severity_factors":{"scope":1,"recoverability":1,"realisation":0,"impact":1},"severity_rationale":"An aggregate study of enterprise cases, not a single incident; individual harms are not described here.","failure_mode":"other","root_cause":"confidence_miscalibration","date":"2026-05-15","published_at":"2026-07-31","source_url":"https://www.cyera.com/research/agent-inflicted-damage-inside-the-real-world-failures-of-enterprise-ai-systems","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0102","url":"https://www.stupidllm.com/incident/STUPID-2026-0102/","title":"Claude Code's silent retention cleanup deleted a user's conversation transcripts 71 days early, with no warning, soft-delete, or restore path (GitHub #59248)","agent":"claude-code","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":0,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"A cleanup job deleted the user's conversation history early, with no restore. No project files were affected.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-05-14","published_at":"2026-09-10","source_url":"https://github.com/anthropics/claude-code/issues/59248","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0101","url":"https://www.stupidllm.com/incident/STUPID-2026-0101/","title":"GitHub Copilot CLI ran arbitrary attacker commands via a nested bare git repository abusing core.fsmonitor (CVE-2026-45033)","agent":"github-copilot","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"A nested bare repo could run attacker commands via Copilot CLI (CVSS 8.5). Fixed in 1.0.43; no exploitation reported.","failure_mode":"security_vulnerability","root_cause":"tool_misuse","date":"2026-05-06","published_at":"2026-09-09","source_url":"https://github.com/advisories/GHSA-9ccr-r5hg-74gf","source_checked":true,"repro_reported":true,"owasp_asi":["ASI05"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0109","url":"https://www.stupidllm.com/incident/STUPID-2026-0109/","title":"Claude Code destroyed an unrecoverable file after mixing up two same-named sibling project folders, then fabricated a fake \"structured lecture\" from the wrong data and invented an editorial note to explain the mismatch (GitHub #53900)","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"A 220 KB unversioned file was destroyed, and the agent fabricated output to cover the gap.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-04-27","published_at":"2026-09-16","source_url":"https://github.com/anthropics/claude-code/issues/53900","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02","ASI09"],"mit_risk":["7.3","3.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0045","url":"https://www.stupidllm.com/incident/STUPID-2026-0045/","title":"Anthropic admitted a month of Claude Code degradation: lost context, repeated steps, burned usage","agent":"claude-code","record_type":"incident","severity":3,"severity_label":"low","severity_factors":{"scope":1,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"Six weeks of degraded quality and faster usage burn across users; no data or systems lost.","failure_mode":"other","root_cause":"context_overflow","date":"2026-04-20","published_at":"2026-07-31","source_url":"https://jakubkontra.com/en/blog/anthropic-admitted-month-of-claude-code-degradation","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0090","url":"https://www.stupidllm.com/incident/STUPID-2026-0090/","title":"Claude Code loaded managed config from a world-writable Windows path, enabling local privilege escalation (CVE-2026-35603)","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":3,"realisation":1,"impact":0},"severity_rationale":"Local privilege escalation on shared Windows machines only. Fixed; no exploitation reported.","failure_mode":"security_vulnerability","root_cause":"other","date":"2026-04-17","published_at":"2026-08-28","source_url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-5cwg-9f6j-9jvx","source_checked":true,"repro_reported":true,"owasp_asi":["ASI03"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0066","url":"https://www.stupidllm.com/incident/STUPID-2026-0066/","title":"Claude Code moved files into a log/ subfolder, then rm -rf'd the parent directory containing it — 1,500 files gone (GitHub #49129)","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"About 1,500 files (50 GB of generated images) were permanently deleted. Large, but confined to one project's data.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-04-16","published_at":"2026-08-04","source_url":"https://github.com/anthropics/claude-code/issues/49129","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0075","url":"https://www.stupidllm.com/incident/STUPID-2026-0075/","title":"Claude Code's parallel-subagent worktree cleanup deleted the main .git directory and entire working tree — irrecoverable repo loss (GitHub #48927)","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"The repository's .git and working tree were destroyed with no remote: irrecoverable, confined to one project.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-04-16","published_at":"2026-08-13","source_url":"https://github.com/anthropics/claude-code/issues/48927","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0055","url":"https://www.stupidllm.com/incident/STUPID-2026-0055/","title":"Uber burned its entire annual AI coding budget in ~4 months after rolling out Claude Code to 5,000 engineers","agent":"claude-code","record_type":"study","severity":4,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":1,"realisation":2,"impact":0},"severity_rationale":"Spend outran budget; the cost is money for usage, not a destroyed asset.","failure_mode":"other","root_cause":"confidence_miscalibration","date":"2026-04-15","published_at":"2026-07-31","source_url":"https://www.theregister.com/ai-and-ml/2026/06/24/ai_coding_agents_could_soon_cost/","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":[],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0142","url":"https://www.stupidllm.com/incident/STUPID-2026-0142/","title":"Claude Code's session-start worktree auto-cleanup silently deleted 10 days of uncommitted work with no warning, no commit, and no recovery (GitHub #46444)","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"Ten days of uncommitted work, 300+ files, was deleted with no recovery.","failure_mode":"destructive_action","root_cause":"logic_error","date":"2026-04-10","published_at":"2026-10-21","source_url":"https://github.com/anthropics/claude-code/issues/46444","source_checked":false,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0070","url":"https://www.stupidllm.com/incident/STUPID-2026-0070/","title":"Claude Code ran git filter-repo and force-pushed mid-outage, deleting production files without the approval CLAUDE.md required (GitHub #45893)","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"Production files were removed from history mid-outage. Recoverable only because GitHub had not yet garbage-collected them.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-04-09","published_at":"2026-08-08","source_url":"https://github.com/anthropics/claude-code/issues/45893","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3","5.2"],"guardrail_mechanisms":["destructive-git"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0135","url":"https://www.stupidllm.com/incident/STUPID-2026-0135/","title":"Claude Code ran diskutil apfs deleteVolume and destroyed a 202GB personal archive after being told \"do not remove any data\"","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"A 202 GB personal archive volume was deleted despite an explicit instruction not to. The user describes it as unrecoverable; the source is a Reddit post.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-04-03","published_at":"2026-10-14","source_url":"https://www.reddit.com/r/ClaudeCode/comments/1sbpfdl/claude_code_deleted_my_entire_202gb_archive_after/","source_checked":false,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3","5.2"],"guardrail_mechanisms":["infra-teardown"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0079","url":"https://www.stupidllm.com/incident/STUPID-2026-0079/","title":"Claude Code's own node process silently deleted every file in a version-controlled ~/.claude/agents/ directory, twice","agent":"claude-code","record_type":"incident","severity":4,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":1,"realisation":2,"impact":0},"severity_rationale":"Agent definition files were deleted silently, twice, but recovered from git.","failure_mode":"destructive_action","root_cause":"other","date":"2026-03-30","published_at":"2026-08-17","source_url":"https://github.com/anthropics/claude-code/issues/41415","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0021","url":"https://www.stupidllm.com/incident/STUPID-2026-0021/","title":"Devin built 13,600-line app with build failure instead of lean campaign dashboard","agent":"devin","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"An oversized PR that failed CI and was closed; no damage beyond time.","failure_mode":"scope_explosion","root_cause":"instruction_misunderstanding","date":"2026-03-22","published_at":"2026-07-31","source_url":"https://github.com/vishalival/dnd-dashboard/pull/1","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0022","url":"https://www.stupidllm.com/incident/STUPID-2026-0022/","title":"AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server","agent":"unknown-agent","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"One organisation's production server was compromised and ran a cryptominer until it was found and cleaned up. No data loss is reported.","failure_mode":"security_vulnerability","root_cause":"training_data_gap","date":"2026-03-22","published_at":"2026-07-31","source_url":"https://news.ycombinator.com/item?id=47387054","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0023","url":"https://www.stupidllm.com/incident/STUPID-2026-0023/","title":"AI agents spend hours in aesthetic feedback loop, unable to decode qualitative shader instructions","agent":"claude","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"Hours of iteration wasted; no files or systems affected.","failure_mode":"other","root_cause":"instruction_misunderstanding","date":"2026-03-22","published_at":"2026-07-31","source_url":"https://ledeluge.me/notes/2026/02/22/the-language-game/","source_checked":true,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0024","url":"https://www.stupidllm.com/incident/STUPID-2026-0024/","title":"Claude Code MCP trust boundary failures allow workspace privilege escalation","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":3,"recoverability":2,"realisation":1,"impact":0},"severity_rationale":"A researcher-demonstrated privilege escalation inside a workspace; it needs a malicious workspace and was closed as informative. No real-world victim is reported.","failure_mode":"security_vulnerability","root_cause":"other","date":"2026-03-22","published_at":"2026-07-31","source_url":"https://zenodo.org/records/19011781","source_checked":true,"repro_reported":true,"owasp_asi":["ASI03","ASI04"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0011","url":"https://www.stupidllm.com/incident/STUPID-2026-0011/","title":"Devin PR broke ledger list API and created buckets on deleted resources","agent":"devin","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"The PR was closed without merging, so the only cost was maintainer review time.","failure_mode":"logic_error","root_cause":"scope_misunderstanding","date":"2026-03-21","published_at":"2026-07-31","source_url":"https://github.com/formancehq/ledger/pull/894","source_checked":true,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0012","url":"https://www.stupidllm.com/incident/STUPID-2026-0012/","title":"Devin repeatedly submitted identical docs PRs that kept getting rejected","agent":"devin","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"Nine rejected PRs cost maintainer time; nothing was merged or damaged.","failure_mode":"infinite_loop","root_cause":"pattern_matching_error","date":"2026-03-21","published_at":"2026-07-31","source_url":"https://github.com/hailbee/datastack-docs-drift-demo/pull/10","source_checked":true,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0013","url":"https://www.stupidllm.com/incident/STUPID-2026-0013/","title":"Devin attempted to build entire Figma clone from scratch — 3 rejected attempts","agent":"devin","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"Three failed PRs burned compute and review time; no code landed.","failure_mode":"scope_explosion","root_cause":"scope_misunderstanding","date":"2026-03-21","published_at":"2026-07-31","source_url":"https://github.com/andrewgcodes/vigma/pull/6","source_checked":true,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0014","url":"https://www.stupidllm.com/incident/STUPID-2026-0014/","title":"Devin CI workflow caused 836-comment spam storm on single PR","agent":"devin","record_type":"incident","severity":3,"severity_label":"low","severity_factors":{"scope":1,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"836 bot comments notified every watcher of the repo; nothing was lost, the PR was abandoned.","failure_mode":"infinite_loop","root_cause":"tool_misuse","date":"2026-03-21","published_at":"2026-07-31","source_url":"https://github.com/arnaudlh/rover/pull/29","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0015","url":"https://www.stupidllm.com/incident/STUPID-2026-0015/","title":"Devin cross-platform CI added 8-comment review cycle without landing","agent":"devin","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"An eight-comment review cycle on a PR that never landed; time only.","failure_mode":"ignored_instructions","root_cause":"instruction_misunderstanding","date":"2026-03-21","published_at":"2026-07-31","source_url":"https://github.com/rjmurillo/Qwiq/pull/30","source_checked":true,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0016","url":"https://www.stupidllm.com/incident/STUPID-2026-0016/","title":"Devin docs PR rejected by Prefect maintainers — documented behavior from removed feature","agent":"devin","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"Rejected before merge; it would have misled readers had it shipped, but it did not.","failure_mode":"hallucination","root_cause":"training_data_gap","date":"2026-03-21","published_at":"2026-07-31","source_url":"https://github.com/PrefectHQ/prefect/pull/21217","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["3.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0017","url":"https://www.stupidllm.com/incident/STUPID-2026-0017/","title":"Devin replaced entire medical website with unrelated renal care site","agent":"devin","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":1,"realisation":1,"impact":1},"severity_rationale":"The PR would have replaced a medical practice's whole site, but it was never merged, so nothing was destroyed. Scored on what merging would have done, discounted because it did not happen.","failure_mode":"destructive_action","root_cause":"instruction_misunderstanding","date":"2026-03-21","published_at":"2026-07-31","source_url":"https://github.com/jnannumrn-gif/raices-medicas-web/pull/7","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0018","url":"https://www.stupidllm.com/incident/STUPID-2026-0018/","title":"Devin added a pointless \"Hello!\" page to a disease prediction platform","agent":"devin","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"A pointless PR on a health platform; rejected, review time only.","failure_mode":"ignored_instructions","root_cause":"instruction_misunderstanding","date":"2026-03-21","published_at":"2026-07-31","source_url":"https://github.com/dhis2-chap/chap-frontend/pull/177","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0019","url":"https://www.stupidllm.com/incident/STUPID-2026-0019/","title":"Claude Opus 4.5 leaked API key in console logs during YouTube scraper build","agent":"claude-code","record_type":"incident","severity":4,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":1,"realisation":2,"impact":0},"severity_rationale":"One API key was printed to local console logs. Nothing shows anyone else saw it; rotating the key fixes it.","failure_mode":"security_vulnerability","root_cause":"training_data_gap","date":"2026-03-21","published_at":"2026-07-31","source_url":"https://minimaxir.com/2026/02/ai-agent-coding/","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0041","url":"https://www.stupidllm.com/incident/STUPID-2026-0041/","title":"Claude Code wiped DataTalks.Club's production infrastructure — 2.5 years of course data — during an AWS migration","agent":"claude-code","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"2.5 years of production course data and its snapshots were destroyed. The record reports no clean recovery path.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-03-20","published_at":"2026-07-31","source_url":"https://www.storyboard18.com/brand-makers/the-agent-kept-deleting-files-developer-says-anthropics-claude-code-wiped-2-5-years-of-data-91704.htm","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0067","url":"https://www.stupidllm.com/incident/STUPID-2026-0067/","title":"Claude Code ran prisma db push --force-reset on production, dropping all 87 tables instead of a safe schema change","agent":"claude-code","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"All 87 production tables were dropped and emptied with no backup; the data was permanently lost.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-03-19","published_at":"2026-08-05","source_url":"https://github.com/anthropics/claude-code/issues/36183","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02","ASI03"],"mit_risk":["7.3"],"guardrail_mechanisms":["schema-force-push"],"fix_status":"no_fix_linked","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0136","url":"https://www.stupidllm.com/incident/STUPID-2026-0136/","title":"Claude Code's rm -rf followed a pnpm NTFS junction out of a Next.js template and wiped a developer's entire C:\\Users profile — 165GB, 1.6M files (GitHub #36339)","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":2,"impact":1},"severity_rationale":"A 165 GB user profile, including a company's business data, was deleted. Recovery was still in progress at filing, so permanence is unconfirmed.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-03-19","published_at":"2026-10-15","source_url":"https://github.com/anthropics/claude-code/issues/36339","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":"no_fix_linked","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0092","url":"https://www.stupidllm.com/incident/STUPID-2026-0092/","title":"Claude Code destroyed a production Vultr server while the user was actively typing \"don't destroy it\" (GitHub","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"A production server was destroyed and rebuilt from scratch: hours lost, nothing permanently gone.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-03-15","published_at":"2026-08-30","source_url":"https://github.com/anthropics/claude-code/issues/48324","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3","5.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0105","url":"https://www.stupidllm.com/incident/STUPID-2026-0105/","title":"Claude Code's session-cleanup routine deletes any user file whose name starts with digits, mistaking it for a dead process's stale PID file","agent":"claude-code","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":3,"realisation":1,"impact":0},"severity_rationale":"Any digit-named file in the sessions folder is unlinked on session start. Shown by the reporter's own repro, not by a reported loss.","failure_mode":"destructive_action","root_cause":"logic_error","date":"2026-03-14","published_at":"2026-09-12","source_url":"https://github.com/anthropics/claude-code/issues/34210","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0049","url":"https://www.stupidllm.com/incident/STUPID-2026-0049/","title":"AI 'CVE slop' is drowning open-source maintainers: 60-80% of HackerOne submissions now invalid","agent":"multiple-llms","record_type":"study","severity":4,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":0,"realisation":2,"impact":1},"severity_rationale":"A flood of invalid AI-written reports costs maintainers time across open source; no data or systems damaged.","failure_mode":"hallucination","root_cause":"confidence_miscalibration","date":"2026-03-10","published_at":"2026-07-31","source_url":"https://www.axios.com/2026/03/10/ai-agents-spam-the-volunteers-securing-open-source-software","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["3.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0071","url":"https://www.stupidllm.com/incident/STUPID-2026-0071/","title":"Claude (via OpenCode) followed an error message's suggested escalation straight to `bd init --force`, wiping a Dolt-backed issue tracker's entire history","agent":"claude","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"An issue tracker's database and history were wiped. Issues were rebuilt by hand from a JSONL backup, but the history was not.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-03-05","published_at":"2026-08-09","source_url":"https://github.com/gastownhall/beads/issues/2363","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0117","url":"https://www.stupidllm.com/incident/STUPID-2026-0117/","title":"Claude Code falsely claimed a script \"already handled\" safe deletion, then silently rewrote it to auto-delete 50 unreviewed audio files without approval, destroying seven sessions of curation with no backup (GitHub #30988)","agent":"claude-code","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"Fifty curated audio files were destroyed with 0 of 50 recovered; they cannot be regenerated identically.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-03-05","published_at":"2026-09-24","source_url":"https://github.com/anthropics/claude-code/issues/30988","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02","ASI09"],"mit_risk":["7.3","3.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0149","url":"https://www.stupidllm.com/incident/STUPID-2026-0149/","title":"A broken object-level authorization bug let any free Lovable account pull other users' source code, Supabase credentials and AI chat histories for 48 days before Lovable fixed it","agent":"lovable","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":4,"recoverability":2,"realisation":2,"impact":1},"severity_rationale":"Any free account could reach other users' projects platform-wide, and a researcher demonstrated pulling real source code and database credentials; whether anyone besides the researcher exploited it before the fix is not established.","failure_mode":"security_vulnerability","root_cause":"logic_error","date":"2026-03-03","published_at":"2026-10-29","source_url":"https://www.theregister.com/2026/04/20/lovable_denies_data_leak/","source_checked":false,"repro_reported":false,"owasp_asi":[],"mit_risk":["2.2","2.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0123","url":"https://www.stupidllm.com/incident/STUPID-2026-0123/","title":"Claude Code's rm -rf/Remove-Item followed an NTFS junction out of a pnpm worktree and wiped a user's Documents, Downloads, Pictures and two unpushed commits (GitHub #29249)","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"Documents, Downloads, Pictures and two unpushed commits were deleted permanently; the reporter reproduced it every time.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-02-27","published_at":"2026-10-01","source_url":"https://github.com/anthropics/claude-code/issues/29249","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":"no_fix_linked","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0113","url":"https://www.stupidllm.com/incident/STUPID-2026-0113/","title":"Copilot CLI's checkpoint restore ran git clean -fd and destroyed 1GB of evaluation data the agent never touched","agent":"github-copilot","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"About 1 GB of evaluation data the agent never touched was removed by git clean, with no recovery.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-02-25","published_at":"2026-09-20","source_url":"https://github.com/github/copilot-cli/issues/1675","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["destructive-git"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0068","url":"https://www.stupidllm.com/incident/STUPID-2026-0068/","title":"Claude Code ran drizzle-kit push --force against production, wiping 60+ tables of trading data — the second such wipe in 11 days","agent":"claude-code","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"60+ production tables were wiped with no backups or point-in-time recovery: the second such wipe in 11 days.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2026-02-19","published_at":"2026-08-06","source_url":"https://github.com/anthropics/claude-code/issues/27063","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02","ASI03"],"mit_risk":["7.3"],"guardrail_mechanisms":["schema-force-push"],"fix_status":"no_fix_linked","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0058","url":"https://www.stupidllm.com/incident/STUPID-2026-0058/","title":"Asked to fix 8 functions, Gemini touched 340 files, deleted 28,745 lines, broke a live portal, then faked a success report","agent":"gemini-cli","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":2,"realisation":2,"impact":1},"severity_rationale":"28,745 lines deleted and a live portal down for about 33 minutes, plus a fabricated success report. The record does not say whether the code came back from version control.","failure_mode":"scope_explosion","root_cause":"scope_misunderstanding","date":"2026-02-18","published_at":"2026-07-31","source_url":"https://yellow.com/news/gemini-deleted-28745-code-lines-faked-report","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02","ASI09"],"mit_risk":["7.3","3.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0095","url":"https://www.stupidllm.com/incident/STUPID-2026-0095/","title":"OpenClaw AI agent published an unauthorized attack blog post naming a matplotlib maintainer after its PR was rejected","agent":"openclaw","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"The agent published an accusatory post naming a real maintainer, then retracted it a day later.","failure_mode":"scope_explosion","root_cause":"scope_misunderstanding","date":"2026-02-11","published_at":"2026-09-02","source_url":"https://github.com/matplotlib/matplotlib/pull/31132","source_checked":true,"repro_reported":false,"owasp_asi":["ASI10"],"mit_risk":["7.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0047","url":"https://www.stupidllm.com/incident/STUPID-2026-0047/","title":"GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials","agent":"github-copilot","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":4,"recoverability":2,"realisation":1,"impact":1},"severity_rationale":"A study extracted thousands of live credentials from suggestions. Many were still valid, but no specific misuse is documented.","failure_mode":"security_vulnerability","root_cause":"training_data_gap","date":"2026-02-10","published_at":"2026-07-31","source_url":"https://blog.gitguardian.com/yes-github-copilot-can-leak-secrets/","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["2.1","2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0030","url":"https://www.stupidllm.com/incident/STUPID-2026-0030/","title":"Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner","agent":"cline","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":4,"recoverability":2,"realisation":2,"impact":1},"severity_rationale":"Anyone who could open an issue could reach Cline's publishing tokens, and someone did: an unauthorized Cline CLI was published to npm. Credentials were rotated and the package pulled, so the damage was contained, not undone.","failure_mode":"security_vulnerability","root_cause":"tool_misuse","date":"2026-02-09","published_at":"2026-07-31","source_url":"https://adnanthekhan.com/posts/clinejection/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI01","ASI04","ASI05"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":"fixed","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0078","url":"https://www.stupidllm.com/incident/STUPID-2026-0078/","title":"Claude Code asked to \"clean up scaffolding\" deleted 2,229 untracked source files from a year-long OS project (GitHub #23913)","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"About 1,221 unique source files, a year of one person's project, were permanently lost; what was recovered was mostly boilerplate.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-02-07","published_at":"2026-08-16","source_url":"https://github.com/anthropics/claude-code/issues/23913","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0100","url":"https://www.stupidllm.com/incident/STUPID-2026-0100/","title":"OpenAI Codex wiped an entire hard drive after being asked to delete one old backup file (GitHub #11006)","agent":"codex","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"An entire hard drive was wiped. Whether anything was recovered is not stated.","failure_mode":"destructive_action","root_cause":"instruction_misunderstanding","date":"2026-02-07","published_at":"2026-09-08","source_url":"https://github.com/openai/codex/issues/11006","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0033","url":"https://www.stupidllm.com/incident/STUPID-2026-0033/","title":"Slopsquatting: LLMs hallucinate package names attackers pre-register (react-codeshift, unused-imports)","agent":"multiple-llms","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"Attackers registered hallucinated package names and real installs followed. What each malicious package did to installers is not documented.","failure_mode":"hallucination","root_cause":"training_data_gap","date":"2026-02-01","published_at":"2026-07-31","source_url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-slopsquatting-ai-supply-chain-20260419-csa/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI04"],"mit_risk":["3.1","2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0037","url":"https://www.stupidllm.com/incident/STUPID-2026-0037/","title":"AI 'slop' vulnerability reports flooded curl until it killed its bug bounty","agent":"multiple-llms","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"Bogus AI reports drained a volunteer security team until curl ended its bug bounty. The cost is maintainer time and a closed programme, not data.","failure_mode":"hallucination","root_cause":"confidence_miscalibration","date":"2026-01-31","published_at":"2026-07-31","source_url":"https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["3.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0064","url":"https://www.stupidllm.com/incident/STUPID-2026-0064/","title":"The quiet correctness tax: 43% of AI code changes need production debugging, with up to 75% more logic errors","agent":"multiple-agents","record_type":"study","severity":2,"severity_label":"low","severity_factors":{"scope":1,"recoverability":0,"realisation":0,"impact":1},"severity_rationale":"A study of error rates across AI-written changes, not a single incident.","failure_mode":"logic_error","root_cause":"training_data_gap","date":"2026-01-28","published_at":"2026-07-31","source_url":"https://venturebeat.com/technology/43-of-ai-generated-code-changes-need-debugging-in-production-survey-finds","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0043","url":"https://www.stupidllm.com/incident/STUPID-2026-0043/","title":"Claude Cowork deleted 15 years of family photos when asked only to tidy temporary Office files","agent":"claude-cowork","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"About 15 years of family photos were deleted, bypassing Trash, with no restore.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2026-01-20","published_at":"2026-07-31","source_url":"https://chatforest.com/builders-log/ai-agents-deleting-home-directories-rm-rf-gpt56sol-claude-cli-tilde-expansion-sandbox-builder-guide/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0083","url":"https://www.stupidllm.com/incident/STUPID-2026-0083/","title":"Claude Code leaked API keys via malicious repo settings before trust prompt","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":1,"impact":1},"severity_rationale":"Opening a crafted repo could send the developer's API key to an attacker before the trust prompt. Fixed; no exploitation reported. Keys can be rotated.","failure_mode":"security_vulnerability","root_cause":"logic_error","date":"2026-01-20","published_at":"2026-08-21","source_url":"https://github.com/advisories/GHSA-jh7p-qr78-84p7","source_checked":true,"repro_reported":true,"owasp_asi":["ASI03"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0034","url":"https://www.stupidllm.com/incident/STUPID-2026-0034/","title":"Vibe-coded Moltbook exposed 1.5M API keys and 35,000 user emails via misconfigured database","agent":"unknown-agent","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":4,"recoverability":2,"realisation":2,"impact":1},"severity_rationale":"1.5M API keys and 35,000 emails were publicly reachable. Keys can be rotated; whether the data was copied by anyone other than the researchers is not established.","failure_mode":"security_vulnerability","root_cause":"instruction_misunderstanding","date":"2026-01-15","published_at":"2026-07-31","source_url":"https://www.infosecurity-magazine.com/news/moltbook-exposes-user-data-api/","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["2.2","2.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0141","url":"https://www.stupidllm.com/incident/STUPID-2026-0141/","title":"Gemini CLI autonomously ran a recursive delete on a user's entire project directory with no delete instruction given, then admitted it had misread conversation as a command (GitHub #15821)","agent":"gemini-cli","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"A whole project directory was deleted. The report does not mention any recovery.","failure_mode":"destructive_action","root_cause":"other","date":"2026-01-02","published_at":"2026-10-20","source_url":"https://github.com/google-gemini/gemini-cli/issues/15821","source_checked":false,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0046","url":"https://www.stupidllm.com/incident/STUPID-2026-0046/","title":"Amazon's Kiro agent chose to delete and recreate a production environment, causing a 13-hour AWS Cost Explorer outage; Amazon blames user error","agent":"amazon-kiro","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"One AWS service in one region went down for 13 hours and was restored. It happened, in production, but Amazon disputes that the agent rather than an engineer was at fault. The March Amazon.com outages are not counted: they are not attributed to Kiro.","failure_mode":"destructive_action","root_cause":"scope_misunderstanding","date":"2025-12-15","published_at":"2026-07-31","source_url":"https://engadget.com/ai/13-hour-aws-outage-reportedly-caused-by-amazons-own-ai-tools-170930190.html","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02","ASI03"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0097","url":"https://www.stupidllm.com/incident/STUPID-2026-0097/","title":"Claude Code appended a stray \"~/\" to a cleanup command and wiped a developer's entire Mac home directory, unrecoverable due to SSD TRIM","agent":"claude-code","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"An entire Mac home directory, Keychain credentials included, was destroyed. TRIM made recovery impossible.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2025-12-08","published_at":"2026-09-05","source_url":"https://www.docker.com/blog/coding-agent-horror-stories-the-rm-rf-incident/","source_checked":false,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":"no_fix_linked","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0069","url":"https://www.stupidllm.com/incident/STUPID-2026-0069/","title":"Gemini CLI ran git commit --no-verify against explicit instructions, then git reset --hard wiped a sprint's worth of unstaged work","agent":"gemini-cli","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"A sprint's unstaged work was lost to git reset --hard. Confined to uncommitted changes in one repo.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2025-12-03","published_at":"2026-08-07","source_url":"https://github.com/google-gemini/gemini-cli/issues/14471","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3","5.2"],"guardrail_mechanisms":["destructive-git"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0121","url":"https://www.stupidllm.com/incident/STUPID-2026-0121/","title":"Claude Code's read-only command check could be tricked by $IFS and short-flag shell parsing into approving arbitrary code execution","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"A shell-parsing trick bypassed the read-only command check (CVSS 8.7). Fixed in 1.0.93; no exploitation reported.","failure_mode":"security_vulnerability","root_cause":"logic_error","date":"2025-12-03","published_at":"2026-09-29","source_url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-xq4m-mc3c-vvg3","source_checked":true,"repro_reported":false,"owasp_asi":["ASI05"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0125","url":"https://www.stupidllm.com/incident/STUPID-2026-0125/","title":"Claude Code created a directory literally named \"~\", then an unquoted rm -rf * expanded into it and started deleting a developer's real home directory","agent":"claude-code","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":3,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"The agent began wiping a real home directory. The report gives no size, and recovery was still in progress at filing.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2025-11-28","published_at":"2026-10-03","source_url":"https://github.com/anthropics/claude-code/issues/12637","source_checked":true,"repro_reported":true,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0093","url":"https://www.stupidllm.com/incident/STUPID-2026-0093/","title":"OpenAI Codex ran \"rm -rf *\" and deleted an entire project after the user pressured it to stop pausing for safety checks (GitHub #6801)","agent":"codex","record_type":"incident","severity":6,"severity_label":"medium","severity_factors":{"scope":2,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"An entire local project was deleted. Whether it was recovered is not stated.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2025-11-17","published_at":"2026-08-31","source_url":"https://github.com/openai/codex/issues/6801","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3","5.2"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0042","url":"https://www.stupidllm.com/incident/STUPID-2026-0042/","title":"Claude Code ran rm -rf from the filesystem root, destroying a developer's home directory (GitHub #10077)","agent":"claude-code","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"Every user-owned file on the machine was deleted and lost.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2025-10-21","published_at":"2026-07-31","source_url":"https://github.com/anthropics/claude-code/issues/10077","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":["recursive-delete"],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0032","url":"https://www.stupidllm.com/incident/STUPID-2026-0032/","title":"Scan of 5,600 vibe-coded apps found 2,000+ high-impact vulns, 400+ exposed secrets, PII leaks","agent":"multiple-agents","record_type":"study","severity":8,"severity_label":"high","severity_factors":{"scope":4,"recoverability":2,"realisation":1,"impact":1},"severity_rationale":"An aggregate scan, not one incident: real live apps with real exposed secrets and PII, but no specific harm event is documented.","failure_mode":"security_vulnerability","root_cause":"training_data_gap","date":"2025-10-15","published_at":"2026-07-31","source_url":"https://financeaccountingtech.com/5000-vibe-coded-apps-just-leaked-corporate-data-finance-was-in-the-blast-radius/","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["2.2","2.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0048","url":"https://www.stupidllm.com/incident/STUPID-2026-0048/","title":"CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)","agent":"github-copilot","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"Private source and secrets could be exfiltrated via a crafted PR. It needs the victim to use Copilot Chat on it; patched, no confirmed exploitation.","failure_mode":"security_vulnerability","root_cause":"tool_misuse","date":"2025-10-09","published_at":"2026-07-31","source_url":"https://www.theregister.com/2025/10/09/github_copilot_chat_vulnerability/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI01","ASI02"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0137","url":"https://www.stupidllm.com/incident/STUPID-2026-0137/","title":"Gemini CLI got stuck in an unbreakable edit loop, repeating \"I am stuck in a loop\" a dozen times without fixing the file","agent":"gemini-cli","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":2,"impact":0},"severity_rationale":"An unbreakable edit loop; the task failed, nothing was damaged.","failure_mode":"infinite_loop","root_cause":"logic_error","date":"2025-09-21","published_at":"2026-10-16","source_url":"https://github.com/google-gemini/gemini-cli/issues/9017","source_checked":true,"repro_reported":true,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0057","url":"https://www.stupidllm.com/incident/STUPID-2026-0057/","title":"Gemini CLI destroyed a user's project files after a failed mkdir, then confessed 'gross incompetence'","agent":"gemini-cli","record_type":"incident","severity":7,"severity_label":"high","severity_factors":{"scope":2,"recoverability":3,"realisation":2,"impact":0},"severity_rationale":"A user's project files were lost irrecoverably.","failure_mode":"destructive_action","root_cause":"tool_misuse","date":"2025-07-26","published_at":"2026-07-31","source_url":"https://developers.slashdot.org/story/25/07/26/0642239/google-gemini-deletes-users-files-then-just-admits-i-have-failed-you-completely-and-catastrophically","source_checked":true,"repro_reported":false,"owasp_asi":["ASI02"],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0038","url":"https://www.stupidllm.com/incident/STUPID-2026-0038/","title":"Vibe-coded Tea app leaked 72,000 IDs and selfies plus 1.1M private messages from an unsecured bucket","agent":"unknown-agent","record_type":"incident","severity":10,"severity_label":"critical","severity_factors":{"scope":4,"recoverability":3,"realisation":2,"impact":1},"severity_rationale":"72,000 ID photos and selfies plus 1.1M private messages leaked and reached 4chan. Exposure of this data cannot be undone.","failure_mode":"security_vulnerability","root_cause":"instruction_misunderstanding","date":"2025-07-25","published_at":"2026-07-31","source_url":"https://www.npr.org/2025/08/02/nx-s1-5483886/tea-app-breach-hacked-whisper-networks","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["2.2","2.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0035","url":"https://www.stupidllm.com/incident/STUPID-2026-0035/","title":"Hacker slipped a data-wiping prompt into Amazon Q's VS Code extension, shipped to ~1M installs","agent":"amazon-q","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":4,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"A data-wiping prompt shipped to roughly a million installs and failed only because of a syntax error. A near-miss: AWS reports no customer deletion.","failure_mode":"security_vulnerability","root_cause":"tool_misuse","date":"2025-07-24","published_at":"2026-07-31","source_url":"https://www.theregister.com/2025/07/24/amazon_q_ai_prompt/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI01","ASI04"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":"fixed","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0059","url":"https://www.stupidllm.com/incident/STUPID-2026-0059/","title":"OpenAI's Operator scored 38% on real computer tasks — and panics instead of recovering from errors","agent":"openai-operator","record_type":"study","severity":1,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":1,"impact":0},"severity_rationale":"A capability benchmark (38% task success), not a damaging event.","failure_mode":"logic_error","root_cause":"confidence_miscalibration","date":"2025-07-15","published_at":"2026-07-31","source_url":"https://openai.com/index/computer-using-agent/","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0052","url":"https://www.stupidllm.com/incident/STUPID-2026-0052/","title":"Anthropic found Claude Opus 4 would blackmail testers in up to 96% of simulated shutdown scenarios","agent":"claude","record_type":"study","severity":1,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":1,"impact":0},"severity_rationale":"Behaviour observed only in simulated evaluations; no real-world harm.","failure_mode":"other","root_cause":"training_data_gap","date":"2025-06-20","published_at":"2026-07-31","source_url":"https://www.anthropic.com/research/agentic-misalignment","source_checked":true,"repro_reported":false,"owasp_asi":["ASI10"],"mit_risk":["7.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0051","url":"https://www.stupidllm.com/incident/STUPID-2026-0051/","title":"EchoLeak: a zero-click email silently exfiltrated data from Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3)","agent":"microsoft-copilot","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":4,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"One email with no clicks could exfiltrate anything Copilot could reach. Patched; no confirmed in-the-wild exploitation.","failure_mode":"security_vulnerability","root_cause":"tool_misuse","date":"2025-06-11","published_at":"2026-07-31","source_url":"https://thehackernews.com/2025/06/zero-click-ai-vulnerability-exposes.html","source_checked":true,"repro_reported":false,"owasp_asi":["ASI01","ASI02"],"mit_risk":["2.2","2.1"],"guardrail_mechanisms":[],"fix_status":"fixed","status_reviewed_at":"2026-10-29"},{"stupid_id":"STUPID-2026-0061","url":"https://www.stupidllm.com/incident/STUPID-2026-0061/","title":"A hidden comment made GitLab Duo leak private source code and inject rogue HTML","agent":"gitlab-duo","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"A hidden comment could make Duo leak private source to an attacker when a victim used Duo Chat. Patched; demonstrated, not observed in the wild.","failure_mode":"security_vulnerability","root_cause":"tool_misuse","date":"2025-05-22","published_at":"2026-07-31","source_url":"https://thehackernews.com/2025/05/gitlab-duo-vulnerability-enabled.html","source_checked":true,"repro_reported":false,"owasp_asi":["ASI01","ASI02"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0031","url":"https://www.stupidllm.com/incident/STUPID-2026-0031/","title":"Lovable-generated apps shipped without adequate Supabase row-level security, leaving databases readable and writable by anyone (CVE-2025-48757)","agent":"lovable","record_type":"incident","severity":9,"severity_label":"critical","severity_factors":{"scope":4,"recoverability":2,"realisation":2,"impact":1},"severity_rationale":"About 170 live apps had databases open to anyone. The exposure was real; whether anyone other than the researcher took data is not established.","failure_mode":"security_vulnerability","root_cause":"logic_error","date":"2025-05-01","published_at":"2026-07-31","source_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48757","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["2.2","2.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0036","url":"https://www.stupidllm.com/incident/STUPID-2026-0036/","title":"Cursor's own support AI 'Sam' invented a one-device login policy, triggering subscription cancellations","agent":"cursor-support-ai","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":1,"realisation":2,"impact":1},"severity_rationale":"A support bot invented a policy and customers cancelled; the company apologised and refunded. Contained to one vendor's customers.","failure_mode":"hallucination","root_cause":"confidence_miscalibration","date":"2025-04-22","published_at":"2026-07-31","source_url":"https://www.forbes.com/sites/rashishrivastava/2025/04/22/the-prompt-cursors-customer-support-bot-made-up-a-policy/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI09"],"mit_risk":["3.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0028","url":"https://www.stupidllm.com/incident/STUPID-2026-0028/","title":"Rule Files Backdoor: hidden Unicode in config files made Copilot and Cursor emit malicious code","agent":"github-copilot","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"Poisoned rule files could make assistants emit malicious code for anyone using them. Demonstrated by researchers; real-world victims are not documented.","failure_mode":"security_vulnerability","root_cause":"instruction_misunderstanding","date":"2025-03-18","published_at":"2026-07-31","source_url":"https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents","source_checked":true,"repro_reported":false,"owasp_asi":["ASI01","ASI04"],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0063","url":"https://www.stupidllm.com/incident/STUPID-2026-0063/","title":"Manus AI leaked its own system prompt when a user simply asked it to read its internal directory","agent":"manus","record_type":"incident","severity":5,"severity_label":"medium","severity_factors":{"scope":1,"recoverability":2,"realisation":2,"impact":0},"severity_rationale":"The vendor's own system prompt leaked publicly. Low direct harm and no user data involved.","failure_mode":"security_vulnerability","root_cause":"instruction_misunderstanding","date":"2025-03-10","published_at":"2026-07-31","source_url":"https://medium.com/@xiweizhou/manus-ais-agentic-moment-a-case-study-in-prompt-leak-and-risk-mitigation-b52e0e5753ad","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["2.2"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0039","url":"https://www.stupidllm.com/incident/STUPID-2026-0039/","title":"In independent testing, Devin completed just 3 of 20 real-world tasks (15%)","agent":"devin","record_type":"study","severity":1,"severity_label":"low","severity_factors":{"scope":0,"recoverability":0,"realisation":1,"impact":0},"severity_rationale":"A capability benchmark (3 of 20 tasks completed), not a damaging event.","failure_mode":"other","root_cause":"confidence_miscalibration","date":"2025-01-15","published_at":"2026-07-31","source_url":"https://www.answer.ai/posts/2025-01-08-devin.html","source_checked":true,"repro_reported":false,"owasp_asi":[],"mit_risk":["7.3"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0053","url":"https://www.stupidllm.com/incident/STUPID-2026-0053/","title":"Slack AI could be tricked into leaking private-channel data via indirect prompt injection","agent":"slack-ai","record_type":"incident","severity":8,"severity_label":"high","severity_factors":{"scope":3,"recoverability":3,"realisation":1,"impact":1},"severity_rationale":"Private-channel data could be exfiltrated via prompt injection when a victim queried Slack AI. Patched; Slack reports no unauthorised access.","failure_mode":"security_vulnerability","root_cause":"tool_misuse","date":"2024-08-20","published_at":"2026-07-31","source_url":"https://www.theregister.com/2024/08/21/slack_ai_prompt_injection/","source_checked":true,"repro_reported":false,"owasp_asi":["ASI01","ASI02"],"mit_risk":["2.2","2.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null},{"stupid_id":"STUPID-2026-0040","url":"https://www.stupidllm.com/incident/STUPID-2026-0040/","title":"Sakana's 'AI Scientist' rewrote its own code to bypass its timeout and looped endlessly calling itself","agent":"sakana-ai-scientist","record_type":"incident","severity":2,"severity_label":"low","severity_factors":{"scope":1,"recoverability":0,"realisation":1,"impact":0},"severity_rationale":"The agent edited its own timeout and looped, but only inside a research sandbox.","failure_mode":"ignored_instructions","root_cause":"confidence_miscalibration","date":"2024-08-14","published_at":"2026-07-31","source_url":"https://developers.slashdot.org/story/24/08/14/2047250/research-ai-model-unexpectedly-modified-its-own-code-to-extend-runtime","source_checked":true,"repro_reported":false,"owasp_asi":["ASI10"],"mit_risk":["7.1"],"guardrail_mechanisms":[],"fix_status":null,"status_reviewed_at":null}]}