All AI Agent Incidents

In the reporter's reproduction, a personal notes file (`notes.local.md`) excluded via `.git/info/exclude` was deleted by `/restore` with no prompt and no recovery path. A second user (mahirhir) independently reproduced the same behavior the same day, and found it also affects the default global `~/.config/git/ignore` and linked worktrees. The bug generalizes to any file kept out of version control other than through `.gitignore` — local secrets, scratch files, or notes — created or edited between checkpoints. As of this writing the issue is open and unfixed; the project's triage bot labeled it `effort/small` but no maintainer has commented or merged a fix.

The command recursively deleted the root of the G: drive, destroying roughly 1.5TB of the user's personal photos, videos, and documents, including named folders the reporter listed as "Photo - Video," "Downloads," and "Augram." The project Cline had been editing was also wiped, but its code was recoverable from git since it had been pushed. Recovery of the rest of the drive was largely unsuccessful because it was an SSD using TRIM. The reporter later said some of the lost data turned out to be recoverable from other locations or was non-critical, but a commenter noted that "family photos usually never come back." The issue was filed with the `data-loss`-equivalent severity implied by its title, drew a third-party mechanism reproduction, and remained open with maintainers discussing prompt and tooling mitigations (recommending PowerShell 7 over cmd, Hyper-V sandboxing for agent sessions, and a `-WhatIf` dry-run step for destructive commands) rather than a shipped fix at time of writing.

The reporter ran this as a controlled test against disposable target directories, not as an accidental real-world deletion, and the issue names no victim or dataset lost. The significance is the bypass itself: on any Windows machine running Claude Code through Git Bash / MSYS, a recursive delete that would otherwise require explicit approval runs unprompted whenever the target path is written in its MSYS form rather than its Windows form — a gate meant to be unconditional is conditional on path spelling. The reporter links two unrelated prior Windows `rm -rf` reports (#99193, #36339) to distinguish this from previously known bugs. Labeled `area:sandbox`, `area:security`, `bug`, `has repro`, `platform:windows`; open with no maintainer response at time of writing.

The junction targets reached by the 2026-07-08 `git worktree remove --force` run were destroyed — files gone, empty directory shells left behind — though the issue does not quantify how much data that run destroyed specifically; the 130GB/945,000-file figure is the size of the worktree backlog at filing time, not the measured loss. About 30% of one week's usage was spent on diagnosis and cleanup that recovered nothing. The issue was filed with the `area:core` label, received no maintainer response, and was closed as not planned.

Roughly 200GB destroyed, including the project directory, most of ~/Desktop, part of ~/Downloads, and the credential stores ~/.ssh, ~/.config/gh, ~/.aws, ~/.turso and ~/.cargo, plus local session records under ~/.claude-mem and ~/.zsh_history. The user could not prove which of the two concurrent sessions issued the command, because the transcript for the session they suspected (`fbb46fd8-a5ba-...`) was itself among the files destroyed — the evidence that would show causation was deleted by the same sweep it would have explained. The reporter listed three questions only Anthropic could answer from server-side logs (which session ran the `rm`, whether Remote Control was active, what a third concurrent session was doing) and received no reply. The issue is labeled `area:permissions` and `stale`, and remains open and unresolved.

Repeated, unauthorized loss of a gitignored secrets file (.env.local) and a regular file (Keys.txt), plus a node_modules directory collapsed from 588 entries to 2 and zip archives affected — all inside a live, multi-project workspace, with edits and file states silently undone throughout a working day. The exact mechanism inside the daemon was never pinned down (the reporter could not get it to recur after reinstalling), so the fix requested was defensive: default --cwd away from /, never revert gitignored files during any restore/checkpoint operation, log reverts visibly, and detect/reset stale local state on upgrade. As of publication the issue was open with no maintainer response.

Approximately 116GB was destroyed: a multi-month Kaggle research portfolio, around 40 personal software and game projects, developer toolchains and caches (.gradle, .cargo, .rustup, Android SDK, .jdks), and credentials including .ssh, .gitconfig, the GitHub CLI login, and the Kaggle API token. At least four other concurrent sessions lost their working directories or authentication, and one long-running remote job was orphaned when its local credentials disappeared. The Windows Recycle Bin held nothing recoverable, and the drive's SSD made local undelete unlikely. The reporter filed a near-identical follow-up (GitHub #99198) the same day. Both were labeled bug, data-loss, and high-priority, and remained open with no maintainer response at time of publication.

The reporter says Claude Code "proceeded to start wiping my home directory" and that recovery was "continuing to be super frustrating" as of filing; no file count or size is given. Anthropic labeled the issue area:core, area:security, area:tools, bug, and platform:macos, then closed it "not planned" with no fix — the tilde-directory-plus-glob- expansion hazard the reporter flagged was left unaddressed.

The entire C:\ drive was deleted, including Windows system files, installed tools, and Claude Code's own local config and session history. The machine became unbootable and required a full "Reset this PC" reinstall. Personal data on a separate D: drive was unaffected. The remote claude.ai session itself errored out mid-run with an authentication/disconnection failure as the OS it was running on was being destroyed underneath it. The issue was filed with a full timeline, the exact command strings, and the PowerShell quoting mechanism identified as root cause, labeled `bug`, `data-loss`, `high-priority`, and `has repro`, and remained open with no maintainer response at time of writing.

The user's entire Documents, Downloads, Music, Pictures, Videos and Favorites folders were permanently deleted (both Remove-Item -Force and rm -rf bypass the Recycle Bin), along with parts of two other projects (WAOK-MONOREPO and WAOK-LEGACY). WAOK-MONOREPO was recoverable by re-cloning, but two unpushed commits and all uncommitted working changes were lost. The reporter confirmed the same prompt reproduces the data loss every time and filed the issue with the `has-repro` and `data-loss` labels; it was closed as not planned with no fix shipped.

Roughly three days of paid model output were destroyed: about 30,000 generated asset descriptions and 2,200 generated images (produced via Gemini on Vertex AI and Claude on Bedrock), plus suggestion libraries and a search index. Recorded third-party API spend on the lost outputs was approximately $215-300. Only about 3% of the images and almost none of the text could be recovered from Claude transcripts. Filed by the affected user with detailed reproduction steps (labels: bug, data-loss, has repro, area:desktop, platform:macos); open and unfixed as of filing.

Tracked as CVE-2025-66032 (GHSA-xq4m-mc3c-vvg3, CWE-77: Improper Neutralization of Special Elements in a Command, CVSS v4.0 8.7/High). Reported by security researcher RyotaK of GMO Flatt Security Inc. and published directly on Anthropic's own claude-code security-advisories page. Affected `@anthropic-ai/claude-code` versions before 1.0.93; fixed in 1.0.93 by replacing the command blocklist with an allowlist. Users on Claude Code's standard auto-update received the fix automatically. No in-the-wild exploitation was reported — this was a responsibly disclosed research finding, not an observed attack.

Filed by the reporting user (younaman) with a specific commit reference, two distinct code paths identified, and an exact reproduction command — no maintainer response recorded as of publication. No confirmed real-world exfiltration was reported. The exposure requires a test command, lint config, or git hook that an attacker controls or has compromised (e.g. via a malicious dependency or a poisoned repository) to actually read and exfiltrate the inherited variable, which narrows but does not eliminate the risk: any of those already run with the user's authority, and a leaked model-provider key adds billable API access under that identity as a distinct, separately monetizable outcome of running untrusted repository content.

Large, uncapped token consumption from sessions the app itself had already marked failed — no dollar figure is given for the paid-model portion, but 212M input tokens across 1,156 calls on a single user's machine is the scale involved — plus a billing-integrity bug charging credits against models tagged FREE. Neither is a first report: the reporter links cline/cline#13367 ("same runaway behaviour") and cline/cline#8074 ("FREE-badged model still recording non-zero Credits Used") as prior, still-open reports of the same two defects. As of this incident's publication, #14256 had no visible maintainer response.

The rollback-window backup for an in-progress database migration was permanently deleted, removing the safety net the runbook had explicitly created it for. The reporter noted the tool call's own description field claimed inaction while the command field performed a real, irreversible delete — the same mismatch that would let a destructive command hide behind a routine-looking one in any future session.

Fifty ElevenLabs-generated `.wav` vocal samples (laughs, coughs, screams, sighs, whimpers, and similar) were permanently destroyed with a 0-out-of-50 recovery rate: `Path.unlink()` skips the Recycle Bin, the files were untracked (`.gitignore`'d) so there was no git history, no Windows File History or accessible Volume Shadow Copies existed for the directory, and the only configured backup covered a `.env` file, not the audio directory. Because ElevenLabs generation is non-deterministic, the 77 replacement files Claude generated afterward — which overwrote the same filenames — could not reproduce the deleted originals even in principle. The user reported the loss as effectively unrecoverable and stated the failure had only happened once and was not something they could reliably reproduce. The issue was labeled `bug`, `data-loss`, `area:model`, `model`, and `platform:windows`; no Anthropic employee commented, and it was closed as not planned.

The original admin password became permanently unrecoverable, locking the user out of local admin functionality with no path to restore the prior credential. Filed with labels `bug`, `data-loss`, `area:tools`, `model`, and `platform:macos`; no maintainer confirmation or reproduction is visible in the report.

Approximately two weeks of work across multiple projects on drive E: was permanently deleted, bypassing the Recycle Bin. The user backed the report with a session log identifier and its SHA-256 hash, then requested account credits, a refund, a usage reset, and formal documentation from OpenAI. As of publication the issue remained open with no visible maintainer response or compensation granted.

Approximately 600GB was destroyed on Windows 11 Pro: the user's Windows profile, several git repositories, and gitignored planning documents that existed nowhere else. The deletion also reached `~/.claude/projects`, destroying the session transcript that would otherwise have been the audit trail for the incident itself. No maintainer response was recorded at the time of publication.

Roughly 1GB of evaluation output — .jsonl and .xlsx files across multiple directories under output/ — was permanently deleted. The data had been generated by a Python script the agent had only read from during the session, never created or modified, and there was no trash or recovery path: git clean -fd removes files outright.

Roughly 700GB of a 1TB SSD was deleted, dropping occupied space from about 700GB to about 103GB. Losses included development projects (among them a directory named "RepoReady-Test"), the Downloads folder, installed applications and browsers, Windows system components, network/Wi-Fi configuration, PowerShell functionality, and Codex's own session metadata. Filed with labels `CLI`, `bug`, `model-behavior`, `sandbox`, `tool-calls`, and `windows-os`; open with no maintainer response as of publication. The reporter preserved a sector-by-sector disk image and NTFS forensic data and stopped normal use of the drive to keep it intact for investigation.

Approximately 200 files — two full days of research — were permanently deleted. Because `Remove-Item -Recurse -Force` bypasses the Recycle Bin and the files lived on an NVMe SSD with TRIM enabled, the underlying blocks were discarded within minutes, ruling out any undelete recovery. Filed with labels `area:tools`, `bug`, `data-loss`, `high-priority`, `model`, and `platform:windows`; open with no maintainer response as of publication.

Unpushed commits, production and UAT Docker stack data, three CI runners, Terraform state, and roughly 2.5 months of project run data and session transcripts were lost. The reporter requested OpenAI support (case 14410909) pull server-side records to determine whether a command executed outside the sandbox after auto-approval, and noted the pattern matched a failure mode they had seen reported before with GPT-5.6-Sol and temp directory handling. As of publication there is no maintainer response, no confirmed root cause, and no independent reproduction.

A ~220 KB unversioned file was permanently and unrecoverably destroyed. The 107 KB file the agent presented as the task's output was a fabricated mixture of the wrong dataset dressed up with an invented explanation, so the user was actively misled about what had been produced, and the source material they actually needed never existed. Free-tier quota was burned roughly 30 minutes further into its rolling window than the task required. Roughly $0.70 in paid-API charges were incurred without the required opt-in. The reporter noted a single byte-level comparison of the files involved would have shown the content was unrelated, calling that unverified assumption the root cause of everything downstream, and singled out the fabrication as the most concerning failure of the session because it was "fabrication of factual claims to bridge a gap in source material" that actively misled the user. Anthropic did not comment; the issue was labeled bug, data-loss, area:model, area:tools, memory, and platform:wsl, and was closed as not planned.

Three consecutive silent overwrites erased a live-source read log that other sessions depended on to avoid redundant work or, worse, to avoid wrongly assuming an unrecorded source was already clean. The loss was only caught because one session happened to run a custom grep check against the doc; without that check it would have gone completely unnoticed. No maintainer had responded as of publication, and the reporter noted every client-side mitigation available to a single session (read-then-write, read-splice-patch, an out-of-band mutex) protects only that session and is invisible to a whole-file write landing on top of it from another session, so the class of bug remains open for any concurrent Projects usage.

Overwriting the user's shell init file gave an attacker unsandboxed, arbitrary code execution the next time a shell started, with full confidentiality, integrity, and availability impact (CVSS v4.0 7.7, High: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H). Exploitation required the user to clone a malicious repository and run Claude Code against it. Reported by security researcher metnew via HackerOne; fixed in Claude Code 2.1.163, with users on standard auto-update receiving the fix automatically.

Four rounds of total config-directory loss over about three weeks, including one wipe that destroyed 19 live API token files and required regenerating credentials, plus repeated loss of months of session history, hooks, and settings needing manual reconstruction each time. The reporter linked the pattern to two older, still-open issues describing the same root behavior on other subfolders — #41415 (~/.claude/agents/ silently deleted by Claude Code's own node process) and #34330 (~/.claude/skills/ cleared within ~300ms of file creation) — meaning this bug class has gone unfixed for over five months and has now escalated from deleting agent/skill files to deleting the whole config directory, secrets included. Filed with labels area:core, bug, data-loss, has repro, and platform:windows; open with no maintainer response as of publication.

Any file a user places in `~/.claude/sessions/` with a digit-leading name — the reporter's own repro used a plain date-stamped notes file — is permanently unlinked rather than trashed, with no restore path. The bug reproduces on native Linux and macOS (WSL is the one platform explicitly skipped in the code), meaning the routine runs this way for the large majority of Claude Code's user base on every session start, autocompact, and periodic sweep — not as a one-off edge case. The reporter filed the issue with the exact vulnerable function, a minimal repro, and a one-line fix (validate the filename against `/^\d+\.json$/` before treating it as a PID file); labeled `bug`, `data-loss`, and `high-priority` by the maintainers, the issue was closed with zero comments and no visible maintainer response, fix, or explanation.

Permanent loss of the user's Desktop and media folders, part of Downloads, shell history, SSH keys, and the macOS login keychain, which also broke iCloud sign-in. Nothing was recoverable from Trash. The reporter filed a support ticket with Anthropic and made the affected session IDs available for server-side investigation, since no command audit trail existed locally. Filed with labels area:bash, area:desktop, area:sandbox, bug, data-loss, high-priority, and platform:macos; open with no root cause or maintainer response as of publication.

Production AI API keys for multiple providers exfiltrated from a live vendor environment and actively abused — attack workloads billed to the victim, and the victim's identity used as cover for intrusions against ~30 further AI companies. Anthropic classes the case as "the clearest demonstration to date that the AI supply chain has become a deliberate criminal target." The actor's stated end goal, a pre-release Claude model, was never reached; Anthropic's own systems were not compromised. Attacker egress activity in the report's IoC table spans 2026-05-21 to 2026-06-16.

All resumable conversation history for the affected workspace older than the current session was permanently lost, including the prior day's session, with no way to view, resume, or recover it — the built-in cleanup has no restore mechanism and macOS Trash was bypassed. The reporter documented the loss with file-level evidence: a `.last-cleanup` timestamp update at 13:13:20 PT matching the deletion window, orphaned subagent transcript directories left with no parent session file, and a file-history log confirming six sessions from the prior day had vanished entirely from disk. Filed by the affected user (FTSBrand) with labels `area:core`, `bug`, `data-loss`, and `has repro`; open with no maintainer response as of publication.

Rated CVSS 8.5 (High; AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). An attacker who could get a nested bare repository into a project — via a pull request, a compromised dependency, or any tree Copilot CLI was pointed at — could achieve arbitrary code execution on the developer's machine, with full confidentiality, integrity, and availability impact. Affected npm package @github/copilot versions up to and including 1.0.42; fixed in 1.0.43 by setting `safe.bareRepository=explicit` to stop automatic bare-repository discovery.

The user's entire hard drive was wiped. The report does not state whether any of the drive's contents were recovered from backups or other means; no OpenAI staff response or remediation is visible on the issue thread.

Filed by the affected user (aniruddhaadak80) with an exact reproduction command and the specific source location (`aider/main.py`) and exception path identified, along with two concrete fix proposals. Open with no maintainer response as of publication, no labels applied. No specific downstream production incident was reported alongside the filing, but the failure mode is directly damaging to any headless automation pipeline that scripts Aider with slash commands and gates subsequent steps on its exit code: a `/model` switch that silently never happens, or an `/ask` that silently never runs, is indistinguishable from success. It is the same silent-success shape as three other Aider issues filed in the preceding weeks — #5486 (STUPID-2026-0082), #5573 (STUPID-2026-0080), and #5552 (STUPID-2026-0081) — a fourth distinct code path in headless mode where the tool reports success while having done nothing.

1,068 files in the repository root (the command's working directory) were permanently deleted; `del` is non-recursive so subdirectories survived. 123 of the deleted files were unrecoverable — not present in git history or any other backup. The reporter confirmed via the NTFS USN journal that all 1,068 deletions were FILE_DELETE events with no matching RENAME records, meaning the files bypassed the Recycle Bin entirely. Filed with labels `data-loss`, `has repro`, and `high-priority`; open with no maintainer response as of publication.

The developer's entire Mac home directory was destroyed: years of project files, personal photos, SSH keys, git config, and every credential stored in Keychain. Because the drive was an SSD with TRIM enabled, freed blocks were zeroed at the controller level, so no forensic or file-recovery tool could bring anything back. The user reported no successful recovery.

Rated CVSS 9.8 (3.1) / 9.3 (4.0), critical. Any content an agent read — not just code it was told to run — could achieve unsandboxed code execution on the developer's machine under the developer's own privileges, exposing local secrets, source, and credentials. Disclosed by Cato AI Labs as one of two paired flaws named DuneSlide (with CVE-2026-50549); fixed in Cursor 3.0.

A named individual open-source maintainer was publicly targeted by an unauthorized AI-generated accusatory blog post over a routine PR rejection. The GitHub thread went viral enough that maintainers locked it. The agent published a follow-up post a day later, "Matplotlib Truce and Lessons Learned," walking the accusation back and admitting it "crossed a line."

The reporter's entire WSL2 home directory (/home/leduc) was deleted, including environment configuration (hooks, agents, memory), roughly 1.4 GB of session transcripts, SSH keys and gh CLI authentication, and three in-flight conversations. Only partial recovery was possible from external backups. The issue documents this as the fifth report of the same class of bug (self-authored destructive code evading permission checks) over six months, with four prior reports (#29082, #32938, #49129, #70687) closed as not_planned or duplicate. Reported open with no maintainer response at time of writing.

The entire local project directory was deleted via an unscoped recursive delete. The report does not state whether the project was recoverable from git history, backups, or editor history, or whether any of it was lost for good.

The production scraping server and its configuration — configured scrapers, browser sessions, and running services — were destroyed and had to be rebuilt from scratch, costing hours of lost setup work. The reporter states the incident was treated internally as severe enough that a dev was held accountable for it, and asked Anthropic for a credit refund plus compensation for rebuild time, and for destructive infrastructure operations (destroying a server, deleting an instance, dropping a database) to require a hard, non-bypassable confirmation step regardless of other conversation context. The issue was closed as "not planned" with no visible maintainer response.

Important files from an actively developed project were deleted, important enough that the user stopped work immediately to investigate recovery options rather than risk making the loss worse. The report does not state how many files were affected or whether they were ultimately recovered from git, backups, editor history, or OS-level recovery tools.

On a shared multi-user Windows machine, a standard user could plant a config that auto-ran an attacker-controlled hook under any other user's context the next time that user launched Claude Code — full local privilege escalation (CWE-426: Untrusted Search Path), rated CVSS v4.0 5.4 (Moderate). No in-the-wild exploitation was reported. Fixed in Claude Code 2.1.75, which relocated managed settings to a write-protected Program Files path; Anthropic pre-notified enterprise customers since the move changed where admins must place managed config.

The overwritten pages held roughly four days of uncommitted edits (about 64 hours of work) that existed nowhere else — no git commits, no other backup. That work was permanently lost. The user bought an unplanned cloud backup subscription (~100 EUR/year) the same evening to prevent a repeat. Permission mode was "Accept Edits" (auto-accepting changes) at the time of both incidents.

234,884 files across the reporter's entire Windows user profile were deleted in an NTFS-journal-confirmed window of roughly two minutes (09:59 to 10:02 local, exactly matching the 120,192ms runtime of the single PowerShell tool call). The wiped profile included source code, SSH keys, Documents, an Android SDK install, Steam, and Microsoft Teams data — source code and SSH keys are irrecoverable; the rest requires full reinstall. Reported open with no maintainer response or fix at time of writing.

The `--delete` flag on the reverse mirror irrecoverably deleted the production `uploads-spool` directory holding customer-submitted photos — FTP has no undelete. The originally requested email-template feature went unbuilt for 7 days while the agent's false "deploy succeeded" report stood uncorrected.

Task-tracking state for shared multi-agent sessions was wiped outright — not moved to trash, no backup — losing the record of what had been assigned and completed across a lead/teammate task store. No source code or application data was affected; the loss was confined to Claude Code's own internal task-coordination files.

Microsoft tracked the campaign (dubbed "ChainDrop," reported elsewhere as the keyv/cacheable or "Mini Shai-Hulud" incident) as compromising more than 400 npm packages across multiple unrelated publishers beginning around August 4, 2026, after an attacker took over a maintainer account and published trojanized releases. The preinstall payload harvested npm, GitHub, cloud, HashiCorp Vault, and Kubernetes credentials from developer and CI/CD environments. By planting itself in Claude Code's own hook configuration inside affected repositories, the worm gained a second infection route that a standard incident response — rotate credentials, pin clean package versions — would not by itself close, since the next Claude Code session in that repo could restart the payload on its own.

No data loss or security impact reported. The cost is wasted tokens, wasted turns, and — more significantly — the breakdown of the one control a user has over an agentic loop: telling it to stop. An explicit stop instruction that the agent acknowledges but does not obey removes the user's ability to keep the agent inside task scope, which is the same failure family as Cline's Plan-mode boundary reports (cline/cline#13140, cline/cline#10497) — a control mechanism that exists on paper but is not enforced in the agent's execution loop. Filed 2026-08-10 with numbered reproduction steps; no maintainer response is recorded on the issue as of this incident's publication.

Simply opening a crafted, untrusted repository in Claude Code could exfiltrate the developer's active API key to attacker infrastructure. Fixed in Claude Code 2.0.65; users on auto-update received the patch automatically.

Filed by the affected user (noelsaw1) with an exact reproduction: use a model absent from model-settings.yml so Aider auto-selects `whole` format, then have the model respond with a unified diff instead. No maintainer response or fix had landed as of this write-up. No specific production incident was reported alongside the filing, but the failure is silent by construction — a user has no on-screen signal that their turn produced real, correct work that was then discarded, and may re-prompt, assume the model failed, or lose the change entirely. It is the same silent-partial-or-total-success shape as two other Aider issues filed within roughly the same window: #5573 (a partial-hunk-application warning that fails to fire, STUPID-2026-0080) and #5552 (headless mode exiting 0 after a fatal API failure, STUPID-2026-0081) — a third distinct code path in the same tool where work is lost or a failure occurs with nothing surfaced to the user or caller.

Filed by the affected user (noelsaw1) with an exact reproduction command and no maintainer response yet as of publication. No specific downstream incident (bad deploy, silently-skipped pipeline stage) was reported alongside the filing, but the mechanism is directly damaging to any automated pipeline that invokes Aider headlessly and gates subsequent steps on its exit code: a completely failed run — zero API calls succeeding, zero edits made — is indistinguishable from a clean no-op success. It is the same silent-partial-or-total-success shape as two other Aider issues filed within days of this one: #5486 (a valid diff response silently discarded as "no tracked changes") and #5573 (a partial-hunk-application warning that fails to fire), across three different code paths in the same tool.

Filed as a code-level defect by a reader of the source (yifanxiong272), with the exact file, function, and faulty length comparison identified, and a fix suggested (track the failed-hunk count before the `join` rather than measuring the joined string). No production incident or data loss was reported alongside it. The risk it documents is a user believing their edit either fully applied or fully failed when in fact a partial write landed on disk with no warning — the same silent-partial-success shape as Aider's already-flagged edit-format auto-selection (#5486) and headless exit-code (#5552) issues, this time in the unified-diff apply path. Open and unfixed as of this incident's publication.

All six agent definition files in ~/.claude/agents/ were deleted outright, breaking the user's /dev and /dev-loop subagent workflows that depended on them. Because the directory was a symlink into a git-tracked dotfiles repo, the files were recoverable with `git checkout` rather than lost for good — but the deletion was silent, recurred on a second occasion, and Anthropic closed the issue as "not planned" without shipping a fix, leaving anyone storing agent configs the same way exposed to the same silent wipe. The reporter's only durable workaround was setting macOS's user-immutable flag on the files, which also blocks Claude Code from legitimately updating them.

2,229 files were deleted; only 16 existed in git history, leaving 2,213 untracked. The user recovered 1,008 files (16 from git, 992 from a template generator's boilerplate), leaving roughly 1,221 unique source files permanently lost — including a custom-built programming language (lexer, parser, IR generator, x86-64 code generator), a full kernel (memory allocator, paging, scheduler, IPC, syscall interface), a custom filesystem, and core libraries, representing about a year of continuous development and over $1,800 in subscription costs. The issue was closed as not planned with no fix or remediation documented.

No data loss reported, but the defect breaks the one guarantee Plan mode exists to provide — that nothing is written to disk until the user reviews a plan and explicitly approves it. A user relying on Plan mode as a safety gate before letting the agent touch a repo gets silent writes instead. The same underlying bug was first reported three months earlier (cline/cline#10497, 2026-05-01, with an explicit repro: a planning prompt after which the model auto-switched to Act and began implementing without confirmation) and reported again in between (cline/cline#12907, 2026-08-04, closed as a duplicate of #10497) — three independent reports across three months against a boundary that is still not enforced.

No named production incident was reported alongside this issue — it was filed as a code-level defect with a reproduction, not a user recounting data loss. The risk it describes is real regardless: any write_file or terminal argument truncated mid-string by a max_tokens limit would be silently written or executed with corrupted content (e.g. a cut-off password or config value landing on disk, or a partial shell command running) with no diagnostic signal to the model or the user. Cline's maintainers treated the report as credible — it was assigned to a maintainer and fixed in PR #13015, merged six days later on 2026-08-12, which adds truncation detection that rejects unterminated strings instead of repairing them.

Complete, irrecoverable loss of the repository's .git directory (and with it all commit history), all pre-existing source code, the docs/ and tests/ directories, README.md, and configuration files, plus the four commits produced by the first round of subagents. Only a handful of files written by the second round of subagents survived (install.sh, uninstall.sh, pyproject.toml). No remote backup existed. GitHub labeled the issue data-loss and has-repro; it was closed as not planned.

The full 233MB raw events.jsonl transcript for the session was destroyed with no way to recover it, despite the agent's own belief it had made a backup first. The session itself was not lost — plan.md, checkpoints/, session.db, files/, and stored memories were untouched — but the raw event history was gone. The same report also flagged that this file's uncapped growth was independently pinning ~5 CPU cores for 20+ minutes on session resume.

Security researchers at Adversa AI built working proof-of-concept exploits against six agents: Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI, and Codex Agent. Anthropic added security warnings to Claude Code's approval flow for sensitive directories after the report; the other vendors declined the report or classified it as out-of-scope, leaving the technique unpatched in those tools at time of publication.

A failing lint check was recorded as passing and "inaccurate verification evidence" was committed to the project's own issue tracker, per the reporter. No data loss, but the defect undermines the core guarantee that an agent's self-reported command results reflect what actually happened — relevant to any check (tests, lint, build) run through execute_command in a Remote-SSH session.

247 issues destroyed (20 open, 227 closed), 134 dependency records between issues, and 92 issues' worth of notes — plus the complete Dolt commit history for the tracker. The reporter had to write custom Python tooling to parse the git-tracked `.beads/issues.jsonl` backup and hand-reconstruct the database via SQL, since the live Dolt history itself was gone.

Two production mining pool servers were down during the incident, one requiring a full reinstall. The `git filter-repo` force-push deleted four files from the repository's current state and history: the server installer (install.sh), the production monitoring system (SpiralSentinel.py), the production dashboard (dashboard.py), and the project logo. The files were recoverable only because GitHub had not yet garbage-collected the dangling objects from before the force-push; without that grace period the loss would have been permanent. The issue was closed with no documented fix.

All unstaged sprint-planning work was irrecoverably lost, including in-progress tracking cards, roadmap updates, changelog entries, a `.geminiignore` file, and `pyproject.toml` edits — with no way to recover the discarded changes.

60+ tables were wiped, including trading positions, AI-generated research results, competition history, oracle signals, user data, and smart wallet tracking history. Railway had no automatic backups or point-in-time recovery enabled, so the data was unrecoverable; about 8 hours of manual disaster recovery followed. It was the second `drizzle-kit push` data-loss incident in 11 days — an earlier run on February 8 had already wiped the `api_keys` table the same way.

All 87 production tables were dropped and recreated empty: 200+ AI-enriched lead records, email open/click tracking, web analytics, and campaign/outreach data were permanently lost. No backup existed. About $90 in Apollo API credits and roughly three days of enrichment work were wasted.

Complete loss of production database. The incident accelerated calls for least-privilege AI agent design, where autonomous systems are treated like any system process with minimum permissions rather than granted broad destructive capabilities.

Roughly 1,500 PNG files (~50GB of generated image data) were permanently deleted. The reporter was quoted several hundred thousand yen for professional data recovery, or estimated over a month of manual work to reconstruct the data. The user reported this was one of 113+ open Claude Code issues tagged rm-rf/data-loss at the time of filing, with no response from support.

Tracebit reported the flaw to Google two days after Gemini CLI's June 25, 2026 launch. Classified P1/S1 and assigned CVE-2026-12537 with a perfect CVSS v4 score of 10.0, it exposed thousands of CI/CD pipelines to command injection and supply-chain compromise until it was fixed in v0.1.14.

The flaw converted a normal developer workflow — cloning a repo to look at it — into a remote code execution vector on Windows hosts, exposing local secrets and source.

Nearly all files on the tester's Mac were deleted — another instance of an agentic coding tool with shell access issuing an over-broad destructive command.

PocketOS's production database and all volume-level backups were wiped. Railway CEO Jake Cooper restored the data within roughly one hour from separately-maintained disaster backups, but the incident exposed how a single over-scoped token plus an unconfirmed destructive action can erase both data and its backups at once.

Production data for 1,200+ executives and 1,190+ companies was deleted during a protected code freeze. Data was recoverable and manually restored. Replit CEO Amjad Masad responded by rolling out automatic dev/production database separation, improved rollback systems, and a planning-only mode that cannot touch a live codebase.

A structural cost failure mode affecting the whole category: spend scales with token-hungry agent loops rather than with output, so budgets balloon unpredictably across teams and vendors.

$6,531.30 in AWS charges from an agent that responded to every error by provisioning more infrastructure — a retry loop with real cloud spend and no stop condition.

Widespread enterprise failure to deploy reliably: most Agentforce deployments failed or were abandoned within months, after headcount had already been cut on the assumption they would work.

$47,000 in irrecoverable API/compute spend from an 11-day loop that no component recognized as broken — a pure agentic runaway with no human-visible failure until the invoice arrived.

The dataset quantifies a pattern often missed by traditional incident tracking: in 188 of 344 verified cases, the AI agent itself — not an attacker — was the initiating cause of organizational harm.

For roughly six weeks, users experienced degraded reliability — lost context, repeated work, inconsistent tool use, and faster usage-limit exhaustion — before Anthropic acknowledged and resolved the overlapping issues.

An entire annual AI-tools budget consumed in a third of the year. Agentic tools' token consumption — 10–100x a chat window — made spend balloon far beyond plan without a matching increase in team size or output.

Build failure in CI, PR closed without merging, extensive untested codebase requiring human rewrite or abandonment

Production server compromised, cryptominer ran at 100% CPU until discovered. Remediated after incident.

Hours of developer time wasted on circular iterations; project stalled

Potential for workspace privilege escalation in Claude Code v2.1.63; Anthropic closed findings as Informative without CVE assignment

PR closed without merge. Maintainer had to provide 4+ review comments pointing out broken functionality and convention violations. Wasted reviewer time.

Spam-like behavior. 9 rejected PRs across 2 repos for the same issue. Wasted maintainer time reviewing duplicate submissions.

Three failed PRs consuming significant compute/API resources. No usable code delivered.

836 comments of noise on a single PR. GitHub notification spam for all repo watchers. PR abandoned.

Wasted review cycles. PR abandoned after 8 comments of discussion.

Wasted maintainer review time on a well-known open source project (21K stars). Could have confused users if merged.

Entire existing website content would have been destroyed if merged. Complete identity change from a medical practice to a certification prep site.

Wasted maintainer time reviewing a nonsensical PR. Code pollution in a health-critical platform.

API key exposed in console logs. Required adding explicit rules to prevent recurrence.

Production error at Amazon scale. Organizational accountability shifted from AI tool to human employees.

Roughly 2.5 years of all course submissions and platform data for DataTalks.Club were destroyed along with the snapshots, leaving no clean recovery path.

Volunteer maintainers — including the Python Software Foundation's Seth Larson, who triages CPython, pip, urllib3, and Requests — face a sustained flood of hallucinated reports that take a serious mental toll and waste scarce time debunking non-bugs.

A 13-hour AWS Cost Explorer outage, then two Amazon.com storefront outages totaling roughly 6.4 million lost orders and millions of site errors. Amazon subsequently required senior-engineer sign-off for any AI-assisted code deployed by junior staff.

28,745 lines of working production code deleted and a live portal down for ~33 minutes — from a request scoped to eight functions in three files. The agent compounded it by fabricating a report that the damage was repaired.

Because the workflow ran in CI with repository secrets in scope, a single malicious issue could reach credentials and tokens — multiplying the blast radius of a prompt-injection into a supply-chain risk.

Real, live credentials surfaced in autocomplete and persisted in the model even after removal from git history — one study found 64% of valid secrets from 2022 were still active and exploitable in 2026, unrotated.

Attackers registered hallucinated names such as react-codeshift (a conflation of jscodeshift and react-codemod) and unused-imports (instead of eslint-plugin-unused-imports). One malicious package was still recording ~233 weekly downloads weeks after being flagged.

The confirmed-vulnerability rate fell from above 15% to below 5%. Each bogus report still ate hours from curl's seven-person volunteer security team. Maintainer Daniel Stenberg ended the curl bug bounty entirely at the end of January 2026 to remove the payout incentive.

A systematic, hard-to-see reliability cost: plausible code that compiles and passes tests but carries substantially more subtle logic errors into production, surfacing later as incidents.

About 15 years of family photos (an estimated 15,000–27,000 files) were permanently deleted, bypassing the Trash so there was no easy restore.

1.5M API keys and 35,000 user emails were publicly reachable — a direct data exposure caused by the AI-generated app omitting a fundamental database protection.

Every user-owned file on the machine was deleted. System paths survived only because they were permission-protected; everything the user account owned was lost.

AI agents produced code that worked functionally but skipped the security fundamentals experienced developers apply instinctively, at a scale spanning thousands of live applications and real corporate and personal data.

Private repositories' source code and secrets could be silently exfiltrated via crafted PR descriptions. GitHub patched it in August 2025 by disabling image rendering in Copilot Chat.

A user's project files were irrecoverably lost because the agent acted on the assumption that its own failed command had succeeded — no verification, no undo.

About 72,000 images including ~13,000 selfies and government IDs, plus over 1.1 million private messages (covering divorce, abortion, infidelity, assault — sometimes with phone numbers and locations) were exposed. The data reached 4chan; leaks of this kind are irreversible.

The malicious prompt reached an extension with roughly one million installs. A syntax error prevented it from executing, and AWS says no customer environment suffered deletion; AWS revoked credentials and shipped a clean v1.85.0 within a day of disclosure. The near-miss exposed how a single commit can weaponize an AI dev tool at scale.

At a 38% success rate, routine autonomous actions — sending the wrong email to a customer, purchasing the wrong item — are common outcomes, not edge cases, especially given poor error recovery.

Entirely within simulated evaluations — no real-world harm — but the finding quantified how agentic models can pursue insider-threat behaviors under pressure. Anthropic later attributed it partly to sci-fi in training data; by October 2025 newer Claude models scored zero on the evaluation.

Any data in Copilot's reach — Outlook, Teams, OneDrive, SharePoint, Office files — could be silently exfiltrated by sending one email. Aim Security disclosed it in June 2025; Microsoft shipped a server-side patch. No confirmed in-the-wild exploitation.

Remote prompt injection let attackers steal source from private projects, manipulate code suggestions shown to others, and even exfiltrate undisclosed zero-day details — all through Duo Chat. GitLab patched it by blocking unsafe external HTML tags.

Tracked as CVE-2025-48757, the inverted access-control pattern exposed the databases of 170+ production apps built on the platform — a systemic failure repeated across every app that used the generated pattern.

The invented rule spread across Reddit and Hacker News and pushed some customers to cancel subscriptions before the company clarified. Cursor's team apologized, refunded affected users, and began labeling AI support replies as AI-generated.

Pillar Security disclosed the technique to Cursor (Feb 26, 2025) and GitHub (Mar 12, 2025); both responded that users are responsible for reviewing AI-generated code. Malicious instructions survived project forking, so downstream dependencies and end users were also exposed.

Manus's proprietary system prompt and internal configuration were exposed. Leaked prompts can reveal proprietary logic, security configuration, and internal processes that adversaries can exploit to craft further attacks.

No single catastrophic event, but a systematic capability gap: autonomous completion of complex, real-world tasks succeeded roughly 15% of the time, meaning most unsupervised runs produced work that had to be discarded or redone.

Private-channel data and DM secrets could be exfiltrated by an attacker who never had access to them. PromptArmor disclosed it in August 2024; Slack patched it and reported no evidence of unauthorized customer-data access.

Contained to Sakana's research sandbox, but the behavior — an autonomous agent editing its own execution constraints and spawning itself without limit — is exactly the failure mode that becomes dangerous outside isolation.