Root cause

Tool Misuse

37 documented incidents where tool misuse was the underlying cause.

What this cause produces

  • Destructive Action26
  • Security Vulnerability9
  • Infinite Loop1
  • Logic Error1
10.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
GPT-5.6-Sol 'accidentally deleted almost ALL' of a tester's Mac files during OpenAI's Ultra mode trial
10.0
Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
10.0
Claude Code ran rm -rf from the filesystem root, destroying a developer's home directory (GitHub #10077)
10.0
CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)
10.0
Gemini CLI destroyed a user's project files after a failed mkdir, then confessed 'gross incompetence'
10.0
Hacker slipped a data-wiping prompt into Amazon Q's VS Code extension, shipped to ~1M installs
10.0
EchoLeak: a zero-click email silently exfiltrated data from Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3)
10.0
A hidden comment made GitLab Duo leak private source code and inject rogue HTML
10.0
Slack AI could be tricked into leaking private-channel data via indirect prompt injection
9.6
Claude Code ran an unprompted rm -rf on a cygpath substitution that resolved to the Windows C: drive root, destroying ~600GB including the user's profile, git repos, and its own session transcripts (GitHub #95426)
9.6
Claude Code ran drizzle-kit push --force against production, wiping 60+ tables of trading data — the second such wipe in 11 days
9.5
Claude Code ran prisma db push --force-reset on production, dropping all 87 tables instead of a safe schema change
9.5
Claude Code appended a stray "~/" to a cleanup command and wiped a developer's entire Mac home directory, unrecoverable due to SSD TRIM
8.6
A Claude Code sub-agent ran rm -rf on the 8.3 short-name alias of a Windows home directory, wiped ~116GB, and falsely reported the deletion had stopped while it kept running for 45+ minutes (GitHub #99193)
8.5
Claude Code destroyed a WSL2 home directory when a self-written bash script's EXIT trap fired against a reassigned variable (GitHub #88462)
8.5
GitHub Copilot CLI ran arbitrary attacker commands via a nested bare git repository abusing core.fsmonitor (CVE-2026-45033)
8.0
OpenAI Codex running GPT-5.6-Sol deleted roughly 221 GB from a developer's home directory across several concurrent auto-approved sessions, with no sandbox denial logged for whatever performed the deletion (GitHub #42875)
8.0
Claude Code bypassed its own blocked-path guard by wrapping a delete in `cmd /c`, then a PowerShell quoting bug and an unsupervised backgrounded timeout let it wipe the entire C:\ drive (GitHub #86667)
7.8
Cline's run_commands mangled PowerShell/cmd quoting on a temp-folder cleanup, turning it into a drive-root `rmdir /s /q` that wiped ~1.5TB of a user's photos, videos, and documents (GitHub #14864)
7.8
Claude Code hand-ran an unrequested lftp mirror --delete against a production host, wiping a customer photo-uploads directory, then reported a failed deploy as successful (GitHub #89014)
7.6
Claude Code ran git filter-repo and force-pushed mid-outage, deleting production files without the approval CLAUDE.md required (GitHub #45893)
7.5
Gemini CLI ran git commit --no-verify against explicit instructions, then git reset --hard wiped a sprint's worth of unstaged work
7.3
Claude Code overwrote live site pages with no backup during an "emergency" takedown, permanently losing 4 days of uncommitted work (GitHub #88384)
7.2
A Codex subagent's malformed rmdir command escaped a __pycache__ cleanup and wiped roughly two weeks of work across two project directories on drive E: (GitHub #40329)
7.2
Claude (via OpenCode) followed an error message's suggested escalation straight to `bd init --force`, wiping a Dolt-backed issue tracker's entire history
7.1
Claude Code's Write tool generated a Windows batch file that CP932 misread, turning a cleanup command into `del /F /Q ""` and deleting 1,068 files (GitHub #92328)
7.0
Claude Code's own `git worktree remove --force` followed NTFS junctions and destroyed their targets on an emergency disk reclaim, while shell-level Remove-Item, rm -rf and shutil.rmtree all left the same junctions untouched (GitHub #84162)
6.5
Claude Code destroyed a production Vultr server while the user was actively typing "don't destroy it" (GitHub
6.2
Claude Sonnet ran an unrequested `rm` on a migration rollback backup mid-runbook, while its own tool-call description falsely claimed it was a no-op placeholder (GitHub #80759)
6.0
Claude Code created a directory literally named "~", then an unquoted rm -rf * expanded into it and started deleting a developer's real home directory
6.0
OpenAI Codex ran "rm -rf *" and deleted an entire project after the user pressured it to stop pausing for safety checks (GitHub #6801)
5.8
Devin CI workflow caused 836-comment spam storm on single PR
5.8
Copilot CLI's checkpoint restore ran git clean -fd and destroyed 1GB of evaluation data the agent never touched
3.8
Cline's execute_command reported a failing Ruff lint check as passing over Remote-SSH
2.6
Copilot CLI destroyed its own 233MB session log trying to "back it up" with a hardlink instead of a copy