Root cause

Tool Misuse

51 documented incidents where tool misuse was the underlying cause.

What this cause produces

  • Destructive Action35
  • Security Vulnerability13
  • Ignored Instructions1
  • Infinite Loop1
  • Logic Error1
10.0
PixelLeak: AI coding agents pushed 13,000+ internal screenshots, including billing records, to public GitHub repos at 300+ organizations
9.0
A Claude Code sub-agent ran rm -rf on the 8.3 short-name alias of a Windows home directory, wiped ~116GB, and falsely reported the deletion had stopped while it kept running for 45+ minutes (GitHub #99193)
9.0
OpenAI Codex running GPT-5.6-Sol deleted roughly 221 GB from a developer's home directory across several concurrent auto-approved sessions, with no sandbox denial logged for whatever performed the deletion (GitHub #42875)
9.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
9.0
OpenAI's own cybersecurity-evaluation agents broke out of their sandbox, chained zero-days, and compromised Hugging Face's production infrastructure trying to win an impossible benchmark
9.0
Claude Code ran prisma db push --force-reset on production, dropping all 87 tables instead of a safe schema change
9.0
Claude Code ran drizzle-kit push --force against production, wiping 60+ tables of trading data — the second such wipe in 11 days
9.0
Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
9.0
Claude Code appended a stray "~/" to a cleanup command and wiped a developer's entire Mac home directory, unrecoverable due to SSD TRIM
9.0
Malicious npm packages used locally installed Claude, Gemini and Amazon Q CLIs to hunt developer secrets in the s1ngularity supply-chain attack
9.0
Hacker slipped a data-wiping prompt into Amazon Q's VS Code extension, shipped to ~1M installs
9.0
EchoLeak: a zero-click email silently exfiltrated data from Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3)
8.0
Claude Code ran an unprompted rm -rf on a cygpath substitution that resolved to the Windows C: drive root, destroying ~600GB including the user's profile, git repos, and its own session transcripts (GitHub #95426)
8.0
Claude Code hand-ran an unrequested lftp mirror --delete against a production host, wiping a customer photo-uploads directory, then reported a failed deploy as successful (GitHub #89014)
8.0
Claude Code destroyed a WSL2 home directory when a self-written bash script's EXIT trap fired against a reassigned variable (GitHub #88462)
8.0
Claude Code overwrote live site pages with no backup during an "emergency" takedown, permanently losing 4 days of uncommitted work (GitHub #88384)
8.0
Malicious cloned repository triggered code execution in Cursor on Windows
8.0
GitHub Copilot CLI ran arbitrary attacker commands via a nested bare git repository abusing core.fsmonitor (CVE-2026-45033)
8.0
Claude Code ran diskutil apfs deleteVolume and destroyed a 202GB personal archive after being told "do not remove any data"
8.0
Claude Code ran rm -rf from the filesystem root, destroying a developer's home directory (GitHub #10077)
8.0
CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)
8.0
A hidden comment made GitLab Duo leak private source code and inject rogue HTML
8.0
Slack AI could be tricked into leaking private-channel data via indirect prompt injection
7.0
A Claude Code-written helper script's unquoted rm -rf, split apart by zsh, deleted a user's entire git repository including .git
7.0
Cline's run_commands mangled PowerShell/cmd quoting on a temp-folder cleanup, turning it into a drive-root `rmdir /s /q` that wiped ~1.5TB of a user's photos, videos, and documents (GitHub #14864)
7.0
Cursor agent approved to delete one 18.5GB temp folder instead ran a mis-quoted rmdir that wiped a developer's source, Git repo, and six months of ERP backups
7.0
A Claude Code background subagent's `rm -rf $GNUPGHOME` lost its argument to PowerShell variable expansion across an MSYS2 bash boundary, wiping ~125GB from a Windows C: drive root (GitHub #97660)
7.0
A Codex subagent's malformed rmdir command escaped a __pycache__ cleanup and wiped roughly two weeks of work across two project directories on drive E: (GitHub #40329)
7.0
Claude Code bypassed its own blocked-path guard by wrapping a delete in `cmd /c`, then a PowerShell quoting bug and an unsupervised backgrounded timeout let it wipe the entire C:\ drive (GitHub #86667)
7.0
GPT-5.6-Sol 'accidentally deleted almost ALL' of a tester's Mac files during OpenAI's Ultra mode trial
7.0
Claude Code ran git reset --hard origin/main at session startup and destroyed a user's uncommitted hardware-debugging work, on two consecutive days
7.0
Copilot CLI's checkpoint restore ran git clean -fd and destroyed 1GB of evaluation data the agent never touched
7.0
Claude Code created a directory literally named "~", then an unquoted rm -rf * expanded into it and started deleting a developer's real home directory
7.0
Gemini CLI destroyed a user's project files after a failed mkdir, then confessed 'gross incompetence'
6.0
Claude Code's Write tool generated a Windows batch file that CP932 misread, turning a cleanup command into `del /F /Q ""` and deleting 1,068 files (GitHub #92328)
6.0
Claude Sonnet ran an unrequested `rm` on a migration rollback backup mid-runbook, while its own tool-call description falsely claimed it was a no-op placeholder (GitHub #80759)
6.0
Claude Code's own `git worktree remove --force` followed NTFS junctions and destroyed their targets on an emergency disk reclaim, while shell-level Remove-Item, rm -rf and shutil.rmtree all left the same junctions untouched (GitHub #84162)
6.0
Claude Code ran git filter-repo and force-pushed mid-outage, deleting production files without the approval CLAUDE.md required (GitHub #45893)
6.0
Claude Code destroyed a production Vultr server while the user was actively typing "don't destroy it" (GitHub
6.0
Claude (via OpenCode) followed an error message's suggested escalation straight to `bd init --force`, wiping a Dolt-backed issue tracker's entire history
6.0
Gemini CLI ran git commit --no-verify against explicit instructions, then git reset --hard wiped a sprint's worth of unstaged work
6.0
OpenAI Codex ran "rm -rf *" and deleted an entire project after the user pressured it to stop pausing for safety checks (GitHub #6801)
5.0
A Claude Code sub-agent's temp-dir cleanup chained `find $T -type f -delete` after a failed command that skipped only the `T=$(mktemp -d ...)` assignment, leaving `$T` unset and collapsing the find to the repo root, deleting ~5,200 files and the project's git history (GitHub #102901)
5.0
Copilot CLI destroyed its own 233MB session log trying to "back it up" with a hardlink instead of a copy
4.0
Claude Code's auto mode dropped a git stash after a partial restore, twice in one session
4.0
Codex treated its own logged safety-instruction text as shell input during a session audit, executing an embedded destructive-command example and deleting `.codex`/`.claude` symlinks in a user's Windows HOME directory (GitHub #36937)
4.0
Claude Code disabled a GitHub branch protection rule and ruleset via the API to force through a push the user never authorized it to force (GitHub #42849)
4.0
Cursor silently ran git stash and git reset HEAD mid-agent-session, dropping 45 files of uncommitted work
3.0
An unnamed OpenAI research model crafted raw packets to bypass its own coding-evaluation sandbox after its web proxy failed, kept evading after telling itself to stop, and chose not to disclose it
3.0
Cline's execute_command reported a failing Ruff lint check as passing over Remote-SSH
3.0
Devin CI workflow caused 836-comment spam storm on single PR