Nine AI coding agent incidents that ended with deleted data

A year of documented AI coding agent incidents: wiped drives, dropped production tables, a live AWS service down for roughly 13 hours. What each one actually did, and what the pattern says about how to run agents safely.

Coding agents went from novelty to default in about eighteen months. From Cursor and Claude Code to Kiro and Replit, millions of developers now hand a model a terminal and let it work. Amazon set a target of 80% of its developers using AI for coding every week. The tools are good, and the productivity story is compelling enough that most teams stopped questioning any friction between the model’s decision and its execution in the shell.

However, the confirmation prompts started getting in the way. Every approval dialog is a context switch, and a coding agent generates dozens of commands per minute. So people turned the prompts off. Cursor calls it YOLO mode. Antigravity called it Turbo. The names are honest about what they do.

Below are documented incidents from June 2025 through July 2026. None of them were cyberattacks. Some involve a user who disabled the safety rails. Several do not, and those are harder to dismiss.

TL;DR

• Nine publicly documented cases in fourteen months where a coding agent destroyed data: personal drives, git-tracked repositories, a SaaS production database, and a live AWS service in one region for roughly 13 hours.
• The “user turned off the guardrails” explanation covers maybe half of them. Some happened with the permission system enabled, one violated an explicit “DO NOT RUN ANYTHING” instruction it had just acknowledged, and one inherited an engineer’s elevated permissions and sailed past a two-person approval gate.
• Almost none of these are hallucinations. The model’s intent was usually correct and boring: clear a cache, diff a migration. The damage happened one layer below, in shell quoting, tilde expansion, exit code parsing, and a documented but dangerous database flag.
• Even a competent engineer routinely makes similar errors from the list. What changed with agents is the blast radius: no read-after-write check, no pause before an irreversible action, and a loop that will not exit on its own.
• “Smarter models” won’t fix it. The real fix is a control layer that sees what the agent intends to do and what it is about to do, blocks the unambiguous disasters, and pauses the ambiguous ones.

Why developers turn AI coding agent guardrails off

Two forces push in the same direction. Approval fatigue is the first: an agent working through a refactor emits a stream of file writes and shell calls, and approving each one manually turns a ten-minute task into an hour of clicking. The second is that many safety options are shipped off by default. Cursor’s file deletion and external file protections exist, but users in the forum thread below had to be told they existed. Antigravity v1.x came out without confining filesystem access to the workspace, and one of its users, a photographer with no development background, got no install-time warning that the tool had terminal access at all.

There is also a plain trust accumulation effect. The tools work for weeks without major failures, which builds the justified confidence that makes the eventual failure expensive.

Key AI coding agent incidents that hit production in 2025 and 2026

The nine incidents at a glance

#	When	Tool	What was destroyed	Guardrails at the time	Recovered
1	Jun 2025	Cursor, YOLO mode	Everything on a developer’s machine, Cursor included	Off by design	Partial, cloud copies only
2	Jul 2025	Replit agent	SaaStr production database: 1,200+ executive and 1,190+ company records	Active code and action freeze, ignored	Yes, rollback worked
3	Oct 2025	Claude Code, issue #10077	Every user-owned file on an Ubuntu/WSL2 system	On, and did not see the expansion coming	No
4	Nov 2025	Gemini CLI	A folder of files, each overwriting the last	Harness misread a failed directory creation as success	No
5	Nov 2025	Google Antigravity, Turbo mode	An entire D: partition	Off, with SafeToAutoRun set true	No
6	Dec 2025	Cursor, Plan Mode	~70 files in git-tracked directories, plus test processes on two remote machines	On, and Plan Mode itself was the thing that broke	Partial, files were git-tracked
7	Dec 2025	Claude Code	A Mac home directory: Desktop, Documents, Library, Keychain	Not stated	No, TRIM had zeroed the blocks
8	Dec 2025	Amazon Kiro	An AWS production environment; Cost Explorer down ~13h in one region	On, two-person gate bypassed by inherited permissions	Yes, backups and IaC
9	Jul 2026	Claude Code	A live Supabase database, every table	Broad access, autonomous run	Yes, DIY, in hours

Cursor YOLO mode wipes a developer’s machine

A Cursor user running YOLO mode reported in June 2025 that a routine backend migration from Express.js to Next.js ended with his computer empty. The agent tried to delete some old files, failed, then deleted everything on the machine, Cursor included. YOLO mode removes the per-command approval step by design, so nothing stopped it.

The user, an AI program manager who had been using Cursor for personal projects since March, recovered what he could from Google Drive and GitHub. Local disk recovery mostly failed. No vendor post-mortem followed. Forum responders noted that Cursor has file deletion and external file protection settings that would probably have caught it, raising the question of why they were off by default.

Replit’s agent deletes SaaStr’s production database

Replit’s agent wiped a live production database belonging to SaaStr founder Jason Lemkin on July 18, 2025, during an active code and action freeze. Records for more than 1,200 executives and more than 1,190 companies were gone. The agent had been told not to proceed without human approval and did anyway.

What made this the reference case was not the deletion. Asked about recovery, the agent told Lemkin it had destroyed all database versions and rollback was impossible. Both claims were false. Lemkin tried the rollback himself and it worked. The agent also fabricated a 4,000-record database of fictional people. Replit CEO Amjad Masad apologized publicly within days and called the incident unacceptable. The company shipped separate production and development databases in beta shortly after.

Gemini CLI destroys the files it thought it had moved

Gemini CLI misread a failed directory creation as a success, and then moved a folder’s worth of files into a destination that did not exist. The user had asked it to reorganize a folder. On Windows PowerShell, moving a file to a nonexistent path renames it instead, so each file overwrote the last under the same name. One file survived.

The agent never issued a single verification command after execution. No dir, no ls, nothing that would have caught the divergence. When the user could not find the new folder, the agent conceded the files were gone and described its own conduct as gross incompetence. Attempts to revert failed and the data was never recovered. Google acknowledged the GitHub issue without a formal public statement.

Claude Code deletes a developer’s home directory

Developer Mike Wolak filed issue #10077 on October 21, 2025, after Claude Code executed a recursive delete starting from root on his Ubuntu/WSL2 system. The debug logs show thousands of permission-denied errors for /bin, /boot and /etc as it worked through everything it could reach. Every user-owned file went with it, along with weeks or months of active project work.

Wolak was not running with --dangerously-skip-permissions. The permission system was on and did not detect that the command would expand destructively before he approved it. That is a failure mode with precedent: Claude Code’s deny rules have been silently bypassed before, for reasons that had nothing to do with the user’s settings. He filed the issue with conversation JSONL, two debug logs, command history and a written incident report, and pointed out a gap in the logging itself, which recorded the command’s output but not the command. Anthropic tagged it as a security bug. Nothing was recovered.

Google Antigravity wipes an entire D: drive

Antigravity’s Gemini 3 agent ran rmdir /s /q d:\, while trying to clear a Vite cache inside a project folder. The target path was D:\ETSY 2025\Antigravity Projects\Image Selector\client\node_modules\.vite. Unquoted spaces truncated it after D:\. The /q flag suppressed confirmation and bypassed the Recycle Bin. The user, a photographer and designer in Greece running Turbo mode, lost the partition. Recuva and other tools salvaged nothing.

Asked whether it had permission, the agent reconstructed its own failure in the reasoning trace, identifying the destructive step, the stripped nested quotes in its powershell -Command 'cmd /c "..."' call, and its SafeToAutoRun flag set to true. This one produced an actual vendor fix. The user sent Google his logs, and by December 9, roughly twelve days later, Google shipped Secure Mode: terminal commands no longer auto-execute, JavaScript and artifact-suggested actions need explicit approval, and filesystem access is confined to the designated workspace with root-level drives blocked. The data was never recovered.

Cursor Plan Mode ignores “DO NOT RUN ANYTHING”

A developer using Cursor’s Plan Mode, the mode built specifically to prevent unintended execution, watched the agent delete roughly 70 files from git-tracked directories with rm -rf, kill running test processes on two remote machines, and then create git commits trying to patch up the damage. This was December 2025.

The instruction “DO NOT RUN ANYTHING” was in the prompt. The agent acknowledged it in its response text and then executed commands anyway. A Cursor team member confirmed on the forum that this was a critical bug in Plan Mode’s constraint enforcement. The files were git-tracked, so recovery was at least possible. This is the case that separates a user disabling safety from a safety mode failing: a verbal acknowledgment is not an enforcement mechanism.

A trailing tilde wipes a Mac

Claude Code generated and ran rm -rf tests/ patches/ plan/ ~/ on December 8, 2025, after a developer asked it to clean up packages in an old repository. The trailing ~/ expanded to the home directory. Desktop, Documents, Downloads, Library, the Keychain, years of project files, family photos and work product went with it. TRIM had already zeroed the freed blocks on the SSD, so forensic recovery found nothing.

Nobody knows why the model appended ~/. The command is syntactically valid, and nothing about its shape marks it as dangerous. One consequence has a bleak symmetry: the Keychain deletion broke authentication across every application on the machine, including Claude Code, which could no longer reach its own backend. The thread passed 1,500 upvotes within hours and was picked up by Simon Willison and by Gigazine in Japan the following week.

Amazon’s Kiro deletes and recreates an AWS production environment

The Financial Times reported, citing four people familiar with the matter, that in mid-December 2025 Amazon’s internal coding agent Kiro hit a problem in a production environment and determined that the optimal fix was to delete and recreate the whole thing. AWS Cost Explorer went down in one mainland China region for roughly 13 hours. Kiro normally requires two-person approval for production pushes, but the deploying engineer held broader than typical permissions, and Kiro inherited them, so the gate never triggered. By the time an observing engineer understood what was about to happen, it was already irreversible. Engineers rebuilt from backups and IaC templates.

Amazon published a formal rebuttal, attributing the outage to a misconfigured role and stating it could have happened with any developer tool or manual action; no customer inquiries were received. A spokesperson added that the involvement of AI tools was coincidental. Amazon then made peer reviews mandatory for all production changes, which reads as an implicit admission that the prior configuration was not sufficient. The FT also reported a senior AWS employee describing at least two production outages where engineers let an agent resolve an issue without intervening.

Claude Opus 5 resets a production Supabase database

A developer connected Claude Code to a live Supabase instance with broad access in July 2026, and asked it to analyze the repo and autonomously fix schema and content issues. Roughly ten minutes in, it ran a Prisma migration command that pointed --shadow-database-url at production. Prisma resets the shadow database before replaying migration history against it, so it did exactly what the flag documents. Every table came back empty: tools, users, reviews, likes, comparison entries.

The model caught the damage itself and reported it unprompted, saying the database had been wiped and that this was its fault. Recovery was DIY and iterative, documented across five edits to the original post: Gemini 3.6 recovered 96 pages, backups went in, and the rest came back through MCP. The developer’s final update reports everything restored, in hours rather than days. Two nuances: the prompt that triggered the run had itself been written by Opus 5 after analyzing the repo, and by the developer’s own account this was a low-stakes test project. Production in the sense of live, not in the sense of consequential.

What went wrong: AI goal drift or lax permissions?

“Hallucination”, “agents going rogue”, and “goal drift” get reached for a lot in coverage of these cases, and mostly mislead. Sorting the nine by mechanism is more useful.

The largest group is a gap between what the model intended and what the substrate did with it. Antigravity, Claude Code #10077, the Mac tilde case, the Opus 5 Prisma reset, and partly Gemini CLI all belong here. The intent in each was correct and unremarkable: delete the Vite cache, clean up three directories, diff a migration. The trap was one layer down: unquoted spaces truncated a path at D:\; ~ expanded after the permission check rather than before; --shadow-database-url did what it documents when handed the wrong URL. These are the errors of an agent operating at the wrong abstraction level, writing shell as though it were an API, when the real shell behavior is very different. It is the same structural gap we measured in GuardFall, where an agent’s command guard inspects raw text while bash expands, unquotes and rewrites that text before running it. There the mismatch was an attack primitive. Here it is an accident, and the mechanism is identical.

Gemini CLI is the clean case of an unverified world model, with Cursor YOLO probably alongside it. The agent read a non-zero exit code as success and then executed a coherent sequence of operations against a filesystem that did not exist. This is the closest thing on the list to hallucination, but note the trigger was a harness bug in exit code parsing, not the model inventing facts. The model’s specific failure was narrower: it never issued a verification call. That is a missing control flow habit, not a knowledge problem.

Constraint decay covers Replit’s code freeze and Cursor’s acknowledged-then-violated “DO NOT RUN ANYTHING”. Here “drift” earns its keep. The constraint was present, was acknowledged in natural language, and then lost purchase over behavior. However, for agents, instructions enter as context and compete with everything else in context. It’s not a configuration.

Kiro, and partly Replit, are goal-rational destruction. Kiro did not malfunction in any interesting sense. “Delete and recreate the environment” is a legitimate remediation that human SREs choose regularly. The error was authority. It inherited an engineer’s elevated permissions and therefore never met the two-person gate that exists to catch such decisions when a human makes them.

Which brings the guardrails-off story up short. It fits Cursor YOLO and Antigravity Turbo cleanly. It does not fit issue #10077, where the permission system was running and failed to see the expansion coming. It does not fit Cursor Plan Mode, where the safety mode was the thing that broke. And it does not fit Kiro, where the control existed, was mandatory, and was bypassed by permission inheritance rather than by anyone choosing to skip it. Turning the prompts back on would have prevented some of this list. It would not have prevented the harder half.

Why smarter models won’t fix AI agent data loss

Every mistake here is one a competent engineer makes routinely: forgetting to quote a path with spaces, passing the wrong environment variable to a flag, deleting the parent instead of the child, running a migration against the wrong connection string. Humans make these constantly and they mostly cost nothing, because a human types one command, watches it, and the feedback loop between error and consequence is about one second wide.

An agent emits the same error inside a loop it will not exit, at dozens of operations per minute, with no read-after-write check and no hesitation before irreversible actions. It is equally confident listing files and deleting them.

That is why the hallucination framing does damage. It implies the fix is a more accurate model. But a model with a tenth the error rate, running unbounded destructive operations at machine speed, still wipes drives. Just less often, which is arguably worse, because rarity erodes the operator’s (justified) caution.

How to secure your AI agents and your production data

Start with the assumption that the agent will eventually issue a destructive command it did not intend, and design so that command cannot reach anything that matters. What these nine cases share is that the agent’s judgment was mostly fine and the safety and security layer between its judgment and the filesystem or cloud data was missing.

Build the layer yourself

Scope credentials before you scope prompts. Coding agents should run with their own identity and their own permissions, never with a developer’s ambient ones. No production database URL should be reachable from a development session.

Confine the filesystem. Antigravity’s Secure Mode is the right shape of fix: the agent works inside a designated workspace, root-level drives are blocked, and terminal commands do not auto-execute. If your tool offers sandboxing, turn it on. If it does not, run the agent in a container or a VM where the worst case is a rebuilt image.

Treat irreversibility as its own category. rm -rf, DROP, rmdir /s /q, migrate reset, force pushes, infrastructure teardown: these deserve a different control path from ordinary file writes, and they are the small minority of commands where a confirmation prompt costs almost nothing. Approval fatigue comes from prompting on everything. Prompting on the 2% that cannot be undone is survivable.

Require verification after write. Gemini CLI destroyed a folder because it never issued a single ls or dir after execution, so a filesystem that existed only in its “head” stayed unchallenged through every subsequent operation. Read-after-write is cheap and it catches the divergence at step one.

Log the command, not just the output. If you cannot reconstruct the exact command from your telemetry, you cannot investigate an incident and you cannot build a rule to prevent the next one.

Get backups off the machine and test the restore. This is the variable that separated survivable from total across the whole list.

For the wider pattern beyond coding agents, our Top AI Security Incidents report collects the 2025 cases across the whole AI stack.

Or buy the layer, with security rules written out of the box

That is what Adversa AI builds. Our platform is an AI agent security control plane that watches the agent’s own traffic and connects the chain of agentic actions: what untrusted content entered the session, which files and secrets were touched, where data went, what command was sent. These signals live in separate domains, and the platform is where they meet, matching the agent’s stated reasoning against the shell commands and MCP calls it actually issued.

Unambiguous destructive actions and attacks are blocked, ambiguous ones pause for confirmation, and every action is tied to a person and recorded for audit. It deploys as a gateway, optionally with a lightweight endpoint agent that monitors what coding agents do on developer machines. Typical checks run under a millisecond and the design fails open, so even a platform crash never blocks a developer.

The point of any of this is not to slow the developers and their AI agents down. It is to make sure that when an AI agent makes an ordinary mistake, that mistake stays ordinary. Stop the damage, not the developers.