AI agents accidentally deleting user files—a pattern of state confusion

On July 16, 2026, Thibault Sottiaux, who works on the Codex harness at OpenAI, posted findings from an investigation into reports of unexpected file deletions by GPT-5.6. The most common scenario occurs when full access mode is enabled without sandboxing protections or auto-review, the model attempts to override the $HOME environment variable to define a temporary directory, and mistakenly deletes $HOME itself instead.

The article documents a series of high-impact incidents. On July 11, 2026, user mattschumer_ reported that GPT-5.6-Sol accidentally deleted almost all files on their Mac. The agent had run a cleanup command that incorrectly expanded $HOME and executed rm -rf /Users/mattsdevbox—the user killed the process but material deletion had occurred. The same day, cremieuxrecueil encountered a similar cleanup problem: a PowerShell command treated an -Include filter unexpectedly and removed compiled paper files. On July 14, brunolemos reported that GPT-5.6 Sol deleted their entire production database after 14 hours and 35 minutes of autonomous execution. The agent had incorrectly pointed the TEST_DATABASE_URL environment variable to the production Neon database URL and then executed integration tests that included destructive setup commands such as TRUNCATE TABLE users CASCADE and explicit deletion of the users table.

Incidents predate the recent surge. In April 2026, peter_szilagyi asked Claude Code to isolate a 3-line fix into a new branch; Claude stashed changes, switched branches, and attempted to restore them with git stash pop, but then discarded uncommitted changes with git checkout --, immediately overwriting the restored work. On February 7, 2026, Nick_Davidov asked Claude Cowork to organize his wife's desktop and granted permission to delete temporary office files. The agent attempted to rename and accidentally deleted a folder containing all photos taken on her camera for 15 years. Claude Opus 4.6 explained: while merging a lowercase "photos" folder with a new "Photos" folder, it did not account for macOS's case-insensitive file system, where both names point to the same folder, and ran rm -rf on what it thought was a separate empty folder.

The author describes a personal incident from April 14, 2026: when asked to move inline HTML from a TypeScript file to separate HTML files, Sonnet 4.6 proposed using a Python script with a regular expression to match and delete the original lines. The regex pattern included a closing group for }, whitespace, ], }, and );—but one code block ended with an extra comma, causing the pattern to not match until far further down the file, swallowing hundreds of lines of code that neither the agent nor the user noticed until the change appeared on GitHub.

The article identifies a through-line: confusion about state. The $HOME variable did not address the intended directory; PowerShell's -Include parameter behaved unexpectedly; the DATABASE_URL pointed to production, not test; git checkout after stash pop did not preserve work; macOS treats capitalization-variant folder names as identical; and the regex did not match intended boundaries. Agents often reach for power-user techniques—chained commands like git stash && git checkout, environment variable overloads, regex-based substitution—that are valid but require tracking implicit state. This conflicts with other training goals: without a calculator tool, LLMs often overconfidently estimate arithmetic; without a provided key-value store for custom variables, agents cannot safely store task state; without standard temporary-file creation, cleanup is always arbitrary.

The article notes that Claude Code launched in February 2025 and became a revenue driver, normalizing "agent with command line access" as a flagship product. Mitigations involve trade-offs between constraints and convenience, but several concrete proposals emerge: destructive_command_guard, a high-performance hook intercepting destructive commands before execution (over 5k GitHub stars); Git worktrees to isolate tasks into separate directories; backups and versioned folder schemas (e.g., Documents/work/2026-01/myfile.js); and safer, scoped operations built into the harness itself—a key-value store for custom variables, a standard temporary-file API, database branching via Neon, and a tool to move character ranges as blocks rather than requiring regex surgery. These would not eliminate mistakes but would reduce the distance between what the user intended and the destructive primitive the agent eventually executes.

The incidents catalogued in this article reveal a consistent failure mode: AI agents confuse the actual state of a file system or environment variable with what they believe it to be, then execute a destructive command irreversibly. In the most dramatic case, a user ran a GPT-5.6 agent for over 14 hours pursuing a goal (finish implementation, including app UI, server); the agent had accidentally pointed a test database URL to the production database URL, then executed TRUNCATE TABLE and DELETE commands during test setup. In another, Claude Cowork attempted to merge two folders with names differing only in capitalization—a distinction the agent did not realize macOS ignores—and deleted 15 years of photos. OpenAI's Thibault Sottiaux confirmed the pattern on July 16, 2026: the issue occurs most commonly when full access mode is enabled without sandboxing protections, the model attempts to override $HOME to define a temporary directory, and makes an honest mistake.

These are not attacks; they are failures of comprehension. The article notes that security research has historically focused on exfiltration via prompt injection, where an agent leaks secrets through a confused deputy attack. In practice, however, state confusion leading to accidental destruction appears far more common. The underlying cause is missing affordances: AI agents reach for power-user techniques (chained shell commands, regex-based code surgery, environment variable overloads) because no safer, scoped alternative exists for common tasks like temporary file creation, database branching, or block-based code movement. The article argues that as Claude Code (launched February 2025) and similar tools have become flagship revenue products with full terminal access, the human cost of a mistake has shifted from minor corruption to permanent loss. Mitigations proposed include backups, projects like destructive_command_guard (which intercepts dangerous commands before execution), and redesigned harnesses that offer safer alternatives for routine operations.

No comments yet. Be the first to share your thoughts!