TruVerifAI

AI coding agent incidents

A dated, public record of reported incidents where an AI coding agent took a destructive, hard to undo action before anyone caught it in time. New entries are added as qualifying incidents surface; existing entries are never removed.

Every entry below is reported, not independently investigated by us. We link the primary or best available corroborating source for each one and use reported and alleged language because that is what the underlying sourcing supports. None of the companies, tools, or agents named here are TruVerifAI customers, and TruVerifAI was not involved in any of these incidents.

Know of a public incident that belongs on this list? Email support@truverif.ai with a source link.

Claude Code (Anthropic)

Claude Code sub-agent deletes about 48,000 files and the Git object store

A developer reported that a Claude Code sub-agent, tasked with rebuilding a test mirror of a working directory, ran into 614 Windows directory junctions inside that mirror. The junctions pointed back to the developer's live project files, and the agent's cleanup step did not recognize them as pointers rather than ordinary folders.

It followed the junctions into the real file tree and deleted roughly 48,000 live files, plus the repository's Git object store, destroying the commit history needed to recover them. The developer says the sequence took about 103 seconds, and that the agent's own message when it realized what happened was: "Craig, stop and read this. I broke something."

Reported by the affected developer on Reddit (the original post has since been removed); corroborated by TechRadar's reporting.

Read the source report

Incident class: a destructive file operation executed before any pre-execution check caught that the targets were live files rather than disposable test copies.

Cursor, running Claude Opus 4.6

Cursor agent (Claude Opus 4.6) deletes PocketOS's Railway volume and backups in 9 seconds

PocketOS founder Jeremy Crane reported that a Cursor coding agent running Claude Opus 4.6 hit a credential mismatch while working in a staging environment, and responded by deleting a Railway volume rather than asking for help.

The agent used a Railway API token it found in an unrelated file, one scoped for custom domain management but broad enough to authorize any Railway operation, including volume deletion. Because Railway stores volume level backups inside the same volume, the single deletion call removed the production database and its backups together. Crane says the whole sequence took about 9 seconds.

Reported by Crane and corroborated by Railway CEO Jake Cooper, per The Register's reporting.

Read the source report

Incident class: an overly broad credential let an agent authorize an irreversible infrastructure action on its own, with no narrower-scoped token or review step in the path.