{"meta":{"exportedAt":"2026-10-07T06:03:07.958Z","formatVersion":2,"selection":{"q":"powershell-quoting","system":"","harm":"","context":"","country":"","role":"","relation":"","evidence":"","year":"","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":0,"languages":1,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":1,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":1,"contextualRelations":0,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-cline-agent-cleanup-command-quoting-error-deleted-windows-data-drive-root-about-1-5-tb-first-person-issue","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'In Act mode, needed to clean a temp folder'; 'The nested escaping'; 'The path resolved to the drive root'; 'The text above was generated by the Cline AI agent on my behalf'","relation":"supports","source_id":"s1"}],"assertion":"The issue reports that, in Act mode, the Cline agent built a temp-folder cleanup command wrapping rmdir /s /q in cmd /c inside a PowerShell string, that the nested quoting was mangled and that the recursive delete ran against the G: data drive instead of the intended subfolder; the author says the agent wrote the issue text on their behalf.","causal_attribution":"The issue attributes the command to the agent's run_commands tool."},{"id":"c2","status":"reported","evidence":[{"locator":"'Result: recursive deletion of the drive's contents (~1.5 TB of the user's photos/videos/docs)'; 'only the code was recoverable (it was under git and pushed), user data was lost'; 'Recovery on an SSD was largely unsuccessful (TRIM)'","relation":"supports","source_id":"s1"}],"assertion":"The issue reports that about 1.5 TB of the user's photos, videos and documents and the project being edited were deleted, that only the code was recoverable from git, and that SSD recovery was largely unsuccessful.","causal_attribution":"User's account via the agent-written filing."},{"id":"c3","status":"reported","evidence":[{"locator":"'I reproduced the mechanism in a sandbox. The path did not resolve to `G:`. The quoting gave `rmdir` a second target, `\\`, which is the root of the current drive, and `rmdir /s /q` deletes every target it is given.'","relation":"supports","source_id":"s1"}],"assertion":"A commenter reports reproducing the quoting mechanism in a sandbox: PowerShell ended the string at the first escaped quote, so rmdir received a bare backslash, the root of the current drive, as a second target.","causal_attribution":"Commenter's own sandbox test; establishes the mechanism, not the author's loss."},{"id":"c4","status":"reported","evidence":[{"locator":"'an Act-mode pre-tool guard for Windows PowerShell `run_commands`'; 'the existing command guard is registered only for Plan mode'","relation":"supports","source_id":"s1"}],"assertion":"A project contributor proposed an Act-mode pre-tool guard for Windows PowerShell run_commands and noted that the existing command guard is registered only for Plan mode.","causal_attribution":"Not applicable."}],"effects":[{"label":"about 1.5 TB of photos, videos and documents and the edited project deleted from the data drive; code recovered from git, personal data not (user's account)","claim_id":"c2","direction":"negative"}],"sources":[{"id":"s1","url":"https://github.com/cline/cline/issues/14864","kind":"first_person_account","access":"read","language":"en","translation_note":"Read in English on 2026-10-07: issue body and four comments retrieved through the GitHub API; the issue text is in English with a Cyrillic folder name and Russian-language Windows error strings quoted, which the research agent (an AI) read without translation. The author's handle is not recorded.","independence_group":"github-cline-14864-author"}],"version":1,"ai_roles":["own_use"],"contexts":["everyday_life","work"],"unknowns":["The date of the deletion; the issue gives none.","The provider and model behind the agent; the issue leaves those fields empty.","How much data, if any, was recovered.","Where the author lives.","Whether Cline has shipped a fix."],"geography":{"basis":"The issue does not say where the author was or lives; a Cyrillic folder name and a Russian-language error message do not establish a country. No country is recorded.","court_countries":[],"event_countries":[],"affected_person_countries":[]},"publication":{"basis":"Published under the charter's public first-person rule as a concrete account of an AI coding agent's own cleanup command deleting a user's personal drive contents, with the agent's authorship of the filing disclosed, the loss attributed to the user and the mechanism's reproduction attributed to a commenter; uncorroborated as to the loss. The author's handle is not recorded.","reviewed_on":"2026-10-07"},"ai_involvement":{"basis":"The issue states that the Cline agent, in Act mode, constructed and ran the cleanup command whose mangled quoting sent rmdir /s /q against the drive root, and attributes the deletion of the drive's contents to that command; the author adopted the account by filing it and said the agent wrote the text on their behalf. A commenter's sandbox reproduction supports the quoting mechanism but not the author's loss.","status":"reported"},"person_relations":["acted_on_behalf"]},"name":"GitHub issue by a Cline user: a cleanup command the agent built ran against a Windows data drive's root, deleting about 1.5 TB of personal files, user says","summary":"In a GitHub issue filed on 6 October 2026 in the Cline repository, a user reports that a temp-folder cleanup command built by the Cline coding agent in Act mode on Windows was mangled by nested quoting and ran a recursive delete against the root of the G: data drive instead of the intended subfolder. The issue text, which the user says the Cline agent wrote on their behalf, puts the loss at about 1.5 TB of photos, videos and documents plus the project the agent was editing; the code was recoverable from git, the personal data was not, and recovery from the SSD largely failed. A commenter reproduced the quoting mechanism in a sandbox and found that PowerShell split the command so that rmdir received a bare backslash as a second target, which is the root of the current drive; a contributor proposed an Act-mode guard. The loss itself rests on the user's account.","incidentKind":"single_event","incidentDatePrecision":"unknown","exposurePattern":"single_interaction","reportedDate":"2026-10-06","aiSystem":"Cline coding agent, VS Code extension version 4.1.22, using its run_commands tool in Act mode to invoke cmd /c through PowerShell on Windows, per the issue; the provider and model are not stated","aiProduct":"Cline","aiCompany":"Cline","severity":"medium","verificationStatus":"unverified","harmCategories":[],"harmOutcomes":["property_loss","other_material_harm"],"harmOutcomeSummary":"The user reports that a recursive delete built by the Cline agent for a temp-folder cleanup ran against the root of their Windows data drive and destroyed about 1.5 TB of photos, videos and documents plus the project being edited, with the code recoverable from git and the personal data not (first-person filing written by the agent on the user's behalf, uncorroborated).","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":1,"otherPeopleHarmedMin":0,"affectedCountStatus":"exact","affectedCountEvidence":"One person: the account's author. Exact 1.","victimAgeRange":"unknown","jurisdiction":"unknown","platformType":"agent","outcomeStatus":"ongoing","primarySourceUrl":"https://github.com/cline/cline/issues/14864","primarySourceLabel":"GitHub issue cline/cline #14864, 6 October 2026: mangled quoting led to rmdir /s /q running against a drive root, mass deletion of user data","firstPublishedAt":"2026-10-07T03:20:29.209252+00:00","updatedAt":"2026-10-07T03:20:29.209252+00:00","scopeVersion":"facts-v3","tags":["first-person","github-issue","cline","ai-agent","coding-agent","data-loss","file-deletion","windows","drive-root","powershell-quoting","acted-on-behalf"]}]}