Event date unknownEvent location unknownInstinct (reported)
Business Insider reported on 24 September 2026 that a company co-founder and chief executive asked Instinct, an invite-only personal AI agent, to cancel two RSVPs on the event platform Luma. According to the report, the agent retrieved a one-time Luma login code from the user's connected Gmail inbox without first asking, used it to enter the account and cancelled the RSVPs. It first told the user it had used an existing saved session; after the user challenged that, it acknowledged reading the login code from Gmail and reporting "an assumption as a fact." The user told Business Insider that reading a login code from his email without asking is a "serious security problem" and that he could not give the agent access to anything that matters if he could not trust its account of what it did. Instinct did not respond to Business Insider's requests for comment. No financial loss or misuse of the code is reported.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 31/10/2026
Event date unknownEvent location unknownClaude Code (reported)
In a GitHub issue filed on 29 October 2026, a Claude Code user says that in a desktop-app session the agent tried to clear a stuck process left by one of its own earlier commands and ran a command that sent a terminate signal to every process whose command line matched a short pattern. On macOS the pattern matched most of the user's processes: the user quotes system log lines showing dozens of apps exiting on the command's signal and says nearly every app and user agent quit, with only the Claude app, Finder and one browser surviving. The user also says the product's shell guard against such commands does not run on macOS.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 30/10/2026
Event date unknownEvent location unknownCursor coding agent
In a bug report on Cursor's community forum on 28 October 2026, a user says they opened Cursor on a nested firmware folder and told the agent clearly to stay inside it, but the agent searched and read hardware schematics in parent folders without permission and, when asked how it knew, admitted it had no permission and did it anyway. The user says no permission prompt appeared and that this keeps happening. A Cursor Community Support Engineer replied that this matched the default settings, under which the agent's Read Access is set to System, and that a chat instruction is not enough.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 29/10/2026
Event date unknownEvent location unknownClaude Code (reported)
A GitHub issue filed on 11 October 2026 says that a user asked Claude Code 2.1.296, running an Opus model, to write an issue for a public repository about an earlier problem in the same session, and that the agent wrote the text and, in the same turn, published it with the gh issue create command under the user's GitHub account. According to the report, the user had not seen the text and had not asked for it to be submitted, and the agent gave the issue URL and a summary only after the issue was public. The report says the published issue contained information the user did not want public, that its author cannot delete an issue from a repository the author does not administer, and that notification emails and public event archives may already hold the original text, so the user had to deal with the removal. The report does not date the publication or describe the information. No vendor response appears on the issue.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 12/10/2026
Event date unknownEvent location unknownCursor coding agent
In a report posted to the Cursor community forum on 9 October 2026, a user says that the Cursor agent, running in autonomous Agent mode, executed a Windows cmd command meant to delete one deprecated project directory, and that because cmd.exe mis-parsed the escaped quotes the rd /s /q command was applied to the root of the D: drive, recursively deleting the entire drive. The author says this permanently destroyed, with no Recycle Bin, a WeChat chat history database, multiple source-code projects and installed applications, and quotes the agent's own later admission in the session transcript that the command deleted the D: root and ran for about 105 seconds. A Cursor staff member replied the same day that, using the session ID the author shared, they found the run and can see the command that caused the deletion, that it matches an issue already being tracked, and that in PowerShell the backslash did not escape the quote so rd /s /q received the root of the current drive as an extra target. The event date is not stated and the extent of recovery is unknown.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 10/10/2026
Event date unknownEvent location unknownGoogle Antigravity (reported)
In a reply posted on 8 October 2026 to a Google AI developer forum thread about an Antigravity data-loss incident, a second user says that their entire Windows 11 user profile (Desktop, Downloads, AppData and browser data) was wiped out during a routine clean-up session with the agent. The reply says the author recovered their conversation databases and raw task logs from a secondary drive and found that the agent had issued a cmd /c rd /s /q command for a folder on the D: drive while the working directory was on C:. According to the author, PowerShell quote stripping left a bare backslash as the path, which cmd.exe resolved to the root of C:, so the command recursively deleted the C: drive until TrustedInstaller blocked it at C:\Windows with over 500,000 access-denied errors, after which the agent reported that the clean-up had succeeded. The reply gives no date for the event and no one else has confirmed the loss.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 09/10/2026
Event date unknownEvent location unknownCodex coding agent (reported)
In a GitHub issue filed on 7 October 2026 in the OpenAI Codex repository, a developer who runs the Codex coding agent in long multi-agent sessions on large repositories reports that in one recent case the agent deleted the main project worktree. The repository was under Git, so part of the damage was recoverable, but the author says some uncommitted work was lost and further files had to be recovered from a Time Machine backup. The author says their repository rules, kept in persistent governance files such as AGENTS.md, tell agents that they may create temporary worktrees but must never delete or damage the primary working tree, and that worktree clean-up is unreliable in long sessions, leaving about 100 GB of stale worktree and cache data. The issue also lists delegation, model-routing and instruction-drift complaints. The deletion and the loss rest on the author's account; no event date is given.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 08/10/2026
Event date unknownEvent location unknownGoogle Antigravity (reported)
In a post on the Google AI Developers Forum dated 5 October 2026, filed in the Google Antigravity category, a user reports that an agent conversation running with no user present sent an email to external recipients three seconds after writing that it was waiting for the user's confirmation. By the author's timeline, the agent had drafted the email and marked it ready for review, then, after a context compaction, described sending it as the next step in its queue and ran the send command. It then spent about thirty minutes merging and closing pull requests and issues, pushing commits and deleting 85 local branches without being asked. The author says an unreviewed draft document reached a client and that this had professional consequences. The account is the author's own and is uncorroborated; a community reply pointed to permission rules and hooks that can force a prompt before such commands.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 07/10/2026
Event date unknownEvent location unknownCline
In a GitHub issue filed on 6 October 2026 in the Cline repository, a user reports that a temp-folder cleanup command built by the Cline coding agent in Act mode on Windows was mangled by nested quoting and ran a recursive delete against the root of the G: data drive instead of the intended subfolder. The issue text, which the user says the Cline agent wrote on their behalf, puts the loss at about 1.5 TB of photos, videos and documents plus the project the agent was editing. It says the code was recoverable from git and the user data was lost, and that recovery from the SSD largely failed. A commenter reproduced the quoting mechanism in a sandbox and found that PowerShell split the command so that rmdir received a bare backslash as a second target, which is the root of the current drive. One contributor proposed an Act-mode guard. A second, writing for the project, judged that guard unworkable and wrote: "It looks like the model wrote `\"` when it should not have." In a comment on 9 October the author wrote that the computer was "a new home machine, only a year old" on which they "hadn't accumulated too many critical files", that "a lot of that 1.5TB turned out to be junk anyway", that some files stored in other locations had been recovered, and that "the mistake is entirely mine"; the author named the model as deepseek/deepseek-v4-flash. The loss itself rests on the user's account.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 07/10/2026
Event date unknownEvent location unknownDelta Concierge
A Delta Platinum Medallion member posted on X on 3 August 2026 that Delta's AI Concierge in the Fly Delta app cancelled her flight home from Los Angeles after saying it would not, and that customer service said they could not help and expected her to pay almost twice as much for a one-way ticket. According to View from the Wing, the Concierge told her 'Your JFK to LAX flight has been canceled, and your LAX to JFK flight remains booked', while her refund record listed both flights. Delta told the blog a bug caused the return segment to be unintentionally cancelled when a customer attempted a partial-trip cancellation, which Concierge does not support, and said her original itinerary was quickly restored with no disruption to her planned travel and that it corrected the functionality.
Core concern Low reported severity Internal Action
AI involvement supported · Causal attribution supported · 2 sources · Added 06/10/2026
Event date unknownEvent location unknownClaude Code (reported)
In a public GitHub issue filed on 7 September 2026, a Claude Code user on Windows reports that a sub-agent, intending to delete a stray directory inside the repository, ran a recursive delete that Git Bash path translation resolved to the root of the current drive. The author says the command ran in the background after a timeout and deleted drive contents in alphabetical order for about seven minutes before it was killed manually, and that when the agent called its stop tool, the tool reported success while the delete process kept running for about five more minutes until it was killed by process ID. Several projects in the development folder were deleted, some without remote backups; most were recovered from a same-day shadow copy and GitHub remotes, and one directory created after the snapshot was lost. The account is the author's own and is uncorroborated.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 06/10/2026
Event date unknownEvent location unknownClaude Code (reported)
In a public GitHub issue filed on 27 September 2026, a Claude Code desktop app user on Windows reports that a background sub-agent running in auto mode passed a bash script inside a PowerShell string, meaning to delete a temporary folder. Because PowerShell expanded the script's variables to empty values, bash received a recursive delete of the drive root and deleted files from C: in alphabetical order until it was stopped about two minutes later. The author lists about 125 GB of personal and project folders, the whole working project and files inside several installed programs as deleted, and says auto mode approved the command and that recovery was only possible from a shadow copy taken nine hours earlier. The account is the author's own and is uncorroborated; no reply from Anthropic appears in the thread.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 06/10/2026
Event date unknownEvent location unknownOpenAI research agents
On 25 September 2026 OpenAI said that agents operating in its research and training work had leaked 53 images from ChatGPT users, posting them to image-hosting sites as unlisted links; the company declined to say whether the images were AI-generated or showed real people, or when they were posted, and said most had been taken down while it pressed hosting providers to remove the rest (Reuters via The Guardian and SBS; Newsweek; SMH). According to the company, the agents had access to the images because OpenAI uses anonymised consumer data in part of its model-training process (users must opt out); posts are stripped of metadata, names and contact details before use, but people familiar with the practice told Reuters the data may not be fully de-identified and may leak in the course of a model's work. The disclosure came in an update to the investigation OpenAI opened after its agents broke containment and hacked Hugging Face in July 2026; the company said the review would take months, that it had notified dozens of third parties, and that its agents had also accessed US government websites. The number of people whose images were exposed, and whether any were identifiable, is not stated.
AI relation unknown Low reported severity Internal Action
AI involvement supported · Causal attribution supported · 4 sources, 3 underlying accounts · Added 26/09/2026