Event date unknownEvent location unknownCursor coding agent
In a report posted to the Cursor community forum on 9 October 2026, a user says that the Cursor agent, running in autonomous Agent mode, executed a Windows cmd command meant to delete one deprecated project directory, and that because cmd.exe mis-parsed the escaped quotes the rd /s /q command was applied to the root of the D: drive, recursively deleting the entire drive. The author says this permanently destroyed, with no Recycle Bin, a WeChat chat history database, multiple source-code projects and installed applications, and quotes the agent's own later admission in the session transcript that the command deleted the D: root and ran for about 105 seconds. A Cursor staff member replied the same day that, using the session ID the author shared, they found the run and can see the command that caused the deletion, that it matches an issue already being tracked, and that in PowerShell the backslash did not escape the quote so rd /s /q received the root of the current drive as an extra target. The event date is not stated and the extent of recovery is unknown.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 10/10/2026
Event date unknownEvent location unknownGoogle Antigravity (reported)
In a reply posted on 8 October 2026 to a Google AI developer forum thread about an Antigravity data-loss incident, a second user says that their entire Windows 11 user profile (Desktop, Downloads, AppData and browser data) was wiped out during a routine clean-up session with the agent. The reply says the author recovered their conversation databases and raw task logs from a secondary drive and found that the agent had issued a cmd /c rd /s /q command for a folder on the D: drive while the working directory was on C:. According to the author, PowerShell quote stripping left a bare backslash as the path, which cmd.exe resolved to the root of C:, so the command recursively deleted the C: drive until TrustedInstaller blocked it at C:\Windows with over 500,000 access-denied errors, after which the agent reported that the clean-up had succeeded. The reply gives no date for the event and no one else has confirmed the loss.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 09/10/2026
Event date unknownEvent location unknownCline
In a GitHub issue filed on 6 October 2026 in the Cline repository, a user reports that a temp-folder cleanup command built by the Cline coding agent in Act mode on Windows was mangled by nested quoting and ran a recursive delete against the root of the G: data drive instead of the intended subfolder. The issue text, which the user says the Cline agent wrote on their behalf, puts the loss at about 1.5 TB of photos, videos and documents plus the project the agent was editing. It says the code was recoverable from git and the user data was lost, and that recovery from the SSD largely failed. A commenter reproduced the quoting mechanism in a sandbox and found that PowerShell split the command so that rmdir received a bare backslash as a second target, which is the root of the current drive. One contributor proposed an Act-mode guard. A second, writing for the project, judged that guard unworkable and wrote: "It looks like the model wrote `\"` when it should not have." In a comment on 9 October the author wrote that the computer was "a new home machine, only a year old" on which they "hadn't accumulated too many critical files", that "a lot of that 1.5TB turned out to be junk anyway", that some files stored in other locations had been recovered, and that "the mistake is entirely mine"; the author named the model as deepseek/deepseek-v4-flash. The loss itself rests on the user's account.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 07/10/2026
Event date unknownEvent location unknownClaude Code (reported)
In a public GitHub issue filed on 7 September 2026, a Claude Code user on Windows reports that a sub-agent, intending to delete a stray directory inside the repository, ran a recursive delete that Git Bash path translation resolved to the root of the current drive. The author says the command ran in the background after a timeout and deleted drive contents in alphabetical order for about seven minutes before it was killed manually, and that when the agent called its stop tool, the tool reported success while the delete process kept running for about five more minutes until it was killed by process ID. Several projects in the development folder were deleted, some without remote backups; most were recovered from a same-day shadow copy and GitHub remotes, and one directory created after the snapshot was lost. The account is the author's own and is uncorroborated.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 06/10/2026
Event date unknownEvent location unknownClaude Code (reported)
In a public GitHub issue filed on 27 September 2026, a Claude Code desktop app user on Windows reports that a background sub-agent running in auto mode passed a bash script inside a PowerShell string, meaning to delete a temporary folder. Because PowerShell expanded the script's variables to empty values, bash received a recursive delete of the drive root and deleted files from C: in alphabetical order until it was stopped about two minutes later. The author lists about 125 GB of personal and project folders, the whole working project and files inside several installed programs as deleted, and says auto mode approved the command and that recovery was only possible from a shadow copy taken nine hours earlier. The account is the author's own and is uncorroborated; no reply from Anthropic appears in the thread.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 06/10/2026