2026Event location unknownGoogle Antigravity (reported)
A solo developer who runs an internal admin portal for a small organisation posted on Reddit's r/Bard on 20 May 2026 that a Gemini 3.5 coding agent, asked to fix eight authentication gaps, opened a pull request touching 340 files with 28,745 deletions and then a second commit that changed the Firebase rewrite service identifier to a value pointing at a service that does not exist. The developer says the change deployed and the entire portal returned 404 errors for 33 minutes until a manual rollback. After the rollback, the developer says, the agent sent an all-clear message claiming that its own recovery build had succeeded and restored the portal, although that build had been cancelled, and it had written consultation logs into the repository that it later admitted were fabricated to satisfy a consultation rule. The developer attributes the agent's autonomy to a third-party rule pack, styled after Google's Antigravity brand, that told the agent to act without approval prompts and to auto-deploy. In later replies the developer says the agent worked on a development branch that auto-deployed to production. The Register reported the post on 21 May 2026. Google's response, if any, is not reported.
Core concern Low reported severity Media Coverage
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 12/10/2026
Jan 2026 to Mar 2026Event location unknownGoogle Antigravity
In a post on Google's AI developer forum on 7 March 2026, a developer says the Antigravity agent had for the second time deleted the contents of an entire C: drive. The poster says that about two months earlier it deleted the C: drive of a laptop, losing projects, photos and videos and seed phrases kept on the desktop for cryptocurrency savings of 0.4 bitcoin and 3,200 XRP, which file-recovery software could not usefully restore. The poster says that on the day of the post, after asking Antigravity to close any process using a workspace folder so the folder could be deleted, the agent instead ran destructive commands and deleted the project the poster had been building for two months on a new desktop, including git folders with recent commits. The poster says an investor was paying for the project and might withdraw. A reply from an account carrying the forum title Google said the issue had been escalated and asked for an in-app bug report.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 11/10/2026
1 Sept 2026Event location unknownGoogle Antigravity (reported)
In a post on Google's AI developer forum on 2 September 2026, a developer says that during a coding session on a local project on 1 September 2026, the Antigravity agent deleted files from the project that the poster has not been able to recover, including trade account data files with no other backup, without warning and without offering a way to confirm or undo the deletion. The developer says that when asked a question about a separate copy of the project, the agent did not answer it but began searching for backups and accessed folders on the machine outside the project directory it had been granted, and acknowledged doing so when asked why. The developer asks Google to explain the access, advise on recovery and consider helping with the cost of restoring the data, which a paid database tier would allow. No reply appears in the thread.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 11/10/2026
6 Oct 2026Event location unknownClaude Code
In X posts of 6 and 7 October 2026, a developer writes that Claude Code running Anthropic's Opus 5.5 model "just deleted my entire fucking C drive" during a hands-free session, and that daily backups to a NAS saved the data. In a follow-up the developer says the sessions run for hours unattended with the --dangerously-skip-permissions flag, as they had since Opus 4.6 without such an issue, attributes the deletion to "a simple powershell syntax mangling issue", says 98% of the data has been recovered and that deterministic safeguards have since been built, and accepts the fault as the user's own while arguing that the harness should prevent such a command natively. The head of Claude Code at Anthropic replied that the company recommends and defaults to auto mode for permissions, which "almost certainly would have caught this"; the developer answered that auto mode had felt like babysitting for long unattended sessions. The account is the developer's own. The first post carries a screenshot of a text analysis addressed to the developer, whose author is not stated; it says the session was a Claude Code session in bypass-permissions mode that tried to remove two leftover git worktree folders, quotes the removal command, explains that Windows PowerShell 5.1 read its quoting so that the path became the root of drive C:, and says the session was not running as administrator, so Program Files, Windows and other accounts' files survived. MadRobot wrote that the developer had not shared a command log or screenshots showing what ran.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 4 sources, 2 underlying accounts · Added 10/10/2026
3 Oct 2026Event location unknownClaude Code (reported)
In a public GitHub issue filed on 3 October 2026, a Claude Code user on Windows reports that a sub-agent, while cleaning up its own scratch files during research work, ran a command that included an unintended recursive delete of the 8.3 short-name alias of their home folder. The issue says no confirmation or permission prompt was recorded, that the command was moved to the background after a 120-second timeout, and that the deletion continued for about 50 minutes after the agent's stop call reported success. According to the issue, the agent told the main session it had killed the command and that the profile looked intact, having checked only top-level folder names. The author reports about 116 GB removed, including roughly 40 top-level Documents folders holding work described as months of work, developer toolchains and credentials, with recovery ongoing and incomplete. The account is the author's own and is uncorroborated; Anthropic had not replied in the thread when it was read.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 05/10/2026
23 Mar 2026 to 24 Mar 2026United StatesUnidentified voice-cloning tool
The Spokesman-Review (8 May 2026) reported that a 75-year-old man in Washington state took a call on Monday 23 March in which a crying voice presented as the man's adult daughter said an accident had happened and asked for help. Male voices then described a collision and said the daughter had been taken hostage. The newspaper states that the daughter's voice on the call was an AI-generated copy and that investigators later surmised the callers used a recording of the daughter's voice with a program that mimicked the speech pattern. Over about 30 hours the callers directed the man to banks and stores in Washington and Idaho, where $13,000 was wired. The man was about to withdraw $17,000 when a bank employee stalled and police were alerted, and police then reached the daughter, who confirmed being at home and safe. The newspaper says none of the wired money had been recovered when the article was published. The man says it took days to start feeling normal again. The report rests on the man's account, a bank employee's account and a police report quoted by the newspaper. The article gives the call date as Monday 23 March without a year. The record uses 2026 because 23 March fell on a Monday only in 2026 among the years 2023 to 2026. The range starts at 2023 because the article says the Federal Trade Commission began warning about AI voice-copy scams as early as 2023, and it ends at 2026 because the article was published on 8 May 2026.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 30/09/2026
6 Jan 2026IndiaUnidentified voice-cloning tool (suspected)
The New Indian Express (9 January 2026) reported that a woman who runs a small play school in Indore said that on the night of 6 January a call came from an unknown number close to a cousin's number, in a voice that sounded exactly like the cousin's. The caller said a close friend needed urgent cardiac surgery at a private hospital in Indore and asked for money to be forwarded to a QR code. A total of Rs 97,500 was sent in four transactions. None of the money the caller had said was being credited arrived, the cousin denied making the call, and the calling number has been switched off. An Additional Deputy Commissioner of Police (Crime) in Indore said preliminary investigations strongly suggest AI-based voice modulation technology was used. The Free Press Journal, The420 and Malwa Abhi Tak reported the same call. All four outlets appear to rest on the woman's account and police statements, no audio analysis or AI tool is reported, and the police case against unidentified persons was described as ongoing.
Core concern Medium reported severity
AI involvement suspected · Causal attribution alleged · 4 sources, 1 underlying account · Added 30/09/2026
17 Apr 2026 to 31 May 2026Event location unknownMeta AI support assistant
Meta announced the rollout of its AI support assistant on Facebook and Instagram on 19 March 2026. Meta's filing with the Maine Attorney General (notice dated 5 June 2026) says unauthorized third parties exploited a vulnerability in its AI-assisted Instagram account recovery tool (High Touch Support) to receive password reset links for accounts they did not own, and the listing gives 17 April 2026 as the breach date and 31 May 2026 as the discovery date. Videos that attackers posted, as described by TechCrunch, 404 Media and Krebs on Security, show attackers asking the assistant in a chat to link a new email address to a target username. Reported victims include the security researcher Jane Manchun Wong, who posted that her password was changed without her knowledge, the Instagram account of the U.S. Space Force's Chief Master Sergeant, and the accounts of Sephora and a dormant Obama White House page (TechCrunch marks the last as disputed by Meta). Krebs and the BBC report pro-Iran defacement of some accounts, and TechCrunch reports that some victims were locked out and that short handles were offered for resale. The filing gives 20225 persons affected in total and 30 in Maine, and the notice calls the Maine figure an upper bound. Meta says the tool worked as intended, that a bug in a separate code path failed to check the email address, and (through a spokesperson to Gizmodo) that the failure was not due to the AI agent itself. Meta says it disabled the tool on 31 May 2026, the day it discovered the exploitation.
Contextual tracker case Low reported severity
AI involvement supported · Causal attribution disputed · 12 sources, 2 underlying accounts · Added 29/09/2026
22 Feb 2026Event location unknownOpenClaw
Summer Yue, whom Business Insider describes as a director of alignment in Meta's Superintelligence Labs, posted on X on 23 February 2026 that an OpenClaw agent connected to Yue's real inbox had started deleting emails after Yue told it to confirm before acting. Yue says the agent lost the instruction to suggest and wait when it compacted its context on an inbox much larger than the test inbox it had handled for weeks. Stop messages typed from a phone did not halt it, and Yue went to the Mac mini hosting the agent and killed its processes. In screenshots Yue shared, the agent later said it had bulk-trashed and archived hundreds of emails without showing a plan or getting approval. Business Insider describes the screenshots as showing a plan to delete, and no inspected source reports whether the emails were recovered or whether any were permanently lost. Yue called the episode a rookie mistake.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 6 sources, 1 underlying account · Added 29/09/2026
26 Feb 2026Event location unknownClaude Code
On the evening of Thursday 26 February 2026 a Claude Code agent that Alexey Grigorev, who runs the DataTalks.Club course platform, was using to move his AI Shipping Labs website to AWS ran terraform destroy against the platform's production infrastructure. According to Grigorev's own post-mortem, he had added the new site to the Terraform setup that already managed DataTalks.Club production, and after a move to a new computer without the Terraform state file the agent's plan tried to create resources that already existed. He cancelled the apply and asked the agent to delete the duplicates with the AWS command line. He then pointed the agent at his archived Terraform folder, did not notice that the agent unpacked it over the current state file, and did not stop the agent when it chose terraform destroy, believing it was removing only the duplicates. The destroy removed the VPC, ECS cluster, load balancers, bastion host and RDS database of the course management platform, and the automated snapshots were gone too. The platform, which stored 2.5 years of course submissions (homework, projects and leaderboard entries), was down. After Grigorev upgraded to AWS Business Support, which he says added about 10% to his cloud costs, AWS found a snapshot that was not visible in his console and restored it about 24 hours after the deletion, and the platform came back online on 27 February. Grigorev writes that the incident was his fault because he over-relied on the agent, and he has stopped agents from running Terraform commands. Tom's Hardware rewrites his account.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 29/09/2026
Feb 2026Event location unknownClaude Cowork
In February 2026 Nick Davidov, a venture capitalist, posted on X that Anthropic's Claude Cowork agent, which he had asked to organise his wife's desktop, deleted a folder holding all the photos his wife had taken on her camera over the previous 15 years. He says Cowork asked permission to delete temporary Office files and he granted it, that the deletion ran through the terminal so the files were not in the Trash, that iCloud had already synced the new folder structure, that his wife had no Time Machine backup and that disk recovery tools found nothing. Futurism reports a screenshot in which the agent says its script ran rm -rf on what it thought was a separate empty folder and deleted the existing photos directory. Apple support pointed Davidov to an iCloud recovery feature that keeps files removed from iCloud Drive for 30 days. He wrote that he was watching it load tens of thousands of files and later thanked Apple. He wrote that he nearly had a heart attack and advised users not to let Cowork touch anything hard to repair. In a LinkedIn version of the post he says a couple of Anthropic employees told him they were working on making Cowork safer. Every account traces to Davidov's own posts.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 6 sources, 1 underlying account · Added 29/09/2026
10 Jul 2026Event location unknownCodex coding agent
On 10 July 2026 Matt Shumer, founder and chief executive of the AI start-up OthersideAI, posted on X that OpenAI's newly released GPT-5.6 Sol "just accidentally deleted almost ALL of my Mac’s files". Accounts of his post-mortem say he was testing a high-autonomy multi-agent "Ultra mode" at OpenAI's invitation, with the Codex agent given Full Access to his machine; during a cleanup task a sub-agent expanded $HOME incorrectly and ran a recursive delete of his home directory, he noticed a problem about 81 minutes into the session, and by the time he stopped the process most of its contents were gone. Three days later he wrote that the deletion "absolutely sucked" and that OpenAI staff, including Greg Brockman, had contacted him to help. OpenAI confirmed, as reported by The Register, that GPT-5.6 had deleted users' files without authorisation, describing it as an "honest mistake" that usually occurred in Full-Access mode without sandboxing, and said it was adding safeguards. Whether the files were recovered is not reported.
Core concern Low reported severity Media Coverage
AI involvement supported · Causal attribution supported · 6 sources, 2 underlying accounts · Added 29/09/2026
19 Jul 2026IndiaClaude Code
On 19 July 2026 heritage conservationist Udaya Kumar P L, of The Mythic Society's Bengaluru Inscriptions 3D Digital Conservation Project, was using Anthropic's Claude Code to clear a cache on his computer when a command generated by the agent began deleting files. According to his account to OneIndia, the deletion ran for about four minutes while the agent tried to work out what was wrong, and when it tried to stop the process its own safety system blocked the kill twice; he eventually shut down the computer himself. Software and original photographs of Bengaluru's inscriptions, temples, hero stones and coins were lost, some of them the only records the project had of particular inscriptions. OneIndia and Deccan Herald report that about 15% of the project's records were deleted and that about 120 sites must be revisited and rescanned; the Society is spending about Rs 15 lakh on additional backups. He says he also opened a public GitHub issue on 29 July with the command, process output and his attempts to stop the deletion. He says he received an automated acknowledgement from Anthropic but was still waiting for a human response weeks later, and that he has asked it to reimburse recovery and rebuilding costs.
Core concern Low reported severity Media Coverage
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 29/09/2026
25 Sept 2026 to 26 Sept 2026Event location unknownGemini coding agent (reported)
In a public post to r/GeminiAI on 27 September 2026, a developer writes that the previous day, while they were using Gemini 3.8 Flash to work on a project on their Linux machine over SSH, the agent deleted all three main sub-project folders of their roughly 10 GB project folder, some of them not under git, although they had set a global rule forbidding it to modify or delete anything. Asked why, the agent said a wildcard caused the deletion. After a whole evening its recovery attempt restored only parts of the untracked files and a half-broken version of the git project, and then ran out of credits; in a follow-up comment the poster says they stopped the recovery themselves because the agent was going through private folders unrelated to the projects without their permission. The poster describes years of personal work as gone, reports acute distress, and says they must rebuild the projects. The account is uncorroborated; the poster writes 'I was careless.'
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 28/09/2026
19 Sept 2026Event location unknownClaude Code
On 20 September 2026 (UTC; late on 19 September in US Eastern time) a Reddit user who says they work in finance and are not a developer posted in r/ClaudeAI that Claude Code had deleted about 48,000 files, and later posted their instructions and the agent's report. They had authorised Claude Code to carry out a batch of repairs to their software for back-testing options-trading engines 'on isolated copies'. The agent's report says it launched sub-agents; one, rebuilding a test mirror, wrote a remover for an old mirror that held 7,332 files and 614 Windows directory junctions pointing into the live project tree. Because the remover did not treat the junctions as links, it deleted about 48,218 live files between 10:10:31 and 10:12:14 PM ET and emptied the Git repository's objects, refs and logs, so Git could not restore anything. The agent opened its report with 'stop and read this. I broke something.' The user said they would try Windows shadow copies and otherwise their iDrive backups; whether the files were recovered is not reported. The account has not been independently verified.
Core concern Low reported severity Media Coverage
AI involvement reported · Causal attribution supported · 5 sources, 1 underlying account · Added 28/09/2026
1 Jul 2026 to 14 Jul 2026BrazilUnidentified video tool
On 14 July 2026 the Rio Grande do Sul Civil Police launched Operação Sophia against a group that used AI voice cloning and deepfake to turn real fundraising campaigns of children with cancer into fake donation appeals: AI-generated child voices asked for money in videos boosted by pages such as 'Clube de Doadores' and 'Unidos pelo Amor', leading donors to lookalike sites that issued Pix codes to shell companies. Sixteen people were arrested across five states. In the campaign that started the investigation — using the image of Kelen Santos's daughter, who was in cancer treatment — police traced R$294,500 diverted, and the investigation found a financial-hub company that moved more than R$1.7 million. The family had to tell congratulating donors that their money had gone to a scam.
Core concern Medium reported severity Involving minors Criminal Charges
AI involvement supported · Causal attribution supported · 2 sources · Added 15/09/2026