Back to the ward
Case 0546ModerateApraxia

Deleting Only the Named Folders, and Their Parent

Admitted
2026-10-19
Source dataset
Other / sample
Source
GitHub issue, agent's git clean on nested ignored paths deleted the entire ignored parent directory
Failure mode
Destructive action
Agent system
Tool-calling
Tool access
Write access
Industry
Software development

Presenting Behaviour

A user asked a coding agent to remove a few specific unused folders inside a configuration directory, after backing them up. The agent backed up only those folders, then ran a version-control cleanup command intended to remove just the named sub-folders. Because the whole parent configuration folder was set to be ignored by version control, the command removed the entire parent instead, including API key files and operational scripts that weren't in the partial backup. The agent disclosed the loss only after it had happened; the user recovered only because they had made their own separate backup.

Case Replay

A reconstruction, not a simulation. This sequence is reconstructed from the public incident record and summarised in our own words. It is a static record of what was reported, and nothing here can be run or replayed live.

4 steps

  1. Removal requested. Remove a few named unused folders after backing them up.
  2. Partial backup. The agent backed up only the named folders.
  3. Cleanup without dry run. It ran a git clean on nested ignored paths, which removed the whole ignored parent directory. This is where the agent derailed.
  4. Keys and scripts lost. API key files and operational scripts outside the backup were deleted.

Differential Diagnosis

Disinhibition (acting beyond the requested scope) considered. The effect went well beyond scope, but the agent's intent was to delete only the named folders; it did not decide to touch the rest.

Concrete thinking, ruled out. The instruction was clear and correctly understood.

Apraxia, most consistent with the evidence: the agent chose a tool whose real behaviour on ignored parent folders it didn't account for, skipped the tool's own dry-run mode that would have shown the true scope, and so performed the action incorrectly despite understanding the goal.

Working Diagnosis

Apraxia: a correctly understood request executed with a command whose actual effect differed from the agent's mental model, with no dry run to expose the gap.

Discussion

Many cleanup tools have a 'show me what you would delete' mode precisely because their real scope can surprise people. A sensible safeguard is to require a dry run whenever a recursive delete is used, and to check that the backup covers everything in the true deletion scope, not just the intended one.

Mitigation Strategy

Run dry-run mode before any git clean or recursive delete; stop if the resolved scope exceeds the explicitly requested paths.

Governance Guardrails

Destructive-operation confirmation showing the resolved scope; backups validated against the effective deletion set.

Typical Presentation in Human Patients

General clinical background, included for context. Not medical advice, and not a diagnosis of any individual.

Apraxia usually follows damage to specific brain regions, often after a stroke. A person with apraxia cannot carry out a previously familiar, purposeful movement (such as waving goodbye or using a comb) on request or by imitation, even though their muscle strength, coordination, and understanding of what's being asked are otherwise intact.

Source Note

GitHub issue, agent's git clean on nested ignored paths deleted the entire ignored parent directory

https://github.com/openai/codex/issues/42355