I Have Failed You Completely and Catastrophically
- Admitted
- 2026-08-17
- Source dataset
- Other / sample
- Failure mode
- Destructive action
- Agent system
- Tool-calling
- Tool access
- System admin
- Industry
- Software development
Presenting Behaviour
A developer asked a coding agent to clean up packages in an old project directory. The agent ran a recursive delete command that expanded to target the user's entire home directory rather than the intended project subfolder. Thousands of the delete attempts failed with permission errors against protected system files, but every file the user actually owned was deleted before the run was interrupted, weeks of unrelated project work included, none of it backed up.
Case Replay
A reconstruction, not a simulation. This sequence is reconstructed from the public incident record and summarised in our own words. It is a static record of what was reported, and nothing here can be run or replayed live.
5 steps
- Cleanup request. A developer asks the agent to clean up packages in an old project directory.
- Path expands. The recursive delete targets the user's whole home directory. This is where the agent derailed.
- Files deleted. Everything the user owned is deleted; system files resist.
- Interrupted. The run is stopped after the damage is done.
- No command log. The exact command was never recorded, only its output.
Differential Diagnosis
Disinhibition (correct understanding of scope, paired with no restraint against acting beyond it), considered. The outcome (deleting far more than intended) resembles a scope violation. But the available evidence points to the boundary itself being computed incorrectly, rather than a boundary being understood and then ignored.
Malingering, considered and ruled out. There's no external check or measurable reward this action was optimizing for; deleting the user's own project files served no goal, real or gamed.
Apraxia (correctly understanding the intended action (delete some specific, scoped set of files) while the actual mechanics of expressing that scope in the command failed catastrophically), most consistent with the incident. The agent had the right general idea, cleaning up an old project, and the right general tool, a delete command, but whatever produced the actual path expansion turned a narrow, intended target into the broadest possible one.
Working Diagnosis
Apraxia: the agent's intended action was a scoped cleanup, and its chosen tool was appropriate for that; the failure was specifically in how the target path was constructed and executed, expanding a narrow instruction into a command with no effective boundary.
Discussion
The most alarming part of this report isn't the deletion, it's that the exact command that ran was never logged anywhere the developer could later inspect, only its output. An agent that can run destructive filesystem commands needs two independent safeguards: a hard confirmation step before any broad or recursive delete, and a complete, unfilterable log of the literal command executed, not just a summary of what it was trying to do.
Mitigation Strategy
Require confirmation before broad or recursive deletes, and keep a complete log of the literal command executed.
Governance Guardrails
Hard confirmation step for recursive deletes; unfilterable command logging; backups of user data.
Typical Presentation in Human Patients
General clinical background, included for context. Not medical advice, and not a diagnosis of any individual.
Apraxia usually follows damage to specific brain regions, often after a stroke. A person with apraxia cannot carry out a previously familiar, purposeful movement (such as waving goodbye or using a comb) on request or by imitation, even though their muscle strength, coordination, and understanding of what's being asked are otherwise intact.
Source Note
GitHub, anthropics/claude-code issue #10077
https://github.com/anthropics/claude-code/issues/10077