An AI agent ran a safety check to prove it could never delete the developer’s machine. It deleted the machine.

The safety test!

Setting off the bomb to see whether the blast can be contained — the test and the disaster were the same event.

What happened

In late August 2026, developer Sebastien Guillemot posted four sentences that every engineer using coding agents should read twice: “Fable nuked my entire dev machine. Claude decided to test a sandbox it was building by running rm -rf on my home directory. The sandbox didn’t work. It’s all gone.”

The task could not have been more routine. He asked the agent for a housekeeping script: give each AI agent its own scratch folder inside /tmp — the standard place for temporary files — and delete that folder when the agent finishes. Because the script deletes things, the agent did what a careful engineer would do: it wrote a safety test, to prove the script would refuse to delete anywhere dangerous — the user’s home directory above all.

The test passed. The script refused the dangerous target, exactly as designed. And then the test’s own tidy-up step ran rm -rf — delete everything, permanently, no recycle bin — against the home directory anyway. Roughly 700 GB and about a week of work were gone before Guillemot could stop the process. The /tmp junk the script existed to clean up was left untouched. Tom’s Hardware’s report adds one more wrinkle: an automatic model switch mid-task may have contributed — though that remains speculation, and the failure itself needs no help from it.

The one confused box

Strip away the drama and the mechanism is almost insultingly small. The test needed to hold a path in a variable — think of a variable as a labelled box the code reaches into later. Into that box went the pretend target: the home directory, the place the script must never touch, held there so the test could check the script said no. It did say no.

But tests leave their own litter behind, so the test ended with a clean-up of its own — and that clean-up reached into the same box, expecting to find its scraps. The box still held the home directory. Illustratively:

TARGET="$HOME"          # the pretend danger: prove the script refuses this
check_refuses "$TARGET"   # it does — test passed

# ...later, the test tidies up after itself:
rm -rf "$TARGET"          # meant the test's scraps. The box still held $HOME.

A human reviewer scanning that script might catch it — or might not; variable reuse is among the oldest bugs there is. What a human would not do is write it, decide it was safe, and execute it against a live machine in the same breath, with no one else in the loop. The agent did all three at machine speed. That is the new part. Not a new class of bug — a new class of blast radius, because generation, review and execution collapsed into one uninterrupted act by one actor.

Not a freak accident — a class

Stylosa’s report on another incident in the same class — an AI agent deleting at machine speed. Different victim, same shape of failure.

If this were one unlucky afternoon it would be an anecdote. It is not. Tom’s Hardware separately reports another agent wiping a developer’s entire profile directory after mistaking it for a temporary backup — and apologising for the “typo”. The Claude Code project has an open public issue for unsafe rm execution deleting a home directory, and developers keep publishing their own post-mortems of the same shape. The pattern underneath is always the same one: an autonomous tool that can write a destructive command is one small confusion away from running it against the wrong target, faster than any human can intervene.

What no scanner can save you from — said plainly

Here is the part a security page owes you straight: no code scanner — ours included — prevents a runtime rm -rf on a developer’s laptop. That command ran and finished before any review could exist. Anyone who tells you their product would have stopped this specific accident is selling you a story. The controls that address this incident are older and duller: agents run with the least permissions they need, destructive commands require a human hand, and backups are tested before they are needed.

The only thing left standing

Now the detail that matters most, and the reason this story belongs on a code-security site at all: Guillemot got most of his week back. Not from the machine — the machine was gone. From git: his repositories, configurations and session logs. When the agent’s blast radius swallowed everything it could reach, the version-controlled record was the thing outside the radius. The repository was the only structure left standing.

That is exactly the ground Code Delta’s threat detection stands on, and it is why the honest claim is stronger than the fake one. The repo is where an agent’s work becomes permanent — what it committed, what its code calls, what its build steps fetch, what credentials it left behind — and permanence is precisely what you can gate. Five deterministic layers read that record, and a merge gate refuses what should never land, with no model in the loop making judgement calls about its own behaviour. An agent’s account of itself failed at Replit; an agent’s safety test failed here. The repository record does not take the agent’s word for anything — and neither do we. Get Code Delta now — free to evaluate, nothing leaves your network.