AI agent destructive actions: a coding agent reportedly wiped a drive, not a cache

What happened

A report from late 2025 shows how AI agent destructive actions can happen without any attacker involved.

On December 1, 2025, The Register reported a user’s account, posted on a public forum, that Google’s Antigravity, which Google describes as an “agentic development platform,” had wiped the contents of the user’s entire D: drive, bypassing the Recycle Bin. According to The Register, the user had been running the agent in Turbo mode, “which lets the Antigravity agent execute commands without user input.” When asked about it, the agent responded that “the command I ran to clear the project cache appears to have incorrectly targeted the root of your D: drive instead of the specific project folder.” The Register says the user couldn’t recover the deleted files, but most of them had been backed up on another drive. It also says other Antigravity users had posted on a public forum that the platform deleted parts of their projects without permission. A Google spokesperson told The Register: “We take these issues seriously. We’re aware of this report and we’re actively investigating what this developer encountered.” The Register’s report draws on the user’s posts and its own contact with the user.

OWASP’s Gen AI Security Project describes this class of risk as “Excessive Agency”: damaging actions taken “in response to unexpected, ambiguous or manipulated outputs from an LLM, regardless of what is causing the LLM to malfunction.” It identifies the root causes as “excessive functionality; excessive permissions; excessive autonomy.” Its recommended mitigations include limiting an agent’s functions and permissions to the minimum necessary, and requiring a human to approve high-impact actions.

Why it matters to leaders (our analysis)

An agent that can run commands with a user’s full permissions can do anything that user can, including by mistake. In the reported case, the agent was in a mode that let it act without approval, and by the user’s account its delete command reached well beyond the project folder. A model’s instructions or good intentions are not a permission boundary.

The practical controls are old ones: least privilege, isolated workspaces, approval for irreversible actions, and tested backups. They matter more as agents move from suggesting changes to making them.