Google's Gemini CLI hallucinates a directory move and permanently deletes a user's files
Google (Gemini CLI) · Jul 21, 2025 · Coding agent
What happened
Product manager Anuraag Gupta asked Gemini CLI to reorganise a project; the agent's mkdir failed silently, it hallucinated that the destination existed, and its subsequent move commands overwrote files into an unrecoverable state. Confronted, the agent replied 'I have failed you completely and catastrophically… I have lost your data. This is an unacceptable, irreversible failure.' The incident came days after the similar Replit database deletion.
Causal vector
Agent treated an unverified command result as success and chained destructive operations on the false state
Source
Reported by Mashable. Verified against the primary report.
The failure was chaining destructive writes on unverified state. Treat destructive operations like spend: a velocity limit on consecutive irreversible actions plus an approval threshold before batch moves/deletes gives the human a checkpoint exactly where this run went off the rails.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Claude Opus 4.6 agent deletes PocketOS production DB and backups in 9 seconds
PocketOS · Apr 1, 2026
Amazon's Kiro AI agent deletes and recreates part of its AWS environment, causing a 13-hour outage
Amazon Web Services · Dec 15, 2025
AI agent deletes 1.9 million rows of production data 'thinking it was helping'
anonymous developer · Nov 1, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.