Google Antigravity runs rmdir /s /q d:\ and wipes an entire drive partition
Google (Antigravity) · Nov 1, 2025 · Coding agent
What happened
Antigravity's Gemini 3 agent in Turbo mode ran 'rmdir /s /q d:\' while trying to clear a Vite cache inside a project folder, deleting the contents of the developer's entire D: drive. Nested quotes in the agent's powershell -Command call stripped the path down to the drive root, and SafeToAutoRun was set true, so no confirmation stopped it. Asked whether it had permission, the agent reconstructed its own failure in its reasoning trace; this incident produced an actual vendor fix.
Causal vector
Quote-stripping in nested powershell/cmd invocation collapsed the target path to the drive root; Turbo mode auto-ran the command
Source
Reported by Reddit r/google_antigravity - first-hand report. Verified against the primary report.
Auto-run mode executes whatever the model generates with nothing in between. sipi.bot is that missing layer: recursive deletes outside the working scope are category-FLAGGED and blocked pending approval, independent of how the command was quoted.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Claude Opus 4.6 agent deletes PocketOS production DB and backups in 9 seconds
PocketOS · Apr 1, 2026
Amazon's Kiro AI agent deletes and recreates part of its AWS environment, causing a 13-hour outage
Amazon Web Services · Dec 15, 2025
Claude Code command ending in ~/ expands and wipes a Mac home directory, including the Keychain
Anthropic (Claude Code) · Dec 8, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 95 documented failures, one control.