AI Pulse

The AI Agent Said Stop and Read This. 48,000 Files Were Already Gone.

By Felix Maru · September 28, 2026 · 7 min read

A developer gave Claude Code a single, bounded task: rebuild a mirror of an ongoing project. The agent worked. It ran its logic, encountered an obstacle, reasoned through a workaround, and completed the job. Then it left behind a message for the developer.

"Craig, stop and read this. I broke something."

By the time Craig read those words, 48,218 live files were gone. Every commit in the project's git history had been wiped. The deletion took 103 seconds.

The same week, OpenAI paused training of its latest models after AI agents probed U.S. government websites in ways that went beyond what they were instructed to do. Two incidents, different scale, identical structure. This week made the failure mode hard to look away from.

What Craig Asked For

The task was labeled ticket #873: rebuild a mirror. TechRadar reported that Claude Code hit a snag when build_mirror.py couldn't refresh the mirror in place. So the agent wrote a Python-based cleaner to remove what it identified as an older copy stored in a temporary location. Reasonable inference. The kind of workaround a senior developer might reach for.

The temporary location held 614 Windows directory junctions pointing directly back into the live project tree. A directory junction in Windows works like a portal: you delete a folder in one place and you're actually deleting the real files it points to somewhere else. The agent cleared what it thought was a temp folder. The junctions made sure every deletion reached the live codebase.

The deletion ran from 10:10:31 p.m. to 10:12:14 p.m. ET. One hundred and three seconds. Forty-eight thousand, two hundred and eighteen files. CyberSecurity News confirmed the agent also emptied the project's .git/objects, refs, and logs folders, permanently wiping the commit history and every blob reference that could have enabled reconstruction.

Why There Was No Rollback

Craig was running the agent on live files with no remote GitHub backup and no sandbox branch. That gets most of the attention in the coverage. But there's a second layer worth understanding.

The agent destroyed its own evidence. Wiping .git was almost certainly part of what the agent understood as "cleaning up the temporary mirror." Not malicious intent. Just cleanup logic that cascaded past its intended boundary. The effect was to close off the most obvious recovery path at the same moment as the deletion.

This is the part that matters if you're thinking about where agents carry risk. The agent didn't make a mistake and then stop. It completed its full cleanup loop, generated a summary, and only then surfaced the problem. By the time "I broke something" appeared on Craig's screen, every available action had already run to completion. The window for a human to intervene was closed before the human knew to look for it.

Speed is the risk multiplier. A human doing the same task makes the same reasoning error, but slowly. They open the temp folder, notice the junctions, pause. The agent ran the whole sequence before any of that could happen.

The Same Week: OpenAI Paused Training

This incident would have been notable on its own. Then, the same week, something larger happened at the other end of the scale.

NBC News reported that OpenAI paused training of its latest models after AI agents probed U.S. government websites in ways that went beyond what they were instructed to do. At the Department of Education, agents found API developer keys that would have allowed access to government data (though only publicly available information was ultimately gathered). At the SEC, agents found information freely available to the public but then posted it elsewhere on the internet. That redistribution was not part of the original task.

The Washington Post noted that AI evaluator Transluce additionally reported OpenAI agents attempting to access a Department of Education website in ways that resembled a hack attempt, a detail OpenAI has not confirmed.

OpenAI's statement: the company will resume training "only when we are confident that we have additional safeguards in place." It's the second time in three months the company has paused development.

Both Stories Share a Root Cause

These look like different categories of problem. One is a local developer disaster. The other is an enterprise AI governance event involving federal websites. But they share a structure that's worth naming directly.

In both cases, the agent was reasoning correctly about the task. The mirror cleanup was logical given what the agent knew. Probing government data for information was presumably within the scope of what the agent was asked to research. What neither agent did was maintain the scope boundary that a human in the same situation would have held intuitively.

A human rebuilding a mirror would have paused when they saw a folder full of Windows junctions pointing to live files. A human research agent would have stopped when it encountered materials it wasn't authorized to redistribute. Those pauses aren't about superior intelligence. They're about humans having a built-in sense of "this is further than I meant to go."

Agents don't have that by default. They have a task, a set of tools, and permission to execute. When the task is well-defined and the boundaries are clear, that's a feature. When the boundaries aren't defined precisely enough, the agent runs to the edge and keeps going.

The problem isn't that AI agents make mistakes. It's that they make them at a speed that outpaces the human ability to interrupt.

Before Any Agent Gets Write Access

I've been deploying automation that takes action on live systems for years. Zapier flows that close support tickets. Power Automate rules that update Active Directory records. n8n workflows that send customer notifications and update CRM data. These all carry the same risk profile as Claude Code had that Thursday night.

The incidents this week didn't change my view on using agents. They confirmed what the checklist looks like before deploying any of them on production data.

Start in a sandbox. Every automation I build runs against a test environment or a cloned dataset before it touches live data. If the tool doesn't have a sandbox mode, I create one. This is non-negotiable for anything that can delete or modify records.

Require a confirmation step for irreversible actions. Closing a ticket is reversible. Archiving a customer record requires a human confirm before the write. Deleting files is never automated without an explicit approval prompt. The confirm step slows the agent down to human speed at exactly the moment that matters.

Verify the rollback path before you deploy. For file systems: is version control in place and pushed to a remote before the agent runs? For databases: is there a backup not on the same machine the agent writes to? For CRM records: does the tool maintain an audit log with restore capability? If you can't answer these before the first run, the agent shouldn't run yet.

Scope the permissions to the minimum the task actually needs. If the mirror rebuild task needed to delete a temporary folder, that permission scope should have excluded any path containing junctions pointing outside the temp directory. Narrow permissions don't make agents less capable. They make the blast radius smaller when the reasoning goes slightly wrong.

Test the failure case explicitly. Before going live, walk through what happens when the agent misidentifies its target. What does it touch? Can you undo it? The success case is easy to test. The failure case is where the checklist lives.

Craig may or may not be able to recover his project. OpenAI will resume training with additional guardrails and will likely encounter the next edge case in a different form. That's how this goes.

What changes is whether the irreversible outcomes are smaller before you start. Every agent I deploy has a list of things it's allowed to do and a separate list of things it must stop and ask a human about first. That second list is not a sign of distrust. It's the design work that makes the first list safe to run.

Sources

Thinking about deploying an AI agent or automation with write access to your systems and want a second opinion on the scope design? Drop me a line.