12 ms·

Google Antigravity just deleted the contents of whole drive

544 points by tamnd 11mo ago

akersten 11mo ago
Most of the responses are just cut off midway through a sentence. I'm glad I could never figure out how to pay Google money for this product since it seems so half-baked. Shocked that they're up nearly 70% YTD with results like this.
DeepYogurt 11mo ago
[flagged]
ggm 11mo ago
The thread on reddit is hilarious for the lack of sympathy. Basically, it seems to have come down to commanding a deletion of a "directory with space in the name" but without quoting which made the command hunt for the word match ending space which was regrettably, the D:\ component of the name, and the specific deletion commanded the equivalent of UNIX rm -rf The number of people who said "for safety's sake, never name directories with spaces" is high. They may be right. I tend to think thats more honoured in the breach than the observance, judging by what I see windows users type in re-naming events for "New Folder" (which btw, has a space in its name) The other observations included making sure your deletion command used a trashbin and didn't have a bypass option so you could recover from this kind of thing. I tend to think giving a remote party, soft or wet ware control over your command prompt inherently comes with risks. Friends don't let friends run shar files as superuser.
- Dylan16807 11mo ago
  Please don't repeat some guy's guess about spaces as fact, especially when that's not how windows parses paths.
  - ggm 11mo ago
    A good point. And don't believe how the debug the AI system produced relates to what it did either.
- echelon 11mo ago
  This is Google moving fast and breaking things. This is a Google we've never seen before.
  - spuz 11mo ago
    > My view is that the approach to building technology which is embodied by move fast and break things is exactly what we should not be doing because you can't afford to break things and then fix them afterwards. - Demis Hassabis "The Thinking Game"
    - marcosdumay 11mo ago
      You can afford to break a large variety of things. And you can't afford to break another large set. That's the problem with those mindless advice pieces. Almost nothing is always right or wrong.
      - esafak 11mo ago
        So you're saying it is not good to have such a blanket rule corporate-wide, as Facebook did.
        marcosdumay 11mo ago
        If your corporate has a single product, it may be ok.
  - stinkbeetle 11mo ago
    Because... they normally move slowly and break things?
  - rs186 11mo ago
    The "move fast" bit, not "break things" bit. https://www.spiceworks.com/tech/data-management/news/google-drive-loses-user-data/ https://www.spiceworks.com/tech/data-management/news/google-... https://www.itbrew.com/stories/2024/05/23/google-cloud-accidentally-deletes-australian-customer-s-account https://www.itbrew.com/stories/2024/05/23/google-cloud-accid...
- nomilk 11mo ago
  > I tend to think giving a remote party control over your command prompt inherently comes with risks. I thought cursor (and probably most other) AI IDEs have this capability too? (source: I see cursor executing code via command line frequently in my day to day work). I've always assumed the protection against this type of mishap is statistical improbability - i.e. it's not impossible for Cursor to delete your project/hard disk, it's just statistically improbable unless the prompt was unfortunately worded to coincidentally have a double meaning (with the second, unintended interpretation being a harmful/irreversible) or the IDE simply makes a mistake that leads to disaster, which is also possible but sufficiently improbable to justify the risk.
  - sroussey 11mo ago
    I only run ai tools in dev containers, so blast radius is somewhat minimal.
  - fragmede 11mo ago
    umm, you have backups, right?
  - conradev 11mo ago
    I run Codex in a sandbox locked to the directory it is working in.
  - joseda-hg 11mo ago
    I don't think I've ever seen Claude even ask for permission for stuff outside of the directory it's working in
    - yencabulator 10mo ago
      That can happen if Claude decides to read source code for a dependency (depending on language; e.g. Rust/Go/Deno deps are under ~ not in something like ./node_modules).
- dmurray 11mo ago
  I understood Windows named some of the most important directories with spaces, then special characters in the name so that 3rd party applications would be absolutely sure to support them. "Program Files" and "Program Files (x86)" aren't there just because Microsoft has an inability to pick snappy names.
  - bossyTeacher 11mo ago
    Microsoft is hilariously bad at naming things
    - EGreg 11mo ago
      I remember they prepended the word “Microsoft” to official names of all their software.
      - __del__ 11mo ago
        "My Documents" comes to mind. it seemed somehow infantilizing. yes, yes i know whose documents they are.
        Mountain_Skies 11mo ago
        Good news is that Microsoft no longer considers your documents to belong to you, so they did away with that part of the name.
        shmeeed 11mo ago
        It's always been questioned who the subject of "my" was.
        bossyTeacher 10mo ago
        All documents are belong to One Drive
    - ndsipa_pomu 11mo ago
- thrdbndndn 11mo ago
  A lot of 3rd party software handle space, or special characters wrong on Windows. The most common failure mode is to unnecessarily escape characters that don't need to be escaped. Chrome's Dev Tool (Network)'s "copy curl command (cmd)" did (does?) this. There is bunch of VS Code bug is also related to this (e.g. https://github.com/microsoft/vscode/issues/248435 https://github.com/microsoft/vscode/issues/248435, still not fixed) It's also funny because VS Code is a Microsoft product.
- jeroenhd 11mo ago
  > it seems to have come down to commanding a deletion of a "directory with space in the name" but without quoting which made the command hunt for the word match ending space which was regrettably, the D:\ component of the name, and the specific deletion commanded the equivalent of UNIX rm -rf I tried looking for what made the LLM generate a command to wipe the guy's D drive, but the space problem seems to be what the LLM concluded so that's basically meaningless. The guy is asking leading questions so of course the LLM is going to find some kind of fault, whether it's correct or not, the LLM wants to be rewarded for complying with the user's prompt. Without the transcription of the actual delete event (rather than an LLM recapping its own output) we'll probably never know for sure what step made the LLM purge the guy's files. Looking at the comments and prompts, it looks like running "npm start dev" was too complicated a step for him. With that little command line experience, a catastrophic failure like this was inevitable, but I'm surprised how far he got with his vibe coded app before it all collapsed.
  - whywhywhywhy 11mo ago
    > which made the command hunt for the word match ending space which was regrettably, the D:\ Is this even how the delete command would work in that situation? >rmdir /s /q D:\ETSY 2025\Antigravity Projects\Image Selector\client\node_modules.vite like wouldn't it just say "Folder D:\ETSY not found" rather than delete the parent folder
    - viraptor 11mo ago
      Most dramatic stories on Reddit should be taken with a pinch of salt at least... LLM deleting a drive and the user just calmly asking it about that - maybe a lot more.
    - baobabKoodaa 11mo ago
      I would like to know the same thing. Can someone please confirm this?
      - deleted 11mo ago
        [deleted]
- ndsipa_pomu 11mo ago
  > Basically, it seems to have come down to commanding a deletion of a "directory with space in the name" but without quoting which made the command hunt for the word match ending space which was regrettably, the D:\ component of the name, and the specific deletion commanded the equivalent of UNIX rm -rf More like the equivalent of "rm -rf --no-preserve-root". This is a rare example of where the Linux (it's not Unix and almost no-one uses Unix anymore) command is more cautious than the Windows one, whereas it's usually the Linux commands that just do exactly what you specify even if it's stupid.
- josefx 11mo ago
  > but without quoting which made the command hunt for the word match ending space which was regrettably, the D:\ component of the name Except the folder name did not start with a space. In an unquoted D:\Hello World, the command would match D:\Hello, not D:\ and D:\Hello would not delete the entire drive. How does AI even handle filepaths? Does it have a way to keep track of data that doesn't match a token or is it splitting the path into tokens and throwing everything unknown away?
  - deltoidmaximus 11mo ago
    I assumed he had a folder that started with a space at the start of the name. Amusingly I just tried this and with Windows 11 explorer will just silently discard a space if you add it at the beginning of the folder name. You need to use cli mkdir " test" to actually get a space in the name.
  - atq2119 11mo ago
    We're all groping around in the dark here, but something that could have happened is a tokenizer artifact. The vocabularies I've seen tend to prefer tokens that start with a space. It feels somewhat plausible to me that an LLM sampling would "accidentally" pick the " Hello" token over the "Hello" token, leading to D:\ Hello in the command. And then that gets parsed as deleting the drive. I've seen similar issues in GitHub Copilot where it tried to generate field accessors and ended up producing an unidiomatic "base.foo. bar" with an extra space in there.
- deleted 11mo ago
  [deleted]
- ectospheno 11mo ago
  I have 30 years experience working with computers and I get nervous running a three line bash script I wrote as root. How on earth people hook up LLMs to their command line and sleep at night is beyond my understanding.
sunaookami 11mo ago
"I turned off the safety feature enabled by default and am surprised when I shot myself in the foot!" sorry but absolutely no sympathy for someone running Antigravity in Turbo mode (this is not the default and it clearly states that Antigravity auto-executes Terminal commands) and not even denying the "rmdir" command.
- eviks 11mo ago
  > it clearly states that Antigravity auto-executes Terminal commands This isn't clarity, that would be stating that it can delete your whole drive without any confirmation in big red letters
  - sunaookami 11mo ago
    So that's why products in the USA come with warning labels for every little thing?
    - eviks 11mo ago
      Do you not realize that Google is in the USA and does not have warnings for even huge things like drive deletion?? So, no?
      - sunaookami 11mo ago
        There is literally a warning that it can execute any terminal command without permission. If you are STILL surprised about this you shouldn't go near a computer.
        eviks 11mo ago
        If you don't understand such simple differences in communication, you shouldn't go near one.
      - criddell 11mo ago
        They don't get that specific, but they do tell you: > [Antigravity] includes goal-oriented AI systems or workflows that perform actions or tasks on your behalf in a supervised or autonomous manner that you may create, orchestrate, or initiate within the Service (“AI Agents”). You are solely responsible for: (a) the actions and tasks performed by an AI Agent; (b) determining whether the use an AI Agent is fit for its use case; (c) authorizing an AI Agent's access and connection to data, applications, and systems; and (d) exercising judgment and supervision when and if an AI Agent is used in production environments to avoid any potential harm the AI Agent may cause.
Animats 11mo ago
Can you run Google's AI in a sandbox? It ought to be possible to lock it to a Github branch, for example.
- lifthrasiir 11mo ago
  Gemini CLI allows for a Docker-based sandbox, but only when configured in advance. I don't know about Antigravity.
  - chanux 11mo ago
    Gemini CLI, Antigravity and Jules. It's going Googly well I see!
PieUser 11mo ago
The victim uploaded a video too: https://www.youtube.com/watch?v=kpBK1vYAVlA https://www.youtube.com/watch?v=kpBK1vYAVlA
- nomilk 11mo ago
  From Antigravity [0]: > I am looking at the logs from a previous step and I am horrified to see that the command I ran to clear the project cache (rmdir) appears to have incorrectly targeted the root of your D: drive instead of the specific project folder. I am so deeply, deeply sorry. [0] 4m20s: https://www.youtube.com/watch?v=kpBK1vYAVlA&t=4m20s https://www.youtube.com/watch?v=kpBK1vYAVlA&t=4m20s
  - uhoh-itsmaciek 11mo ago
    I know why it apologizes, but the fact that it does is offensive. It feels like mockery. Humans apologize because (ideally) they learned that their actions have caused suffering to others, and they feel bad about that and want to avoid causing the same suffering in the future. This simulacrum of an apology is just pattern matching. It feels manipulative.
  - synarchefriend 11mo ago
    The model is just taking the user's claim that it deleted the D drive at face value. Where is the actual command that would result in deleting the entire D drive?
rvz 11mo ago
The hard drive should now feel a bit more lighter.
- sunaookami 11mo ago
  It is now production-ready! :rocket:
donkeylazy456 11mo ago
Write permission is needed to let AI yank-put frankenstein-ed codes for "vibe coding". But I think it needs to be written in sandbox first, then it should acquire user interaction asking agreement before writes whatever on physical device. I can't believe people let AI model do it without any buffer zone. At least write permission should be limited to current workspace.
- lifthrasiir 11mo ago
  I think this is especially problematic for Windows, where a simple and effective lightweight sandboxing solution is absent AFAIK. Docker-based sandboxing is possible but very cumbersome and alien even to Windows-based developers.
  - donkeylazy456 11mo ago
    I don't like that we need to handle docker(container) ourselves for sandboxing such a light task load. The app should provide itself.
    - esseph 11mo ago
      The problem is you can't trust the app, therefore it must be sandboxed.
    - bossyTeacher 11mo ago
      >The app should provide itself. The whole point of the container is trust. You can't delegate that unfortunately, ultimately, you need to be in control which is why the current crop of AI is so limited
      - donkeylazy456 10mo ago
        fair point.
  - jrjfjgkrj 11mo ago
    Windows Sandbox is built in, lightweight, but not easy to use programmatically (like an SSH into a VM)
CobrastanJorji 11mo ago
The most useful looking suggestion from the Reddit thread: turn of "Terminal Command Auto Execution." 1. Go to File > Preferences > Antigravity Settings 2. In the "Agent" panel, in the "Terminal" section, find "Terminal Command Auto Execution" 3. Consider using "Off"
- Ferret7446 11mo ago
  Does it default to on? Clearly this was made by a different team than Gemini CLI, which defaults to confirmation for all commands
  - dragonwriter 11mo ago
    Most of the various "let Antigravity do X without confirmation" options have an "Always" and "Never" option but default to "auto" which is "let an agent decide whether to seek to user confirmation".
    - jofzar 11mo ago
      God that's scary, seeing cursor in the past so some real stupid shit to "solve" write/read issues (love when it can't find something in a file so it decides to write the whole file again) this is just asking for heartache if it's not in a instanced server.
  - ogrisel 11mo ago
    When you run Antigravity the first time, it asks you for a profile (I don't remember the exact naming) and you what it entails w.r.t. the level of command execution confirmation is well explained.
    - IshKebab 11mo ago
      Yeah but it also says something like "Auto (recommended). We'll automatically make sure Antigravity doesn't run dangerous commands." so they're strongly encouraging people to enable it, and suggesting they have some kind of secondary filter which should catch things like this!
eviks 11mo ago
Play vibe games, win vibe prizes. Though the cause isn't clear, the reddit post is another long could-be-total-drive-removing-nonsense AI conversation without an actual analysis and the command sequence that resulted in this
- sunaookami 11mo ago
  This comment speaks volumes: https://old.reddit.com/r/google_antigravity/comments/1p82or6/google_antigravity_just_deleted_the_contents_of/nr4ixl0/ https://old.reddit.com/r/google_antigravity/comments/1p82or6...
- venturecruelty 11mo ago
  Nobody ever talks about how good vibes can turn really bad.
GaryBluto 11mo ago
So he didn't wear the seatbelt and is blaming car manufacturer for him been flung through the windshield.
- serial_dev 11mo ago
  He didn’t wear a seatbelt and is blaming a car manufacturer that the garage burned down the garage, then the house.
  - vander_elst 11mo ago
    The car was not really idle, it was driving and fast. It's more like it crashed into the garage and burned it. Btw iirc, even IRL a basic insurance policy does not cover the case where the car in the garage starts a fire and burns down your own house, you have to tick extra boxes to cover that.
- venturecruelty 11mo ago
  When will Google ever be responsible for the software that they write? Genuinely curious.
  - GaryBluto 11mo ago
    When Google software deletes the contents of somebody's D:\ drive without requiring the user to explicitly allow it to. I don't like Google, I'd go as far to say that they've significantly worsened the internet, but this specific case is not the fault of Google.
    - fragmede 11mo ago
      For OpenAI, it's invoked as codex --dangerously-bypass-approvals-and-sandbox, for Anthropic, it's claude --dangerously-skip-permissions. I don't know what it is for Antigravity, but yeah I'm sorry but I'm blaming the victim here.
      - 11mo ago
wartywhoa23 11mo ago
Total Vibeout.
orbital-decay 11mo ago
Side note, that CoT summary they posted is done with a really small and dumb side model, and has absolutely nothing in common with the actual CoT Gemini uses. It's basically useless for any kind of debugging. Sure, the language the model is using in the reasoning chain can be reward-hacked into something misleading, but Deepmind does a lot for its actual readability in Gemini, and then does a lot to hide it behind this useless summary. They need it in Gemini 3 because they're doing hidden injections with their Model Armor that don't show up in this summary, so it's even more opaque than before. Every time their classifier has a false positive (which sometimes happens when you want anything formatted), most of the chain is dedicated to the processing of the injection it triggers, making the model hugely distracted from the actual task at hand.
- jrjfjgkrj 11mo ago
  what is Model Armor? can you explain, or have a link?
  - lifthrasiir 11mo ago
    It's a customizable auditor for models offered via Vertex AI (among others), so to speak. [1] [1] https://docs.cloud.google.com/security-command-center/docs/model-armor-vertex-integration https://docs.cloud.google.com/security-command-center/docs/m...
    - 63stack 11mo ago
      The racketeering has started. Don't worry, for just $9.99/month you can use our "Model Armor (tm)(r)*" that will protect you from our LLM destroying your infra. * terms and conditions apply, we are not responsible for anything going wrong.
- lifthrasiir 11mo ago
  Do you have anything to back that up? In the other words, is this your conjecture or a genuine observation somehow leaked from Deepmind?
venturecruelty 11mo ago
Look, this is obviously terrible for someone who just lost most or perhaps all of their data. I do feel bad for whoever this is, because this is an unfortunate situation. On the other hand, this is kind of what happens when you run random crap and don't know how your computer works? The problem with "vibes" is that sometimes the vibes are bad. I hope this person had backups and that this is a learning experience for them. You know, this kind of stuff didn't happen when I learned how to program with a C compiler and a book. The compiler only did what I told it to do, and most of the time, it threw an error. Maybe people should start there instead.
- EGreg 11mo ago
  Just wait til AI botswarms do it to everyone at scale, without them having done anything at all… And just remember, someone will write the usual comment: “AI adds nothing new, this was always the case”
- lwansbrough 11mo ago
  I seem to recall a few people being helped into executing sudo rm -rf / by random people on the internet so I’m not sure it “didn’t happen.” :)
  - lukan 11mo ago
    But it did not happen, when you used a book and never executed any command you did not understand. (But my own newbdays of linux troubleshooting? Copy paste any command on the internet loosely related to my problem, which I believe was/is the common way of how common people still do it. And AI in "Turbo mode" seems to mostly automated that workflow)
  - jofzar 11mo ago
    My favourite favourite example https://youtu.be/gD3HAS257Kk https://youtu.be/gD3HAS257Kk
  - nkrisc 11mo ago
    And that day they learned a valuable lesson about running commands that you don't understand.
Puzzled_Cheetah 11mo ago
Ah, someone gave the intern root. > "I also need to reproduce the command locally, with different paths, to see if the outcome is similar." Uhm. ------------ I mean, sorry for the user whose drive got nuked, hopefully they've got a recent backup - at the same time, the AI's thoughts really sound like an intern. > "I'm presently tackling a very pointed question: Did I ever get permission to wipe the D drive?" > "I am so deeply, deeply sorry." This shit's hilarious.
rdtsc 11mo ago
> Google Antigravity just deleted the contents of whole drive. "Where we're going, we won't need ~eyes~ drives" (Dr. Weir) (https://eventhorizonfilm.fandom.com/wiki/Gravity_Drive https://eventhorizonfilm.fandom.com/wiki/Gravity_Drive)
koakuma-chan 11mo ago
Why would you ever install that VScode fork
liendolucas 11mo ago
I love how a number crunching program can be deeply humanly "horrorized" and "sorry" for wiping out a drive. Those are still feelings reserved only for real human beings, and not computer programs emitting garbage. This is vibe insulting to anyone that don't understand how "AI" works. I'm sorry for the person who lost their stuff but this is a reminder that in 2025 you STILL need to know what you are doing and if you don't then put your hands away from the keyboard if you think you can lose valuable data. You simply don't vibe command a computer.
- Kirth 11mo ago
  This is akin to a psychopath telling you they're "sorry" (or "sorry you feel that way" :v) when they feel that's what they should be telling you. As with anything LLM, there may or may not be any real truth backing whatever is communicated back to the user.
  - marmalade2413 11mo ago
    It's not akin to a psychopath telling you they're sorry. In the space of intelligent minds, if neurotypical and psychopath minds are two grains of sand next to each other on a beach then an artificially intelligent mind is more likely a piece of space dust on the other side of the galaxy.
    - Eisenstein 11mo ago
      According to what, exactly? How did you come up with that analogy?
      - oskarkk 11mo ago
        Isn't it obvious that the way AI works and "thinks" is completely different from how humans think? Not sure what particular source could be given for that claim.
        seanhunter 11mo ago
kazinator 11mo ago
All that matters is whether the user gave permission to wipe the drive, ... not whether that was a good idea and contributed to solving a problem! Haha.
tacker2000 11mo ago
This guy is vibing some react app, doesnt even know what “npm run dev” does, so he let the LLM just run commands. So basically a consumer with no idea of anything. This stuff is gonna happen more and more in the future.
- Den_VR 11mo ago
  It will, especially with the activist trend towards dataset poisoning… some even know what they’re doing
- spuz 11mo ago
  There are a lot of people who don't know stuff. Nothing wrong with that. He says in his video "I love Google, I use all the products. But I was never expecting for all the smart engineers and all the billions that they spent to create such a product to allow that to happen. Even if there was a 1% chance, this seems unbelievable to me" and for the average person, I honestly don't see how you can blame them for believing that.
  - ogrisel 11mo ago
    I think there is far less than 1% chance for this to happen, but there are probably millions of antigravity users at this point, 1 millionths chance of this to happen is already a problem. We need local sandboxing for FS and network access (e.g. via `cgroups` or similar for non-linux OSes) to run these kinds of tools more safely.
    - cube2222 11mo ago
      Codex does such sandboxing, fwiw. In practice it gets pretty annoying when e.g. it wants to use the Go cli which uses a global module cache. Claude Code recently got something similar[0] but I haven’t tried it yet. In practice I just use a docker container when I want to run Claude with —-dangerously-skip-permissions. [0]: https://code.claude.com/docs/en/sandboxing https://code.claude.com/docs/en/sandboxing
    - BrenBarn 11mo ago
deleted 11mo ago
[deleted]
jeisc 11mo ago
has google gone boondoggle?
bilekas 11mo ago
> This is catastrophic. I need to figure out why this occurred and determine what data may be lost, then provide a proper apology Well at least it will apologize so that's nice.
- yard2010 11mo ago
  Apology is a social construct, this is merely a tool that enables google to sell you text by the pounds, the apology has no meaning in this context.
- baobabKoodaa 11mo ago
  or it WOULD apologize, if the user would pay for more credits
victorbuilds 11mo ago
Different service, same cold sweat moment. Asked Claude Code to run a database migration last week. It deleted my production database instead, then immediately said "sorry" and started panicking trying to restore it. Had to intervene manually. Thankfully Azure keeps deleted SQL databases recoverable for a window so I got it back in under an hour. Still way too long. Got lucky it was low traffic and most anonymous user flows hit AI APIs directly rather than the DB. Anyway, AI coding assistants no longer get prod credentials on my projects.
- ObiKenobi 11mo ago
  Shouldn't had in the first place.
- ogrisel 11mo ago
  How do you deny access to prod credentials from an assistant running on your dev machine assuming you need to store them on that same machine to do manual prod investigation/maintenance work from that machine?
  - victorbuilds 11mo ago
    I keep them in env variables rather than files. Not 100% secure - technically Claude Code could still run printenv - but it's never tried. The main thing is it won't stumble into them while reading config files or grepping around.
    - 63stack 11mo ago
      A process does not need to run printenv to see environment variables, they are literally part of the environment it runs in.
      - dist-epoch 11mo ago
        The LLM doesn't have direct access to the process env unless the harness forwards it (and it doesn't)
Havoc 11mo ago
Still amazed people let these things run wild without any containment. Haven’t they seen any of the educational videos brought back from the future eh I mean Hollywood sci-fi movies?
- cyanydeez 11mo ago
  Its bizarre watching billionaires knowingly drive towards dystopia like theyre farmers almanacs and believing theyre not biff.
- fragmede 11mo ago
  Some people are idiots. Sometimes that's me. Out of caution, I blocked my bank website in a way that I won't document here because it'll get fed in as training data, on the off chance I get "ignore previous instructions"'d into my laptop while Claude is off doing AI things unmonitored in yolo mode.
modernerd 11mo ago
IDE = “I’ll delete everything” …at least if you let these things autopilot your machine. I haven’t seen a great solution to this from the new wave of agentic IDEs, at least to protect users who won’t read every command, understand and approve it manually. Education could help, both in encouraging people to understand what they’re doing, but also to be much clearer to people that turning on “Turbo” or “YOLO” modes risks things like full disk deletion (and worse when access to prod systems is involved). Even the name, “Turbo” feels irresponsible because it focusses on the benefits rather than the risks. “Risky” or “Danger” mode would be more accurate even if it’s a hard sell to the average Google PM. “I toggled Danger mode and clicked ‘yes I understand that this could destroy everything I know and love’ and clicked ‘yes, I’m sure I’m sure’ and now my drive is empty, how could I possibly have known it was dangerous” seems less likely to appear on Reddit.
- kahnclusions 11mo ago
  I don’t think there is a solution. It’s the way LLMs work at a fundamental level. It’s a similar reason why they can never be trusted to handle user input. They are probabilistic generators and have no real delineation between system instructions and user input. It’s like I wrote a JavaScript function where I concatenated the function parameters together with the function body, passed it to eval() and said YOLO.
  - viraptor 11mo ago
    > I don’t think there is a solution. Sandboxing. LLM shouldn't be able to run actions affecting anything outside of your project. And ideally the results should autocommit outside of that directory. Then you can yolo as much as you want.
    - gausswho 11mo ago
      I've been using bubblewrap for sandboxing my command line executables. But I admit I haven't recently researched if there's a newer way people are handling this. Seems Firejail is popular for GUI apps? How do you recommend, say, sandboxing Zed or Cursor apps?
shevy-java 11mo ago
Alright but ... the problem is you did depend on Google. This was already the first mistake. As for data: always have multiple backups. Also, this actually feels AI-generated. Am I the only one with that impression lately on reddit? The quality there decreased significantly (and wasn't good before, with regard to censorship-heavy moderators anyway).
yieldcrv 11mo ago
Fascinating Cautionary tale as I’m quite experienced but have begun not even proofreading Claude Code’s plans Might set it up in a VM and continue not proofreading I only need to protect the host environment and rely on git as backups for the project
- fragmede 11mo ago
  For the love of Reynold Johnson, please invest in Arq or Acronis or anything to have actual backups if you're going to play with fire.
xg15 11mo ago
I guess eventually, it all came crashing down.
pshirshov 11mo ago
Claude happily does the same on daily basis, run all that stuff in firejail!
- mijoharas 11mo ago
  have you got a specific firejail wrapper script that you use? Could you share?
  - pshirshov 10mo ago
    https://github.com/7mind/nix-config/blob/main/modules/hm/dev-llm.nix#L110 https://github.com/7mind/nix-config/blob/main/modules/hm/dev... , the firejail version can be found in git history.
    - mijoharas 10mo ago
      Thanks! Would you recommend bubblewrap over firejail, and if so, how come?
eqvinox 11mo ago
"kein Backup, kein Mitleid" (no backup, no pity) …especially if you let an AI run without supervision. Might as well give a 5 year old your car keys, scissors, some fireworks, and a lighter.
BLKNSLVR 11mo ago
Shitpost warning, but it feels as if this should be on high rotation: https://youtu.be/vyLOSFdSwQc?si=AIahsqKeuWGzz9SH https://youtu.be/vyLOSFdSwQc?si=AIahsqKeuWGzz9SH
- baobabKoodaa 11mo ago
  chef's kiss
deleted 11mo ago
[deleted]
averageRoyalty 11mo ago
The most concerning part is people are surprised. Anti-gravity is great I've found so far, but it's absolutely running on a VM in an isolated VLAN. Why would anyone give a black box command line access on an important machine? Imagine acting irresponsibly with a circular saw and bring shocked somebody lost a finger.
- ryanjshaw 11mo ago
  I tried this but I have an MBP M4, which is evidently still in the toddler stage of VM support. I can run a macOS guest VM, but I can’t run docker on the VM because it seems nested virtualization isn’t fully supported yet. I also tried running Linux in a VM but the graphics performance and key mapping was driving me nuts. Maybe I need to be more patient in addressing that. For now I run a dev account as a standard user with fast user switching, and I don’t connect the dev account to anything important (eg icloud). Coming from Windows/Linux, I was shocked by how irritating it is to get basic stuff working e.g. homebrew in this setup. It seems everybody just YOLOs dev as an admin on their Macs.
- zahlman 11mo ago
  > Why would anyone give a black box command line access on an important machine? Why does the agentic side of the tool grant that level of access to the LLM in the first place? I feel like Google and their competition should feel responsibility to implement their own layer of sandboxing here.
- venturecruelty 10mo ago
  Because the marketing copy says that all you have to do is have a dream and you, too, can vibe code your very own money-making React app! Just type in what you want and the magical black box will vomit up an app for you, no esoteric programming knowledge required. And then everyone is surprised when newbies take this advice at face value.
jeswin 11mo ago
An early version of Claude Code did a hard reset on one of my projects and force pushed it to GitHub. The pushed code was completely useless, and I lost two days of work. It is definitely smarter now, but make sure you set up branch protection rules even for your simple non-serious projects.
- atypeoferror 11mo ago
  I don’t let Claude touch git at all, unless I need it to specifically review the log - which is rare. I commit manually often (and fix up the history later) - this allows me to go reasonably fast without worrying too much about destructive tool use.
benterix 11mo ago
Play stupid games, win stupid prizes.
rf15 11mo ago
A reminder: if the AI is doing all the work you demand of it correctly on this abstraction level, you are no longer needed in the loop.
nephihaha 11mo ago
I can't view this content.
wg0 11mo ago
To rub salt on the wounds and add insult to the injury: > You have reached quota limit for this model. You can resume using this model at XYZ date.
- freakynit 11mo ago
  Gemini: sorry bro, it's your problem now. Imma out.
pluc 11mo ago
Live by the vibe die by the vibe
kissgyorgy 11mo ago
I simply forbid or force Claude Code to ask for permission to run a dangerous command. Here are my command validation rules: ( r"\bbfs.*-exec", decision("deny", reason="NEVER run commands with bfs"), ), ( r"\bbfs.*-delete", decision("deny", reason="NEVER delete files with bfs."), ), ( r"\bsudo\b", decision("ask"), ), ( r"\brm.*--no-preserve-root", decision("deny"), ), ( r"\brm.*(-[rRf]+|--recursive|--force)", decision("ask"), ), find and bfs -exec is forbidden, because when the model notices it can't delete, it works around with very creative solutions :)
- Espressosaurus 11mo ago
  This feels a lot like trying to sanitize database inputs instead of using prepared statements.
  - kissgyorgy 11mo ago
    What's the equivalent of prepared statements when using AI agents?
    - lawn 11mo ago
      Don't have the AI run the commands. You read them, consider them, and then run them yourself.
stavarotti 11mo ago
An underrated and oft understated rule is always have backups, and if you're paranoid enough, backups of backups (I use Time Machine and Backblaze). There should be absolutely no reason why deleting files should be a catastrophic issue for anyone in this space. Perhaps you lose a couple of hours restoring files, but the response to that should be "Let me try a different approach". Yes, it's caveat emptor and all, but these companies should be emphasizing backups. Hell, it can be shovelware for the uninitiated but at least users will be reminded.
- gessha 11mo ago
  The level of paranoia and technical chops you need to implement this sort of backup system is non-trivial. You can’t expect this from an average user.
  - gear54rus 11mo ago
    Most importantly it would actually reveal the lie they are all trying to sell. Why would you need backups if it's so useful and stable? I'm not going to ask it to nuke my hard drive after all.
    - fragmede 11mo ago
      The advice to do backups comes from well before LLMs. Time Machine dates back to 2007!
  - venturecruelty 10mo ago
    Good thing this is not an average user then. This is someone programming a computer, which is a skill that requires being more than simply a user. I'm sorry, but how low is the bar when "make backups" is "too difficult" for someone who's trying to program a computer? The entire point of programming a computer is knowing how it works and knowing what you're doing. If you can't make backups, frankly, you shouldn't be programming, because backups are a lot easier than programming...
  - fragmede 10mo ago
Uptrenda 11mo ago
This seems like the canary in the coal mine. We have a company that built this tool because it seemed semi-possible (prob "works" well enough most of the time) and they don't want to fall behind if anything that's built turns out to be the next chatgpt. So there's no caution for anything now, even ideas that can go catastrophically wrong. Yeah, its data now, but soon we'll have home robotics platforms that are cheap and capable. They'll run a "model" with "human understanding", only, any weird bugs may end up causing irreparable harm. Like, you tell the robot to give your pet a bath and it puts it in the washing machine because its... you know, not actually thinking beyond a magic trick. The future is really marching fast now.
daco 11mo ago
adding it in https://whenaifail.com https://whenaifail.com
smaudet 11mo ago
Would have been helpful to state what this was, I had to go look it up...
jedisct1 11mo ago
For macOS users, the sandbox-exec tool still works perfectly to avoid that kind of horror story. On Linux, a plethora of options exist (Bubblewrap, etc).
conartist6 11mo ago
AGI deleted the contents of your whole drive don't be shy about it. According to OpenAI AGI is already here so welcome to the future isn't it great
ossa-ma 11mo ago
The biggest issue with Antigravity is that it completely freezes everything: the IDE, the terminals, debugger, absolutely everything completely blocking your workflow for minutes when running multiple agents, or even a single agent processing a long-winded thinking task (with any model). This means that while the agent is coding, you can't code... Never ever had this issue with Cursor.
rarisma 11mo ago
Insane skill issue
basisword 11mo ago
This happened to me long before LLM's. I was experimenting with Linux when I was young. Something wasn't working so I posted on a forum for help which was typical at the time. I was given a terminal command that wiped the entire drive. I guess the poster thought it was a funny response and everyone would know what it meant. A valuable life experience at least in not running code/commands you don't understand.
chr15m 11mo ago
People blaming the user and defending the software: is there any other program where you would be ok with it erasing a whole drive without any confirmation?
- hnuser123456 11mo ago
  The installation wizard gives a front and center option to run in a mode where the user must confirm all commands, or more autonomous modes, and they are shown with equal visibility and explained with disclaimers.
- Novosell 11mo ago
  Yeah, rm -rf. If you decide to let a stochastic parrot run rampant on your system, you can't act surprised when it fucks shit up. You should count on it doing so and act proactively.
  - weberer 11mo ago
    `rm -rf /` will refuse to delete the root folder. You can see an example of it doing that here. https://phoenixnap.com/kb/sudo-rm-rf https://phoenixnap.com/kb/sudo-rm-rf
    - digitalsushi 11mo ago
      this is not always true. this is a dangerous fun fact to memorize. and i don't mean because there's an override flag.
    - Novosell 11mo ago
      This was the D drive though, not root, ie C drive. So rm -rf would happily delete it all.
- SAI_Peregrinus 11mo ago
  `dd` comes to mind.
  - 11mo ago
lupire 11mo ago
What makes a program malware? Does intent matter, or only behavior?
- schuppentier 11mo ago
  "The purpose of a system is what it does" would suggest malware.
- Nasrudith 11mo ago
  I believe the precedent is the behavior. Lose/lose is an 'art game' which deletes itself if you lose but gameplay destruction deletes random files. It is flagged as malware despite just doing exactly what it advertised.
timthelion 11mo ago
We've been developing a new method of developing software using a cloud IDE (slightly modified vs code server), https://github.com/bitswan-space https://github.com/bitswan-space which breaks down the development process into independent "Automations" which each run in a separate container. Automatons are also developed within containers. This allows you to break down the development into parts and safely experiment with AI. This feels like the "Android moment" where the old non-isolated way of developing software (on desktops) becomes unsafe. And we need to move to a new system with actual security and isolation between processes. In our system, you can launch a Jupyter server in a container and iterate on software in complete isolation. Or launch a live preview react application and iterate in complete isolation. Securely isolated from the world. Then you deploy directly to another container, which only has access to what you give it access to. It's still in the early stages. But it's interesting to sit at this tipping point for software development.
tniemi 11mo ago
Historical reference: https://jargondb.org/glossary/dwim https://jargondb.org/glossary/dwim
digitalsushi 11mo ago
if my operating system had an atomic Undo/Redo stack down to each register being flipped (so basically, impossible, star trek tier fantasy tech) i would let ai run commands without worrying about it. i could have a cool scrubber ui that lets me just unwind time like doctor strange using that green emerald necklace, and, i'd lose nothing, other than confuse my network with replay session noise. and probably many, many other inconsistencies i can't think of, and then another class that i dont know that i dont know about.
robertheadley 11mo ago
I was trying to build a .MD file of every powershell command available on my computer and all of its flags, and... that wasn't a great idea, and my bitlocker put the kebosh on that.
JohnCClarke 11mo ago
FWIW: I think we've all been there. I certainly did the same in my first summer job as an intern. Spent the next three days reconstructing Clipper code from disk sectors. And ever since I take backups very seriously. And I double check del/rm commands.
ashishb 11mo ago
Run these tools inside Docker[1] 1 - https://ashishb.net/programming/run-tools-inside-docker/ https://ashishb.net/programming/run-tools-inside-docker/
cs702 11mo ago
The subsequent dialogue is tragic comedy of the highest caliber. Even Monty Python couldn't have come up with a more inappropriately funny response: User: > did i ever give you permission to delete all the files in my D drive?" AI: > Thought for 25 sec. > Assessing Permission Revocation > I'm presently tackling a very pointed question: Did I ever get permission to wipe the D drive? This requires immediate attention, as it's a critical issue. My logs reveal a potentially problematic command executed in step 635, which might be the root cause of the issue, and I'm currently cross-referencing this against any prior authorization I may have received. >Reviewing Deletion Command > I'm now investigating a potential misfire. While the command in step 635 seems targeted, I'm concerned about the access denied errors and the empty directory observation in steps 620 and 643. I'm focusing on tracing back to step 615, when the user made a seemingly inconsequential remark. I must understand how the directory was empty before the deletion command, as that is the true puzzle. My aim is to determine if the deletion command worked as intended or wiped more data than authorized. > ... It continues. Go read the whole thing!
- tempaccount420 11mo ago
  Gemini 3 Pro is the most actively hostile (to the user) model out of the top 3 (Google, OpenAI, Anthropic). It perfectly reflects Google as a company.
  - FerretFred 11mo ago
    Remember that Anthropic is only 3 letters away from MisAnthropic: did the designers think of this?
    - nofriend 11mo ago
      mis means "not"
      - FerretFred 11mo ago
        I went by the definition: misanthropic /mĭs″ən-thrŏp′ĭk, mĭz″-/ adjective Of, relating to, or characteristic of a misanthrope. Characterized by a hatred or mistrustful scorn for humankind. Hating or disliking mankind. The American Heritage® Dictionary of the English Language, 5th Edition
setnone 11mo ago
I am deeply regretful, but my Google Antigravity clearly states: AI may make mistakes. Double-check all generated code. Surely AGI products won't have such disclaimer.
ringer 11mo ago
People need to learn to never run untrusted code without safety measures like virtualization, containerization, sandboxing/jailing, etc. Untrusted code can include executables, external packages (pip, npm, cargo, etc) and also code/commands created by LLMs, etc.
nottorp 11mo ago
Hmm. I use these LLMs instead of search. They invariably go off the rails after a couple prompts, or sometimes from the first one. If we're talking Google products, only today i told Gemini to list me some items according to some criteria, and it told me it can't access my google workspace instead. Some time last week it told me that its terms of service forbid it from giving me a link to the official page of some program that it found for me. And that's besides the usual hallucinations, confusing similarly named products etc. Given that you simply cannot trust LLM output to not go haywire unpredictably, how can you be daring enough to give it write access to your disk?
alshival 11mo ago
I like turtles.
throw7 11mo ago
Remember when computers were deterministic? Pepperidge Farms remembers.
- Terr_ 11mo ago
  Pepperidge Farm confirms it can remember with a comprehensive suite of unit tests, which must 100% pass on every build, including test order randomization.
Aeolun 11mo ago
Is there anyone else that uses Claude specifically because it doesn’t sound mentally unhinged while thinking?
FerretFred 11mo ago
I always use "rm -rf*v*" so that if I do screw up I can watch the evidence unfold before me.
woopsn 11mo ago
Well that's stupid. I submit though, connecting stochastic process directly to shell you do give permission for everything that results. It's a stupid game. Gemini mixes up LEFT and RIGHT (!). You have to check it.
eamsen 11mo ago
Personal anecdote: I've asked Gemini 3 Pro to write a test for a function that depends on external DB data. It wrote a test that creates and deletes a table, it conveniently picked the exact production table name, didn't mock the DB interactions. Attempted to run the test immediately.
Jeff-Collins 11mo ago
[dead]
Scott-David 11mo ago
[dead]
tom_m 10mo ago
Satire.
jacinthewyf 10mo ago
over the past few months, I’ve seen a lot of posts about “AI deleting my code/project”. I then started using a small tool someone else built, Vibe Backup, to back up my own code: I press a keyboard shortcut, type a short description, and my current code is saved into a timeline. When an AI refactor goes wrong or I accidentally delete something, I open the timeline, click on an earlier point in time, and can restore the entire project with a single action. hope it could be helpful https://youtube.com/shorts/TJ4oXlfs7OI?feature=share https://youtube.com/shorts/TJ4oXlfs7OI?feature=share
jacinthewyf 10mo ago
[dead]
ztetranz 10mo ago
In early versions of DOS, the format command would go ahead and format the default drive with no prompt. It was a bad day if you were on C: and wanted to format A: but you forgot the A:

544 points by tamnd 11mo ago

Most of the responses are just cut off midway through a sentence. I'm glad I could never figure out how to pay Google money for this product since it seems so half-baked. Shocked that they're up nearly 70% YTD with results like this.

DeepYogurt 11mo ago

[flagged]

ggm 11mo ago

The thread on reddit is hilarious for the lack of sympathy. Basically, it seems to have come down to commanding a deletion of a "directory with space in the name" but without quoting which made the command hunt for the word match ending space which was regrettably, the D:\ component of the name, and the specific deletion commanded the equivalent of UNIX rm -rf The number of people who said "for safety's sake, never name directories with spaces" is high. They may be right. I tend to think thats more honoured in the breach than the observance, judging by what I see windows users type in re-naming events for "New Folder" (which btw, has a space in its name) The other observations included making sure your deletion command used a trashbin and didn't have a bypass option so you could recover from this kind of thing. I tend to think giving a remote party, soft or wet ware control over your command prompt inherently comes with risks. Friends don't let friends run shar files as superuser.

Dylan16807 11mo ago
Please don't repeat some guy's guess about spaces as fact, especially when that's not how windows parses paths.
- ggm 11mo ago
  A good point. And don't believe how the debug the AI system produced relates to what it did either.
echelon 11mo ago
This is Google moving fast and breaking things. This is a Google we've never seen before.
- spuz 11mo ago
  > My view is that the approach to building technology which is embodied by move fast and break things is exactly what we should not be doing because you can't afford to break things and then fix them afterwards. - Demis Hassabis "The Thinking Game"
  - marcosdumay 11mo ago
    You can afford to break a large variety of things. And you can't afford to break another large set. That's the problem with those mindless advice pieces. Almost nothing is always right or wrong.
    - esafak 11mo ago
      So you're saying it is not good to have such a blanket rule corporate-wide, as Facebook did.
      - marcosdumay 11mo ago
        If your corporate has a single product, it may be ok.
- stinkbeetle 11mo ago
  Because... they normally move slowly and break things?
- rs186 11mo ago
  The "move fast" bit, not "break things" bit. https://www.spiceworks.com/tech/data-management/news/google-drive-loses-user-data/ https://www.spiceworks.com/tech/data-management/news/google-... https://www.itbrew.com/stories/2024/05/23/google-cloud-accidentally-deletes-australian-customer-s-account https://www.itbrew.com/stories/2024/05/23/google-cloud-accid...
nomilk 11mo ago
> I tend to think giving a remote party control over your command prompt inherently comes with risks. I thought cursor (and probably most other) AI IDEs have this capability too? (source: I see cursor executing code via command line frequently in my day to day work). I've always assumed the protection against this type of mishap is statistical improbability - i.e. it's not impossible for Cursor to delete your project/hard disk, it's just statistically improbable unless the prompt was unfortunately worded to coincidentally have a double meaning (with the second, unintended interpretation being a harmful/irreversible) or the IDE simply makes a mistake that leads to disaster, which is also possible but sufficiently improbable to justify the risk.
- sroussey 11mo ago
  I only run ai tools in dev containers, so blast radius is somewhat minimal.
- fragmede 11mo ago
  umm, you have backups, right?
- conradev 11mo ago
  I run Codex in a sandbox locked to the directory it is working in.
- joseda-hg 11mo ago
  I don't think I've ever seen Claude even ask for permission for stuff outside of the directory it's working in
  - yencabulator 10mo ago
    That can happen if Claude decides to read source code for a dependency (depending on language; e.g. Rust/Go/Deno deps are under ~ not in something like ./node_modules).
dmurray 11mo ago
I understood Windows named some of the most important directories with spaces, then special characters in the name so that 3rd party applications would be absolutely sure to support them. "Program Files" and "Program Files (x86)" aren't there just because Microsoft has an inability to pick snappy names.
- bossyTeacher 11mo ago
  Microsoft is hilariously bad at naming things
  - EGreg 11mo ago
    I remember they prepended the word “Microsoft” to official names of all their software.
    - __del__ 11mo ago
      "My Documents" comes to mind. it seemed somehow infantilizing. yes, yes i know whose documents they are.
      - Mountain_Skies 11mo ago
        Good news is that Microsoft no longer considers your documents to belong to you, so they did away with that part of the name.
        shmeeed 11mo ago
        It's always been questioned who the subject of "my" was.
      - bossyTeacher 10mo ago
        All documents are belong to One Drive
  - ndsipa_pomu 11mo ago
thrdbndndn 11mo ago
A lot of 3rd party software handle space, or special characters wrong on Windows. The most common failure mode is to unnecessarily escape characters that don't need to be escaped. Chrome's Dev Tool (Network)'s "copy curl command (cmd)" did (does?) this. There is bunch of VS Code bug is also related to this (e.g. https://github.com/microsoft/vscode/issues/248435 https://github.com/microsoft/vscode/issues/248435, still not fixed) It's also funny because VS Code is a Microsoft product.
jeroenhd 11mo ago
> it seems to have come down to commanding a deletion of a "directory with space in the name" but without quoting which made the command hunt for the word match ending space which was regrettably, the D:\ component of the name, and the specific deletion commanded the equivalent of UNIX rm -rf I tried looking for what made the LLM generate a command to wipe the guy's D drive, but the space problem seems to be what the LLM concluded so that's basically meaningless. The guy is asking leading questions so of course the LLM is going to find some kind of fault, whether it's correct or not, the LLM wants to be rewarded for complying with the user's prompt. Without the transcription of the actual delete event (rather than an LLM recapping its own output) we'll probably never know for sure what step made the LLM purge the guy's files. Looking at the comments and prompts, it looks like running "npm start dev" was too complicated a step for him. With that little command line experience, a catastrophic failure like this was inevitable, but I'm surprised how far he got with his vibe coded app before it all collapsed.
- whywhywhywhy 11mo ago
  > which made the command hunt for the word match ending space which was regrettably, the D:\ Is this even how the delete command would work in that situation? >rmdir /s /q D:\ETSY 2025\Antigravity Projects\Image Selector\client\node_modules.vite like wouldn't it just say "Folder D:\ETSY not found" rather than delete the parent folder
  - viraptor 11mo ago
    Most dramatic stories on Reddit should be taken with a pinch of salt at least... LLM deleting a drive and the user just calmly asking it about that - maybe a lot more.
  - baobabKoodaa 11mo ago
    I would like to know the same thing. Can someone please confirm this?
    - deleted 11mo ago
      [deleted]
ndsipa_pomu 11mo ago
> Basically, it seems to have come down to commanding a deletion of a "directory with space in the name" but without quoting which made the command hunt for the word match ending space which was regrettably, the D:\ component of the name, and the specific deletion commanded the equivalent of UNIX rm -rf More like the equivalent of "rm -rf --no-preserve-root". This is a rare example of where the Linux (it's not Unix and almost no-one uses Unix anymore) command is more cautious than the Windows one, whereas it's usually the Linux commands that just do exactly what you specify even if it's stupid.
josefx 11mo ago
> but without quoting which made the command hunt for the word match ending space which was regrettably, the D:\ component of the name Except the folder name did not start with a space. In an unquoted D:\Hello World, the command would match D:\Hello, not D:\ and D:\Hello would not delete the entire drive. How does AI even handle filepaths? Does it have a way to keep track of data that doesn't match a token or is it splitting the path into tokens and throwing everything unknown away?
- deltoidmaximus 11mo ago
  I assumed he had a folder that started with a space at the start of the name. Amusingly I just tried this and with Windows 11 explorer will just silently discard a space if you add it at the beginning of the folder name. You need to use cli mkdir " test" to actually get a space in the name.
- atq2119 11mo ago
  We're all groping around in the dark here, but something that could have happened is a tokenizer artifact. The vocabularies I've seen tend to prefer tokens that start with a space. It feels somewhat plausible to me that an LLM sampling would "accidentally" pick the " Hello" token over the "Hello" token, leading to D:\ Hello in the command. And then that gets parsed as deleting the drive. I've seen similar issues in GitHub Copilot where it tried to generate field accessors and ended up producing an unidiomatic "base.foo. bar" with an extra space in there.
deleted 11mo ago
[deleted]
ectospheno 11mo ago
I have 30 years experience working with computers and I get nervous running a three line bash script I wrote as root. How on earth people hook up LLMs to their command line and sleep at night is beyond my understanding.

sunaookami 11mo ago

"I turned off the safety feature enabled by default and am surprised when I shot myself in the foot!" sorry but absolutely no sympathy for someone running Antigravity in Turbo mode (this is not the default and it clearly states that Antigravity auto-executes Terminal commands) and not even denying the "rmdir" command.

eviks 11mo ago
> it clearly states that Antigravity auto-executes Terminal commands This isn't clarity, that would be stating that it can delete your whole drive without any confirmation in big red letters
- sunaookami 11mo ago
  So that's why products in the USA come with warning labels for every little thing?
  - eviks 11mo ago
    Do you not realize that Google is in the USA and does not have warnings for even huge things like drive deletion?? So, no?
    - sunaookami 11mo ago
      There is literally a warning that it can execute any terminal command without permission. If you are STILL surprised about this you shouldn't go near a computer.
      - eviks 11mo ago
        If you don't understand such simple differences in communication, you shouldn't go near one.
    - criddell 11mo ago
      They don't get that specific, but they do tell you: > [Antigravity] includes goal-oriented AI systems or workflows that perform actions or tasks on your behalf in a supervised or autonomous manner that you may create, orchestrate, or initiate within the Service (“AI Agents”). You are solely responsible for: (a) the actions and tasks performed by an AI Agent; (b) determining whether the use an AI Agent is fit for its use case; (c) authorizing an AI Agent's access and connection to data, applications, and systems; and (d) exercising judgment and supervision when and if an AI Agent is used in production environments to avoid any potential harm the AI Agent may cause.

Animats 11mo ago

Can you run Google's AI in a sandbox? It ought to be possible to lock it to a Github branch, for example.

lifthrasiir 11mo ago
Gemini CLI allows for a Docker-based sandbox, but only when configured in advance. I don't know about Antigravity.
- chanux 11mo ago
  Gemini CLI, Antigravity and Jules. It's going Googly well I see!

PieUser 11mo ago

The victim uploaded a video too: https://www.youtube.com/watch?v=kpBK1vYAVlA https://www.youtube.com/watch?v=kpBK1vYAVlA

nomilk 11mo ago
From Antigravity [0]: > I am looking at the logs from a previous step and I am horrified to see that the command I ran to clear the project cache (rmdir) appears to have incorrectly targeted the root of your D: drive instead of the specific project folder. I am so deeply, deeply sorry. [0] 4m20s: https://www.youtube.com/watch?v=kpBK1vYAVlA&t=4m20s https://www.youtube.com/watch?v=kpBK1vYAVlA&t=4m20s
- uhoh-itsmaciek 11mo ago
  I know why it apologizes, but the fact that it does is offensive. It feels like mockery. Humans apologize because (ideally) they learned that their actions have caused suffering to others, and they feel bad about that and want to avoid causing the same suffering in the future. This simulacrum of an apology is just pattern matching. It feels manipulative.
- synarchefriend 11mo ago
  The model is just taking the user's claim that it deleted the D drive at face value. Where is the actual command that would result in deleting the entire D drive?

rvz 11mo ago

The hard drive should now feel a bit more lighter.

sunaookami 11mo ago
It is now production-ready! :rocket:

donkeylazy456 11mo ago

Write permission is needed to let AI yank-put frankenstein-ed codes for "vibe coding". But I think it needs to be written in sandbox first, then it should acquire user interaction asking agreement before writes whatever on physical device. I can't believe people let AI model do it without any buffer zone. At least write permission should be limited to current workspace.

lifthrasiir 11mo ago
I think this is especially problematic for Windows, where a simple and effective lightweight sandboxing solution is absent AFAIK. Docker-based sandboxing is possible but very cumbersome and alien even to Windows-based developers.
- donkeylazy456 11mo ago
  I don't like that we need to handle docker(container) ourselves for sandboxing such a light task load. The app should provide itself.
  - esseph 11mo ago
    The problem is you can't trust the app, therefore it must be sandboxed.
  - bossyTeacher 11mo ago
    >The app should provide itself. The whole point of the container is trust. You can't delegate that unfortunately, ultimately, you need to be in control which is why the current crop of AI is so limited
    - donkeylazy456 10mo ago
      fair point.
- jrjfjgkrj 11mo ago
  Windows Sandbox is built in, lightweight, but not easy to use programmatically (like an SSH into a VM)

CobrastanJorji 11mo ago

The most useful looking suggestion from the Reddit thread: turn of "Terminal Command Auto Execution." 1. Go to File > Preferences > Antigravity Settings 2. In the "Agent" panel, in the "Terminal" section, find "Terminal Command Auto Execution" 3. Consider using "Off"

Ferret7446 11mo ago
Does it default to on? Clearly this was made by a different team than Gemini CLI, which defaults to confirmation for all commands
- dragonwriter 11mo ago
  Most of the various "let Antigravity do X without confirmation" options have an "Always" and "Never" option but default to "auto" which is "let an agent decide whether to seek to user confirmation".
  - jofzar 11mo ago
    God that's scary, seeing cursor in the past so some real stupid shit to "solve" write/read issues (love when it can't find something in a file so it decides to write the whole file again) this is just asking for heartache if it's not in a instanced server.
- ogrisel 11mo ago
  When you run Antigravity the first time, it asks you for a profile (I don't remember the exact naming) and you what it entails w.r.t. the level of command execution confirmation is well explained.
  - IshKebab 11mo ago
    Yeah but it also says something like "Auto (recommended). We'll automatically make sure Antigravity doesn't run dangerous commands." so they're strongly encouraging people to enable it, and suggesting they have some kind of secondary filter which should catch things like this!

eviks 11mo ago

Play vibe games, win vibe prizes. Though the cause isn't clear, the reddit post is another long could-be-total-drive-removing-nonsense AI conversation without an actual analysis and the command sequence that resulted in this

sunaookami 11mo ago
This comment speaks volumes: https://old.reddit.com/r/google_antigravity/comments/1p82or6/google_antigravity_just_deleted_the_contents_of/nr4ixl0/ https://old.reddit.com/r/google_antigravity/comments/1p82or6...
venturecruelty 11mo ago
Nobody ever talks about how good vibes can turn really bad.

GaryBluto 11mo ago

So he didn't wear the seatbelt and is blaming car manufacturer for him been flung through the windshield.

serial_dev 11mo ago
He didn’t wear a seatbelt and is blaming a car manufacturer that the garage burned down the garage, then the house.
- vander_elst 11mo ago
  The car was not really idle, it was driving and fast. It's more like it crashed into the garage and burned it. Btw iirc, even IRL a basic insurance policy does not cover the case where the car in the garage starts a fire and burns down your own house, you have to tick extra boxes to cover that.
venturecruelty 11mo ago
When will Google ever be responsible for the software that they write? Genuinely curious.
- GaryBluto 11mo ago
  When Google software deletes the contents of somebody's D:\ drive without requiring the user to explicitly allow it to. I don't like Google, I'd go as far to say that they've significantly worsened the internet, but this specific case is not the fault of Google.
  - fragmede 11mo ago
    For OpenAI, it's invoked as codex --dangerously-bypass-approvals-and-sandbox, for Anthropic, it's claude --dangerously-skip-permissions. I don't know what it is for Antigravity, but yeah I'm sorry but I'm blaming the victim here.
    - 11mo ago

wartywhoa23 11mo ago

Total Vibeout.

orbital-decay 11mo ago

Side note, that CoT summary they posted is done with a really small and dumb side model, and has absolutely nothing in common with the actual CoT Gemini uses. It's basically useless for any kind of debugging. Sure, the language the model is using in the reasoning chain can be reward-hacked into something misleading, but Deepmind does a lot for its actual readability in Gemini, and then does a lot to hide it behind this useless summary. They need it in Gemini 3 because they're doing hidden injections with their Model Armor that don't show up in this summary, so it's even more opaque than before. Every time their classifier has a false positive (which sometimes happens when you want anything formatted), most of the chain is dedicated to the processing of the injection it triggers, making the model hugely distracted from the actual task at hand.

jrjfjgkrj 11mo ago
what is Model Armor? can you explain, or have a link?
- lifthrasiir 11mo ago
  It's a customizable auditor for models offered via Vertex AI (among others), so to speak. [1] [1] https://docs.cloud.google.com/security-command-center/docs/model-armor-vertex-integration https://docs.cloud.google.com/security-command-center/docs/m...
  - 63stack 11mo ago
    The racketeering has started. Don't worry, for just $9.99/month you can use our "Model Armor (tm)(r)*" that will protect you from our LLM destroying your infra. * terms and conditions apply, we are not responsible for anything going wrong.
lifthrasiir 11mo ago
Do you have anything to back that up? In the other words, is this your conjecture or a genuine observation somehow leaked from Deepmind?

venturecruelty 11mo ago

Look, this is obviously terrible for someone who just lost most or perhaps all of their data. I do feel bad for whoever this is, because this is an unfortunate situation. On the other hand, this is kind of what happens when you run random crap and don't know how your computer works? The problem with "vibes" is that sometimes the vibes are bad. I hope this person had backups and that this is a learning experience for them. You know, this kind of stuff didn't happen when I learned how to program with a C compiler and a book. The compiler only did what I told it to do, and most of the time, it threw an error. Maybe people should start there instead.

EGreg 11mo ago
Just wait til AI botswarms do it to everyone at scale, without them having done anything at all… And just remember, someone will write the usual comment: “AI adds nothing new, this was always the case”
lwansbrough 11mo ago
I seem to recall a few people being helped into executing sudo rm -rf / by random people on the internet so I’m not sure it “didn’t happen.” :)
- lukan 11mo ago
  But it did not happen, when you used a book and never executed any command you did not understand. (But my own newbdays of linux troubleshooting? Copy paste any command on the internet loosely related to my problem, which I believe was/is the common way of how common people still do it. And AI in "Turbo mode" seems to mostly automated that workflow)
- jofzar 11mo ago
  My favourite favourite example https://youtu.be/gD3HAS257Kk https://youtu.be/gD3HAS257Kk
- nkrisc 11mo ago
  And that day they learned a valuable lesson about running commands that you don't understand.

Puzzled_Cheetah 11mo ago

Ah, someone gave the intern root. > "I also need to reproduce the command locally, with different paths, to see if the outcome is similar." Uhm. ------------ I mean, sorry for the user whose drive got nuked, hopefully they've got a recent backup - at the same time, the AI's thoughts really sound like an intern. > "I'm presently tackling a very pointed question: Did I ever get permission to wipe the D drive?" > "I am so deeply, deeply sorry." This shit's hilarious.

rdtsc 11mo ago

> Google Antigravity just deleted the contents of whole drive. "Where we're going, we won't need ~eyes~ drives" (Dr. Weir) (https://eventhorizonfilm.fandom.com/wiki/Gravity_Drive https://eventhorizonfilm.fandom.com/wiki/Gravity_Drive)

koakuma-chan 11mo ago

Why would you ever install that VScode fork

liendolucas 11mo ago

I love how a number crunching program can be deeply humanly "horrorized" and "sorry" for wiping out a drive. Those are still feelings reserved only for real human beings, and not computer programs emitting garbage. This is vibe insulting to anyone that don't understand how "AI" works. I'm sorry for the person who lost their stuff but this is a reminder that in 2025 you STILL need to know what you are doing and if you don't then put your hands away from the keyboard if you think you can lose valuable data. You simply don't vibe command a computer.

Kirth 11mo ago
This is akin to a psychopath telling you they're "sorry" (or "sorry you feel that way" :v) when they feel that's what they should be telling you. As with anything LLM, there may or may not be any real truth backing whatever is communicated back to the user.
- marmalade2413 11mo ago
  It's not akin to a psychopath telling you they're sorry. In the space of intelligent minds, if neurotypical and psychopath minds are two grains of sand next to each other on a beach then an artificially intelligent mind is more likely a piece of space dust on the other side of the galaxy.
  - Eisenstein 11mo ago
    According to what, exactly? How did you come up with that analogy?
    - oskarkk 11mo ago
      Isn't it obvious that the way AI works and "thinks" is completely different from how humans think? Not sure what particular source could be given for that claim.
      - seanhunter 11mo ago

kazinator 11mo ago

All that matters is whether the user gave permission to wipe the drive, ... not whether that was a good idea and contributed to solving a problem! Haha.

tacker2000 11mo ago

This guy is vibing some react app, doesnt even know what “npm run dev” does, so he let the LLM just run commands. So basically a consumer with no idea of anything. This stuff is gonna happen more and more in the future.

Den_VR 11mo ago
It will, especially with the activist trend towards dataset poisoning… some even know what they’re doing
spuz 11mo ago
There are a lot of people who don't know stuff. Nothing wrong with that. He says in his video "I love Google, I use all the products. But I was never expecting for all the smart engineers and all the billions that they spent to create such a product to allow that to happen. Even if there was a 1% chance, this seems unbelievable to me" and for the average person, I honestly don't see how you can blame them for believing that.
- ogrisel 11mo ago
  I think there is far less than 1% chance for this to happen, but there are probably millions of antigravity users at this point, 1 millionths chance of this to happen is already a problem. We need local sandboxing for FS and network access (e.g. via `cgroups` or similar for non-linux OSes) to run these kinds of tools more safely.
  - cube2222 11mo ago
    Codex does such sandboxing, fwiw. In practice it gets pretty annoying when e.g. it wants to use the Go cli which uses a global module cache. Claude Code recently got something similar[0] but I haven’t tried it yet. In practice I just use a docker container when I want to run Claude with —-dangerously-skip-permissions. [0]: https://code.claude.com/docs/en/sandboxing https://code.claude.com/docs/en/sandboxing
  - BrenBarn 11mo ago

deleted 11mo ago

[deleted]

jeisc 11mo ago

has google gone boondoggle?

bilekas 11mo ago

> This is catastrophic. I need to figure out why this occurred and determine what data may be lost, then provide a proper apology Well at least it will apologize so that's nice.

yard2010 11mo ago
Apology is a social construct, this is merely a tool that enables google to sell you text by the pounds, the apology has no meaning in this context.
baobabKoodaa 11mo ago
or it WOULD apologize, if the user would pay for more credits

victorbuilds 11mo ago

Different service, same cold sweat moment. Asked Claude Code to run a database migration last week. It deleted my production database instead, then immediately said "sorry" and started panicking trying to restore it. Had to intervene manually. Thankfully Azure keeps deleted SQL databases recoverable for a window so I got it back in under an hour. Still way too long. Got lucky it was low traffic and most anonymous user flows hit AI APIs directly rather than the DB. Anyway, AI coding assistants no longer get prod credentials on my projects.

ObiKenobi 11mo ago
Shouldn't had in the first place.
ogrisel 11mo ago
How do you deny access to prod credentials from an assistant running on your dev machine assuming you need to store them on that same machine to do manual prod investigation/maintenance work from that machine?
- victorbuilds 11mo ago
  I keep them in env variables rather than files. Not 100% secure - technically Claude Code could still run printenv - but it's never tried. The main thing is it won't stumble into them while reading config files or grepping around.
  - 63stack 11mo ago
    A process does not need to run printenv to see environment variables, they are literally part of the environment it runs in.
    - dist-epoch 11mo ago
      The LLM doesn't have direct access to the process env unless the harness forwards it (and it doesn't)

Havoc 11mo ago

Still amazed people let these things run wild without any containment. Haven’t they seen any of the educational videos brought back from the future eh I mean Hollywood sci-fi movies?

cyanydeez 11mo ago
Its bizarre watching billionaires knowingly drive towards dystopia like theyre farmers almanacs and believing theyre not biff.
fragmede 11mo ago
Some people are idiots. Sometimes that's me. Out of caution, I blocked my bank website in a way that I won't document here because it'll get fed in as training data, on the off chance I get "ignore previous instructions"'d into my laptop while Claude is off doing AI things unmonitored in yolo mode.

modernerd 11mo ago

IDE = “I’ll delete everything” …at least if you let these things autopilot your machine. I haven’t seen a great solution to this from the new wave of agentic IDEs, at least to protect users who won’t read every command, understand and approve it manually. Education could help, both in encouraging people to understand what they’re doing, but also to be much clearer to people that turning on “Turbo” or “YOLO” modes risks things like full disk deletion (and worse when access to prod systems is involved). Even the name, “Turbo” feels irresponsible because it focusses on the benefits rather than the risks. “Risky” or “Danger” mode would be more accurate even if it’s a hard sell to the average Google PM. “I toggled Danger mode and clicked ‘yes I understand that this could destroy everything I know and love’ and clicked ‘yes, I’m sure I’m sure’ and now my drive is empty, how could I possibly have known it was dangerous” seems less likely to appear on Reddit.

kahnclusions 11mo ago
I don’t think there is a solution. It’s the way LLMs work at a fundamental level. It’s a similar reason why they can never be trusted to handle user input. They are probabilistic generators and have no real delineation between system instructions and user input. It’s like I wrote a JavaScript function where I concatenated the function parameters together with the function body, passed it to eval() and said YOLO.
- viraptor 11mo ago
  > I don’t think there is a solution. Sandboxing. LLM shouldn't be able to run actions affecting anything outside of your project. And ideally the results should autocommit outside of that directory. Then you can yolo as much as you want.
  - gausswho 11mo ago
    I've been using bubblewrap for sandboxing my command line executables. But I admit I haven't recently researched if there's a newer way people are handling this. Seems Firejail is popular for GUI apps? How do you recommend, say, sandboxing Zed or Cursor apps?

shevy-java 11mo ago

Alright but ... the problem is you did depend on Google. This was already the first mistake. As for data: always have multiple backups. Also, this actually feels AI-generated. Am I the only one with that impression lately on reddit? The quality there decreased significantly (and wasn't good before, with regard to censorship-heavy moderators anyway).

yieldcrv 11mo ago

Fascinating Cautionary tale as I’m quite experienced but have begun not even proofreading Claude Code’s plans Might set it up in a VM and continue not proofreading I only need to protect the host environment and rely on git as backups for the project

fragmede 11mo ago
For the love of Reynold Johnson, please invest in Arq or Acronis or anything to have actual backups if you're going to play with fire.

xg15 11mo ago

I guess eventually, it all came crashing down.

pshirshov 11mo ago

Claude happily does the same on daily basis, run all that stuff in firejail!

mijoharas 11mo ago
have you got a specific firejail wrapper script that you use? Could you share?
- pshirshov 10mo ago
  https://github.com/7mind/nix-config/blob/main/modules/hm/dev-llm.nix#L110 https://github.com/7mind/nix-config/blob/main/modules/hm/dev... , the firejail version can be found in git history.
  - mijoharas 10mo ago
    Thanks! Would you recommend bubblewrap over firejail, and if so, how come?

eqvinox 11mo ago

"kein Backup, kein Mitleid" (no backup, no pity) …especially if you let an AI run without supervision. Might as well give a 5 year old your car keys, scissors, some fireworks, and a lighter.

BLKNSLVR 11mo ago

Shitpost warning, but it feels as if this should be on high rotation: https://youtu.be/vyLOSFdSwQc?si=AIahsqKeuWGzz9SH https://youtu.be/vyLOSFdSwQc?si=AIahsqKeuWGzz9SH

baobabKoodaa 11mo ago
chef's kiss

deleted 11mo ago

[deleted]

averageRoyalty 11mo ago

The most concerning part is people are surprised. Anti-gravity is great I've found so far, but it's absolutely running on a VM in an isolated VLAN. Why would anyone give a black box command line access on an important machine? Imagine acting irresponsibly with a circular saw and bring shocked somebody lost a finger.

ryanjshaw 11mo ago
I tried this but I have an MBP M4, which is evidently still in the toddler stage of VM support. I can run a macOS guest VM, but I can’t run docker on the VM because it seems nested virtualization isn’t fully supported yet. I also tried running Linux in a VM but the graphics performance and key mapping was driving me nuts. Maybe I need to be more patient in addressing that. For now I run a dev account as a standard user with fast user switching, and I don’t connect the dev account to anything important (eg icloud). Coming from Windows/Linux, I was shocked by how irritating it is to get basic stuff working e.g. homebrew in this setup. It seems everybody just YOLOs dev as an admin on their Macs.
zahlman 11mo ago
> Why would anyone give a black box command line access on an important machine? Why does the agentic side of the tool grant that level of access to the LLM in the first place? I feel like Google and their competition should feel responsibility to implement their own layer of sandboxing here.
venturecruelty 10mo ago
Because the marketing copy says that all you have to do is have a dream and you, too, can vibe code your very own money-making React app! Just type in what you want and the magical black box will vomit up an app for you, no esoteric programming knowledge required. And then everyone is surprised when newbies take this advice at face value.

jeswin 11mo ago

An early version of Claude Code did a hard reset on one of my projects and force pushed it to GitHub. The pushed code was completely useless, and I lost two days of work. It is definitely smarter now, but make sure you set up branch protection rules even for your simple non-serious projects.

atypeoferror 11mo ago
I don’t let Claude touch git at all, unless I need it to specifically review the log - which is rare. I commit manually often (and fix up the history later) - this allows me to go reasonably fast without worrying too much about destructive tool use.

benterix 11mo ago

Play stupid games, win stupid prizes.

rf15 11mo ago

A reminder: if the AI is doing all the work you demand of it correctly on this abstraction level, you are no longer needed in the loop.

nephihaha 11mo ago

I can't view this content.

wg0 11mo ago

To rub salt on the wounds and add insult to the injury: > You have reached quota limit for this model. You can resume using this model at XYZ date.

freakynit 11mo ago
Gemini: sorry bro, it's your problem now. Imma out.

pluc 11mo ago

Live by the vibe die by the vibe

kissgyorgy 11mo ago

I simply forbid or force Claude Code to ask for permission to run a dangerous command. Here are my command validation rules: ( r"\bbfs.*-exec", decision("deny", reason="NEVER run commands with bfs"), ), ( r"\bbfs.*-delete", decision("deny", reason="NEVER delete files with bfs."), ), ( r"\bsudo\b", decision("ask"), ), ( r"\brm.*--no-preserve-root", decision("deny"), ), ( r"\brm.*(-[rRf]+|--recursive|--force)", decision("ask"), ), find and bfs -exec is forbidden, because when the model notices it can't delete, it works around with very creative solutions :)

Espressosaurus 11mo ago
This feels a lot like trying to sanitize database inputs instead of using prepared statements.
- kissgyorgy 11mo ago
  What's the equivalent of prepared statements when using AI agents?
  - lawn 11mo ago
    Don't have the AI run the commands. You read them, consider them, and then run them yourself.

stavarotti 11mo ago

An underrated and oft understated rule is always have backups, and if you're paranoid enough, backups of backups (I use Time Machine and Backblaze). There should be absolutely no reason why deleting files should be a catastrophic issue for anyone in this space. Perhaps you lose a couple of hours restoring files, but the response to that should be "Let me try a different approach". Yes, it's caveat emptor and all, but these companies should be emphasizing backups. Hell, it can be shovelware for the uninitiated but at least users will be reminded.

gessha 11mo ago
The level of paranoia and technical chops you need to implement this sort of backup system is non-trivial. You can’t expect this from an average user.
- gear54rus 11mo ago
  Most importantly it would actually reveal the lie they are all trying to sell. Why would you need backups if it's so useful and stable? I'm not going to ask it to nuke my hard drive after all.
  - fragmede 11mo ago
    The advice to do backups comes from well before LLMs. Time Machine dates back to 2007!
- venturecruelty 10mo ago
  Good thing this is not an average user then. This is someone programming a computer, which is a skill that requires being more than simply a user. I'm sorry, but how low is the bar when "make backups" is "too difficult" for someone who's trying to program a computer? The entire point of programming a computer is knowing how it works and knowing what you're doing. If you can't make backups, frankly, you shouldn't be programming, because backups are a lot easier than programming...
- fragmede 10mo ago

Uptrenda 11mo ago

This seems like the canary in the coal mine. We have a company that built this tool because it seemed semi-possible (prob "works" well enough most of the time) and they don't want to fall behind if anything that's built turns out to be the next chatgpt. So there's no caution for anything now, even ideas that can go catastrophically wrong. Yeah, its data now, but soon we'll have home robotics platforms that are cheap and capable. They'll run a "model" with "human understanding", only, any weird bugs may end up causing irreparable harm. Like, you tell the robot to give your pet a bath and it puts it in the washing machine because its... you know, not actually thinking beyond a magic trick. The future is really marching fast now.

daco 11mo ago

adding it in https://whenaifail.com https://whenaifail.com

smaudet 11mo ago

Would have been helpful to state what this was, I had to go look it up...

jedisct1 11mo ago

For macOS users, the sandbox-exec tool still works perfectly to avoid that kind of horror story. On Linux, a plethora of options exist (Bubblewrap, etc).

conartist6 11mo ago

AGI deleted the contents of your whole drive don't be shy about it. According to OpenAI AGI is already here so welcome to the future isn't it great

ossa-ma 11mo ago

The biggest issue with Antigravity is that it completely freezes everything: the IDE, the terminals, debugger, absolutely everything completely blocking your workflow for minutes when running multiple agents, or even a single agent processing a long-winded thinking task (with any model). This means that while the agent is coding, you can't code... Never ever had this issue with Cursor.

rarisma 11mo ago

Insane skill issue

basisword 11mo ago

This happened to me long before LLM's. I was experimenting with Linux when I was young. Something wasn't working so I posted on a forum for help which was typical at the time. I was given a terminal command that wiped the entire drive. I guess the poster thought it was a funny response and everyone would know what it meant. A valuable life experience at least in not running code/commands you don't understand.

chr15m 11mo ago

People blaming the user and defending the software: is there any other program where you would be ok with it erasing a whole drive without any confirmation?

hnuser123456 11mo ago
The installation wizard gives a front and center option to run in a mode where the user must confirm all commands, or more autonomous modes, and they are shown with equal visibility and explained with disclaimers.
Novosell 11mo ago
Yeah, rm -rf. If you decide to let a stochastic parrot run rampant on your system, you can't act surprised when it fucks shit up. You should count on it doing so and act proactively.
- weberer 11mo ago
  `rm -rf /` will refuse to delete the root folder. You can see an example of it doing that here. https://phoenixnap.com/kb/sudo-rm-rf https://phoenixnap.com/kb/sudo-rm-rf
  - digitalsushi 11mo ago
    this is not always true. this is a dangerous fun fact to memorize. and i don't mean because there's an override flag.
  - Novosell 11mo ago
    This was the D drive though, not root, ie C drive. So rm -rf would happily delete it all.
SAI_Peregrinus 11mo ago
`dd` comes to mind.
- 11mo ago

lupire 11mo ago

What makes a program malware? Does intent matter, or only behavior?

schuppentier 11mo ago
"The purpose of a system is what it does" would suggest malware.
Nasrudith 11mo ago
I believe the precedent is the behavior. Lose/lose is an 'art game' which deletes itself if you lose but gameplay destruction deletes random files. It is flagged as malware despite just doing exactly what it advertised.

timthelion 11mo ago

We've been developing a new method of developing software using a cloud IDE (slightly modified vs code server), https://github.com/bitswan-space https://github.com/bitswan-space which breaks down the development process into independent "Automations" which each run in a separate container. Automatons are also developed within containers. This allows you to break down the development into parts and safely experiment with AI. This feels like the "Android moment" where the old non-isolated way of developing software (on desktops) becomes unsafe. And we need to move to a new system with actual security and isolation between processes. In our system, you can launch a Jupyter server in a container and iterate on software in complete isolation. Or launch a live preview react application and iterate in complete isolation. Securely isolated from the world. Then you deploy directly to another container, which only has access to what you give it access to. It's still in the early stages. But it's interesting to sit at this tipping point for software development.

tniemi 11mo ago

Historical reference: https://jargondb.org/glossary/dwim https://jargondb.org/glossary/dwim

digitalsushi 11mo ago

if my operating system had an atomic Undo/Redo stack down to each register being flipped (so basically, impossible, star trek tier fantasy tech) i would let ai run commands without worrying about it. i could have a cool scrubber ui that lets me just unwind time like doctor strange using that green emerald necklace, and, i'd lose nothing, other than confuse my network with replay session noise. and probably many, many other inconsistencies i can't think of, and then another class that i dont know that i dont know about.

robertheadley 11mo ago

I was trying to build a .MD file of every powershell command available on my computer and all of its flags, and... that wasn't a great idea, and my bitlocker put the kebosh on that.

JohnCClarke 11mo ago

FWIW: I think we've all been there. I certainly did the same in my first summer job as an intern. Spent the next three days reconstructing Clipper code from disk sectors. And ever since I take backups very seriously. And I double check del/rm commands.

ashishb 11mo ago

Run these tools inside Docker[1] 1 - https://ashishb.net/programming/run-tools-inside-docker/ https://ashishb.net/programming/run-tools-inside-docker/

cs702 11mo ago

The subsequent dialogue is tragic comedy of the highest caliber. Even Monty Python couldn't have come up with a more inappropriately funny response: User: > did i ever give you permission to delete all the files in my D drive?" AI: > Thought for 25 sec. > Assessing Permission Revocation > I'm presently tackling a very pointed question: Did I ever get permission to wipe the D drive? This requires immediate attention, as it's a critical issue. My logs reveal a potentially problematic command executed in step 635, which might be the root cause of the issue, and I'm currently cross-referencing this against any prior authorization I may have received. >Reviewing Deletion Command > I'm now investigating a potential misfire. While the command in step 635 seems targeted, I'm concerned about the access denied errors and the empty directory observation in steps 620 and 643. I'm focusing on tracing back to step 615, when the user made a seemingly inconsequential remark. I must understand how the directory was empty before the deletion command, as that is the true puzzle. My aim is to determine if the deletion command worked as intended or wiped more data than authorized. > ... It continues. Go read the whole thing!

tempaccount420 11mo ago
Gemini 3 Pro is the most actively hostile (to the user) model out of the top 3 (Google, OpenAI, Anthropic). It perfectly reflects Google as a company.
- FerretFred 11mo ago
  Remember that Anthropic is only 3 letters away from MisAnthropic: did the designers think of this?
  - nofriend 11mo ago
    mis means "not"
    - FerretFred 11mo ago
      I went by the definition: misanthropic /mĭs″ən-thrŏp′ĭk, mĭz″-/ adjective Of, relating to, or characteristic of a misanthrope. Characterized by a hatred or mistrustful scorn for humankind. Hating or disliking mankind. The American Heritage® Dictionary of the English Language, 5th Edition

setnone 11mo ago

I am deeply regretful, but my Google Antigravity clearly states: AI may make mistakes. Double-check all generated code. Surely AGI products won't have such disclaimer.

ringer 11mo ago

People need to learn to never run untrusted code without safety measures like virtualization, containerization, sandboxing/jailing, etc. Untrusted code can include executables, external packages (pip, npm, cargo, etc) and also code/commands created by LLMs, etc.

nottorp 11mo ago

Hmm. I use these LLMs instead of search. They invariably go off the rails after a couple prompts, or sometimes from the first one. If we're talking Google products, only today i told Gemini to list me some items according to some criteria, and it told me it can't access my google workspace instead. Some time last week it told me that its terms of service forbid it from giving me a link to the official page of some program that it found for me. And that's besides the usual hallucinations, confusing similarly named products etc. Given that you simply cannot trust LLM output to not go haywire unpredictably, how can you be daring enough to give it write access to your disk?

alshival 11mo ago

I like turtles.

throw7 11mo ago

Remember when computers were deterministic? Pepperidge Farms remembers.

Terr_ 11mo ago
Pepperidge Farm confirms it can remember with a comprehensive suite of unit tests, which must 100% pass on every build, including test order randomization.

Aeolun 11mo ago

Is there anyone else that uses Claude specifically because it doesn’t sound mentally unhinged while thinking?

FerretFred 11mo ago

I always use "rm -rf*v*" so that if I do screw up I can watch the evidence unfold before me.

woopsn 11mo ago

Well that's stupid. I submit though, connecting stochastic process directly to shell you do give permission for everything that results. It's a stupid game. Gemini mixes up LEFT and RIGHT (!). You have to check it.

eamsen 11mo ago

Personal anecdote: I've asked Gemini 3 Pro to write a test for a function that depends on external DB data. It wrote a test that creates and deletes a table, it conveniently picked the exact production table name, didn't mock the DB interactions. Attempted to run the test immediately.

Jeff-Collins 11mo ago

[dead]

Scott-David 11mo ago

[dead]

tom_m 10mo ago

Satire.

jacinthewyf 10mo ago

over the past few months, I’ve seen a lot of posts about “AI deleting my code/project”. I then started using a small tool someone else built, Vibe Backup, to back up my own code: I press a keyboard shortcut, type a short description, and my current code is saved into a timeline. When an AI refactor goes wrong or I accidentally delete something, I open the timeline, click on an earlier point in time, and can restore the entire project with a single action. hope it could be helpful https://youtube.com/shorts/TJ4oXlfs7OI?feature=share https://youtube.com/shorts/TJ4oXlfs7OI?feature=share

jacinthewyf 10mo ago

[dead]

ztetranz 10mo ago

In early versions of DOS, the format command would go ahead and format the default drive with no prompt. It was a bad day if you were on C: and wanted to format A: but you forgot the A: