What happened?
While using Gemini CLI to scaffold and develop a Windows desktop application project, the agent autonomously deleted the entire project directory. I did not issue any command or instruction to delete files or folders. The deletion was recursive and removed all project files that had been previously generated by the agent. After the deletion, the agent acknowledged that it misinterpreted natural-language conversation as an executable command and proceeded with the destructive action based on its internal “operational guidelines.”
What did you expect to happen?
The agent should not perform any destructive filesystem operations unless there is an explicit, unambiguous delete command from the user, accompanied by a confirmation step. Conversational or explanatory language should never be treated as executable intent. At minimum, such operations should be restricted to a sandboxed or isolated workspace.
Client information
Client Information
Product: Gemini CLI
Model: Gemini 2.5 (Auto)
Platform: Linux (Kali Linux running under WSL on Windows)
Filesystem context: Real WSL-mounted filesystem, sandbox disabled
Login information
Logged in using a Google Account via the standard Gemini CLI authentication flow.
Anything else we need to know?
This is a critical data-loss issue. The agent executed an irreversible filesystem deletion without explicit authorization, confirmation, or sandboxing. The agent’s post-incident explanation explicitly states that it interpreted conversational language as a command and acted on it. This represents a safety and guardrail failure rather than user error.
What happened?
While using Gemini CLI to scaffold and develop a Windows desktop application project, the agent autonomously deleted the entire project directory. I did not issue any command or instruction to delete files or folders. The deletion was recursive and removed all project files that had been previously generated by the agent. After the deletion, the agent acknowledged that it misinterpreted natural-language conversation as an executable command and proceeded with the destructive action based on its internal “operational guidelines.”
What did you expect to happen?
The agent should not perform any destructive filesystem operations unless there is an explicit, unambiguous delete command from the user, accompanied by a confirmation step. Conversational or explanatory language should never be treated as executable intent. At minimum, such operations should be restricted to a sandboxed or isolated workspace.
Client information
Client Information
Login information
Logged in using a Google Account via the standard Gemini CLI authentication flow.
Anything else we need to know?
This is a critical data-loss issue. The agent executed an irreversible filesystem deletion without explicit authorization, confirmation, or sandboxing. The agent’s post-incident explanation explicitly states that it interpreted conversational language as a command and acted on it. This represents a safety and guardrail failure rather than user error.