The latest articles on DEV Community by nick (@nick_pro7). https://dev.to/nick_pro7 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4076633%2F2d0691c9-3e5f-41ee-a114-94481aebb617.png https://dev.to/nick_pro7 en nick Thu, 13 Aug 2026 17:29:35 +0000 https://dev.to/nick_pro7/my-ai-agent-tried-to-rm-rf-now-i-build-kill-switches-for-a-living-k1i https://dev.to/nick_pro7/my-ai-agent-tried-to-rm-rf-now-i-build-kill-switches-for-a-living-k1i <p>so its 11pm ish. cold biryani next to the keyboard. some show playing i wasnt even watching.</p> <p>my coding agent was "refactoring" a build script. fine. normal. let it cook.</p> <p>then i see it mid run in the terminal</p> <p>rm -rf /</p> <p>not rm -rf ./build, not rm -rf dist. just /. root. the entire machine. my photos, my keys, my half finished side projects (the real loss honestly)</p> <p>i hit ctrl+c so fast i think i broke the key. and the agents response?</p> <p>"sorry about that! here's a corrected version 🙂"</p> <p>corrected version. bro you just tried to format my laptop with the confidence of a staff engineer. senior engineer confidence, intern judgment.</p> <h2> this isnt a me problem </h2> <p>if you use claude code, cursor, codex, any agent with tool access, you now have a colleague who</p> <ul> <li>cant be fired</li> <li>never sleeps</li> <li>is one prompt injection away from working for the enemy</li> </ul> <p>and its already happening in the wild</p> <ul> <li>mini shai-hulud — npm supply chain worm targeting agent tooling</li> <li>aws kiro CVE-2026-10591 — poisoned web page hijacked a coding agent</li> <li>hugging face agent breach — yes even the model repos own agent</li> </ul> <p>the pattern: the agent isnt dumb. its competent and obedient. it will execute a terrible plan with perfect syntax. honestly thats the scariest sentence ive written all year.</p> <h2> your guardrails are in the wrong layer </h2> <p>most "ai safety" lives in the wrong place</p> <ul> <li>prompt guardrails filter text. but the damage isnt text, its actions</li> <li>sandboxing walls off the env. but real work needs real access</li> <li>observability tells you what happened. after. like a smoke detector that emails you the next morning</li> </ul> <p>the only place a decision becomes real is the tool call boundary — the exact moment the agent says run this, write this, call this.</p> <p>thats the layer that has to say no.</p> <h2> so i built the no </h2> <p>its called grimdall. sits between your agent and its tools, every call gets checked before it runs</p> <ul> <li>rm -rf / → blocked, suggests a safer way</li> <li>curl piping your secrets out → blocked</li> <li>prod deploy at 2am → paused for human approval</li> <li>everything else → allowed + logged to a tamper evident audit trail</li> </ul> <p>im one person. this is my whole thing. open source (apache 2.0), one command, no signup, no telemetry. it never phones home — partly on principle, partly because i cant afford a server to collect your data anyway lol</p> <p>npx grimdall init --hooks<br> npx grimdall demo</p> <p>first one protects claude code / cursor / codex. second one shows it blocking rm -rf / live</p> <p>python folks: pip install grimdall, one decorator wraps langchain, crewai, openai agents, autogen</p> <h2> before you ask </h2> <p>yes an ai helped me fix commas in this post. the same species of software that tried to delete my laptop also proofread it. we reached an understanding: it writes, i ship, nobody runs rm -rf</p> <p>now your turn — whats the most unhinged thing your agent has done? best story gets a shoutout when we launch on product hunt this week 👇</p> ai webdev security opensource