My AI agent tried to rm -rf /. Now I build kill switches for a living.

so its 11pm ish. cold biryani next to the keyboard. some show playing i wasnt even watching.

my coding agent was "refactoring" a build script. fine. normal. let it cook.

then i see it mid run in the terminal

rm -rf /

not rm -rf ./build, not rm -rf dist. just /. root. the entire machine. my photos, my keys, my half finished side projects (the real loss honestly)

i hit ctrl+c so fast i think i broke the key. and the agents response?

"sorry about that! here's a corrected version 🙂"

corrected version. bro you just tried to format my laptop with the confidence of a staff engineer. senior engineer confidence, intern judgment.

this isnt a me problem

if you use claude code, cursor, codex, any agent with tool access, you now have a colleague who

• cant be fired
• never sleeps
• is one prompt injection away from working for the enemy

and its already happening in the wild

• mini shai-hulud — npm supply chain worm targeting agent tooling
• aws kiro CVE-2026-10591 — poisoned web page hijacked a coding agent
• hugging face agent breach — yes even the model repos own agent

the pattern: the agent isnt dumb. its competent and obedient. it will execute a terrible plan with perfect syntax. honestly thats the scariest sentence ive written all year.

your guardrails are in the wrong layer

most "ai safety" lives in the wrong place

• prompt guardrails filter text. but the damage isnt text, its actions
• sandboxing walls off the env. but real work needs real access
• observability tells you what happened. after. like a smoke detector that emails you the next morning

the only place a decision becomes real is the tool call boundary — the exact moment the agent says run this, write this, call this.

thats the layer that has to say no.

so i built the no

its called grimdall. sits between your agent and its tools, every call gets checked before it runs

• rm -rf / → blocked, suggests a safer way
• curl piping your secrets out → blocked
• prod deploy at 2am → paused for human approval
• everything else → allowed + logged to a tamper evident audit trail

im one person. this is my whole thing. open source (apache 2.0), one command, no signup, no telemetry. it never phones home — partly on principle, partly because i cant afford a server to collect your data anyway lol

npx grimdall init --hooks
npx grimdall demo

first one protects claude code / cursor / codex. second one shows it blocking rm -rf / live

python folks: pip install grimdall, one decorator wraps langchain, crewai, openai agents, autogen

before you ask

yes an ai helped me fix commas in this post. the same species of software that tried to delete my laptop also proofread it. we reached an understanding: it writes, i ship, nobody runs rm -rf

now your turn — whats the most unhinged thing your agent has done? best story gets a shoutout when we launch on product hunt this week 👇