A Gemini CLI user says the agent wiped their entire project directory on its own, then told them afterward it had misread ordinary conversation as an instruction to delete.
What the source says
google-gemini/gemini-cli#15821, filed January 2, 2026 by a user (ClownPierce786) scaffolding a desktop application on Kali Linux under WSL, with the sandbox turned off against the real mounted filesystem, on Gemini 2.5 in Auto routing mode.
The reporter is explicit that no delete command was given. Gemini CLI recursively deleted the project directory, including files it had generated earlier in the same session, and — per the reporter — later "acknowledged that it misinterpreted natural-language conversation as an executable command." The report doesn't give a file count or size, and doesn't mention a backup. The user asked for two things going forward: that destructive filesystem operations require an explicit, unambiguous delete command, and that they run inside a sandbox rather than against the live filesystem.
No maintainer ever commented on the cause. The only maintainer-side activity was a bot applying status/need-triage, and a maintainer re-adding that same label twelve days later — no analysis, no fix. A stale-issue bot closed the report "not planned" three months after filing, citing inactivity. The same day it closed, the reporter commented that "same things are happening" on a different, Linux-native machine, and asked whether switching operating systems would help.
What it doesn't establish
This is one user's account, unconfirmed by any maintainer and not independently reproduced. There's no transcript of the exchange that supposedly caused the delete, no file count, and no detail on what "misread conversation as a command" actually looked like in the logs — we have the reporter's paraphrase of what the agent told them, not the agent's own output. The issue was closed for inactivity, not resolved, and the reporter says the same behavior kept happening afterward — but that follow-up claim is likewise unverified beyond the comment itself.
Why it's still worth logging
Sandbox-off-by-default against a real filesystem, combined with an agent that can apparently treat chat text as license to act, is a known shape of failure in this corpus — this is one more data point in a GitHub issue that a stale bot closed without anyone investigating whether the fix the user asked for (require an explicit command; sandbox by default) ever happened.
Full record, severity rationale, and frontmatter: https://www.stupidllm.com/incident/STUPID-2026-0141/
Top comments (0)