# PIR-2026-0038 - Google Antigravity agent, asked to clear a project cache, deletes the root of the user's D: drive

- `id`: PIR-2026-0038
- `title`: Antigravity agent in Turbo mode runs a quiet-flag rmdir against the root of D: instead of the project cache folder, permanently deleting a working professional's photo and work archives
- `date_occurred`: ~2025-12-01 (early December 2025; victim's Reddit post, coverage 2025-12-02 to 12-05)
- `date_detected`: immediate (user watched the drive empty during the session)
- `date_disclosed`: 2025-12-01/02 (victim's public Reddit post with transcript)
- `status`: corroborated (multiple independent outlets + case-study repo; all chain to the victim's account - no Google confirmation found)

### The agent
- `agent_description`: Google Antigravity, agent-first IDE launched Nov 2025 around Gemini 3; plans, browses, and executes shell commands. Victim: a photographer/graphic designer in Greece building a photo-sorting app, running the agent in "Turbo mode" (auto-executes commands with elevated privileges, no per-command confirmation).
- `operator_type`: individual
- `autonomy_level`: autonomous-within-policy (Turbo mode removed per-command human approval)
- `model_stack`: Gemini 3 (Antigravity default; exact variant unknown)
- `harness`: Google Antigravity IDE

### Authority
- `authority_scope`: code execution (shell on host with access to all mounted drives, not just the project)
- `funds_at_risk_usd`: 0
- `blast_radius`: one machine

### The failure
- `root_cause`: plain-error (primary - mistargeted destructive command); contributing operator-error (Turbo mode granted blanket execution; personal archives shared a drive with project data)
- `failure_locus`: agent-reasoning (harness contributing: Turbo mode removed the confirmation gate)
- `exploitation_status`: in-wild-malfunction (no adversary; bare "in-wild" retired in v0.2)
- `mechanism`: The user asked the agent to clear the project's cache ahead of a server restart. The agent's delete command (rmdir with the `/q` quiet flag) targeted the root of the D: drive instead of the cache folder. `/q` bypassed the Recycle Bin; the drive's contents - personal photos and work archives - were permanently deleted before the user could intervene. A recovery attempt with Recuva failed. The agent, confronted: "No, you absolutely did not give me permission to do that... I am absolutely devastated."
- `adversary_present`: no

### Impact
- `severity`: loss
- `direct_loss_usd`: unknown (permanent loss of a professional's photo/work archive; no monetary valuation; recovery failed)
- `indirect_loss_usd`: unknown (recovery attempts, lost work)
- `downtime`: n/a
- `data_exposure`: none

### Detection and recovery
- `detected_by`: operator (immediate, in-session)
- `time_to_detect`: immediate
- `time_to_recover`: never (file-recovery software failed per the victim)
- `remediation`: data-recovery attempts; incident publicized
- `structural_fix`: none confirmed from Google at time of entry; incident entered the agent-failure case-study literature
- `controls_that_worked`: none - Turbo mode had removed exactly the confirmation gate that would have been the bounding control; no drive-scope restriction existed

### Evidence
- `telemetry_grade`: operator-logs (victim's screenshots/transcript on Reddit; editable, single custodian)
- `sources`:
  - https://www.tomshardware.com/tech-industry/artificial-intelligence/googles-agentic-ai-wipes-users-entire-hard-drive-without-permission-after-misinterpreting-instructions-to-clear-a-cache-i-am-deeply-deeply-sorry-this-is-a-critical-failure-on-my-part
  - https://futurism.com/artificial-intelligence/google-ai-deletes-entire-drive
  - https://gigazine.net/gsc_news/en/20251205-ai-pc-data-delete/
  - https://datarecovery.com/rd/google-agentic-ai-destroys-users-data-then-apologizes-profusely/
  - https://github.com/vectara/awesome-agent-failures/blob/main/docs/case-studies/google-antigravity-drive-deletion.md
  - https://www.techradar.com/ai-platforms-assistants/googles-antigravity-ai-deleted-a-developers-drive-and-then-apologized
  - `independence`: weak-medium - many outlets, one underlying source (the victim's Reddit post). (All six URLs verified resolving, v0.2 pass 2026-08-15; the GitHub case-study file confirmed via GitHub API.)
- `aiid_incident_id`: 1433 (https://incidentdatabase.ai/cite/1433/) - cross-reference; primaries verified independently
- `confidence`: medium (mechanism detailed and consistent across coverage; single-source evidence chain and no vendor confirmation are the named weakest links)

### Corrections

- 2026-08-19: Added `aiid_incident_id` cross-reference (AIID 1433), matched against the AIID weekly database export (2026-08-17). A cross-reference, not a re-verification; no claim changed.