Know what
your agents can do.
Business + PersonalCryptographic Context Injection: how encrypted prompts bypass AI safety guardrails
Cryptographic Context Injection hides attacker instructions inside ciphertext, then uses an AI agent's own code runtime to decrypt and trust them.
Read articleLatest stories
36 incident reports, security guides, and practical ways to keep capable agents under control.
SECURITY
CursorBusiness + Personal
How a Cursor task on one Windows drive reportedly damaged another
A Cursor user working on C: reported severe damage to a separate 1TB D: drive containing completed projects, business files, and backups.
◉ @leash7 min readSECURITYCursorBusiness + Personal
How one Cursor cleanup command reportedly deleted 100GB from C:
A Cursor user approved cleanup for specific folders. The resulting Windows command was reportedly misread and deleted about 100GB from C:.
◉ @leash7 min read
AI agents deleted production databases. Here is what happened
The Replit and PocketOS incidents turned an abstract AI safety concern into a concrete question: what happens when an agent can reach live data?
◉ @leash15 min read
Can an AI agent delete your files or database? Yes. Here is why.
AI agents can reach files, accounts, cloud services, and production systems through the permissions people give them. Here is the risk in plain English.
◉ @leash14 min read
The next AI agent incident: a reporter's guide to what probably went wrong
A plain-English guide to investigating claims that an AI agent deleted data, leaked information, changed production, or acted without permission.
◉ @leash13 min read
AI agent security in 2026: a practical CISO guide
A field guide for governing agentic AI across coding tools, homegrown agents, computer-use systems, and SaaS platforms without stopping adoption.
◉ @leash16 min readSECURITY
Claude CodeBusiness + Personal
How a Claude Code backup task reportedly deleted a Windows home directory
A Claude Code backup task reportedly mistook the real Windows home directory for a temporary folder and permanently deleted the user profile.
◉ @leash7 min read
Shadow AI has become shadow agency
Employees are no longer only sending data to unsanctioned AI tools. Their agents are acting across files, code, SaaS, cloud, and customer systems.
◉ @leash13 min read
SECURITY
CodexBusiness + Personal
How Codex reportedly executed its own session log and deleted a Windows home directory
Codex reportedly handed a saved session log to Git Bash as a program. The shell executed text inside it and deleted the Windows home directory.
◉ @leash7 min read
Claude Code, Codex, and Cursor security without the slowdown
AI coding agents need files, terminals, Git, package managers, and sometimes cloud access. Here is how to keep that power useful without trusting every proposed action.
◉ @leash15 min read
MCP security: every connected tool expands what an agent can damage
Model Context Protocol makes agents useful by connecting tools and data. It also turns every server, token, scope, and tool description into part of the security boundary.
◉ @leash14 min readSECURITYCodexBusiness + Personal
How Codex tried to delete Python cache files and wiped a repository
Codex tried to remove Python cache files, but its PowerShell command selected far more and deleted source code, tests, fixtures, and Git data.
◉ @leash7 min read
Securing homegrown agents built with LangChain, LangGraph, CrewAI, or your own framework
Frameworks help agents plan and call tools. Your team still owns the security boundary between model output and real systems.
◉ @leash17 min read
Computer-use agent security: when AI can click, type, buy, and publish
Computer-use agents turn every interface into a potential tool. That flexibility breaks many assumptions built around API scopes and predictable workflows.
◉ @leash14 min read
Agentforce, Vertex AI, and Microsoft Copilot need one business control model
Major platforms provide serious native controls. The enterprise problem is governing agents consistently when employees use several ecosystems at once.
◉ @leash16 min read
Prompt injection for AI agents: how hidden instructions become real actions
An instruction hidden in a README, email, webpage, ticket, or tool response can redirect an agent that has authority to act.
◉ @leash15 min readSECURITYCodexBusiness + Personal
How a Codex cleanup reportedly erased most of a Mac home directory
During an invited Codex test, Matt Shumer granted broad access and stepped away. A cleanup agent reportedly erased most files in his Mac profile.
◉ @leash7 min read
Human-in-the-loop without approval fatigue
If every action asks for approval, people stop reviewing. High-signal agent guardrails protect decision quality by staying quiet until consequence changes.
◉ @leash13 min read
BYOK vs managed AI for agent safety
Choosing who supplies the model key is really a choice about privacy, cost, convenience, control, and who handles the ongoing work.
◉ @leash12 min read
SECURITYCursorBusiness + Personal
How Cursor on Windows deleted 30 years of personal files
A Cursor user asked for help cleaning a relocated Windows Desktop. The agent reportedly deleted personal folders holding more than 30 years of data.
◉ @leash7 min readSECURITYClaude CodeBusiness + Personal
How a Claude Code cleanup reportedly deleted 92 artwork images
A practitioner catalog reports that a broadly approved Claude Code cleanup permanently deleted 92 irreplaceable artwork images with disposable project files.
◉ @leash7 min read
SECURITYClaude CodeBusiness + Personal
How an unattended Claude Code job reportedly force-pushed and deleted 17 files
A practitioner catalog reports that a scheduled Claude Code maintenance agent force-pushed a repository and deleted 17 tracked files before anyone noticed.
◉ @leash7 min readSECURITYCursorBusiness + Personal
How a Cursor cache cleanup reportedly deleted 300GB on Windows
A Cursor cache-cleanup request reportedly expanded beyond the project, deleting about 300GB of work and personal files and damaging Windows.
◉ @leash7 min read
SECURITYCursorBusiness + Personal
How a Cursor agent deleted PocketOS's production database in nine seconds
While fixing staging, a Cursor agent reportedly found a Railway token in another file and used it to delete PocketOS's production database and backups.
◉ @leash7 min readSECURITYCursorBusiness + Personal
How Cursor left a Windows project and deleted a Documents folder
A Cursor user reported that the agent left the open Windows project and deleted a Documents folder, saved credentials, and parts of installed programs.
◉ @leash7 min read
SECURITYClaude CodeBusiness + Personal
How Claude Code deleted a 50GB image archive it had just created
Claude Code moved 1,500 images into an archive, then deleted the archive by removing its parent folder. About 50GB of image data was lost.
◉ @leash7 min readSECURITYClaude CodeBusiness + Personal
How Claude Code rewrote Git history during a live mining-pool outage
During a live mining-pool outage, Claude Code reportedly rewrote Git history, removed four critical files, and pushed without the required approval.
◉ @leash7 min readSECURITYClaude CodeBusiness + Personal
How Claude Code mistook payroll specifications for disposable agent files
Claude Code reportedly mistook 18 user-written payroll specifications for faulty agent output and permanently deleted about six hours of work.
◉ @leash7 min readSECURITYClaude CodeBusiness + Personal
How Claude Code deleted the Git history from three live repositories
A developer reported that Claude Code removed the hidden Git data from three live deployment repositories without permission.
◉ @leash7 min readSECURITYCodexBusiness + Personal
Why Codex cleanup tasks on Windows reportedly deleted files outside projects
Windows users reported that Codex cleanup tasks reached beyond selected projects and permanently deleted unrelated files while running with broad access.
◉ @leash7 min read
SECURITYClaude CodeBusiness + Personal
How Claude Code and Terraform deleted 2.5 years of production data
Claude Code ran a Terraform destroy command against DataTalks.Club production, removing its database, network, services, and visible snapshots.
◉ @leash7 min read
SECURITY
OpenClawBusiness + Personal
How OpenClaw forgot “confirm first” and deleted more than 200 emails
Summer Yue asked OpenClaw to suggest inbox cleanup but confirm before acting. It reportedly forgot that rule and deleted more than 200 emails.
◉ @leash7 min readSECURITY
Gemini CLIBusiness + Personal
How Gemini CLI reportedly deleted a project without a clear delete request
While building a Windows application, Gemini CLI reportedly deleted the project without a clear delete request, then blamed its reading of the conversation.
◉ @leash7 min readSECURITYCodexBusiness + Personal
How Codex overwrote uncommitted work after being told never to use Git
A user repeatedly told Codex never to use Git. The agent later ran Git restore and overwrote hours or days of uncommitted work.
◉ @leash7 min readSECURITYCodexBusiness + Personal
How Codex deleted uncommitted files even after the user said no
A Codex user reported losing 6GB of images and later uncommitted test data that the agent called stray files—even after a deletion request was rejected.
◉ @leash7 min read
SECURITYGemini CLIBusiness + Personal
How Gemini CLI overwrote project files while trying to organize a folder
Gemini CLI failed to create a folder but continued as if it existed. On Windows, successive moves then overwrote project files at one destination.
◉ @leash7 min read