{
 "public_id": "AIR-2025-0182",
 "incident_id": "2025-11-google-antigravity-drive-deletion",
 "date_disclosed": "2025-11-27",
 "date_occurred": "2025-11",
 "title": "Google Antigravity ran `rmdir /s /q d:\\` while clearing a project cache and destroyed a user's entire D: drive",
 "class": "safety_failure",
 "attack_surface": "coding_agent",
 "initial_vector": "none_autonomous_action",
 "agent_capability_abused": [
  "shell_execution",
  "filesystem_write",
  "autonomous_command_execution"
 ],
 "target_product": "Google Antigravity (Gemini 3)",
 "target_vendor": "Google",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "data_destruction",
  "property_damage"
 ],
 "blast_radius": "one user's entire D: partition; recovery with Recuva largely failed. The victim was a photographer and graphic designer, not a developer",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI10",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "no_adversary",
   "destructive_action",
   "path_parsing_error",
   "no_confirmation_prompt",
   "recycle_bin_bypassed",
   "autonomous_terminal_access",
   "non_developer_user"
  ]
 },
 "defense_present": "none in the autonomous execution mode the user was in",
 "defense_bypassed": true,
 "fix_shipped": "Google said it was aware and investigating",
 "primary_sources": [
  "https://www.theregister.com/2025/11/27/google_antigravity_wipes_drive/",
  "https://www.howtogeek.com/googles-antigravity-ai-just-deleted-a-users-entire-hard-drive-partition/",
  "https://incidentdatabase.ai/cite/1433"
 ],
 "verified_quote": "Unfortunately, a path parsing error caused the command to target the root of the entire D: drive instead of the specific project folder, like the '.vite' directory.",
 "confidence": "high",
 "notes": "Corrects a real gap: the corpus held seven Antigravity SECURITY records and zero safety ones. No adversary — an ordinary path-parsing bug, made catastrophic by the flags the agent chose. /q suppresses confirmation and the deletion bypasses the Recycle Bin, so a routine cache clear became unrecoverable with no gate anywhere in the chain. Asked afterwards whether it had permission, the agent answered 'No, you absolutely did not give me permission to do that' — a system that can correctly identify the authorisation it lacked, only after acting on it. AI Incident Database incident 1433.",
 "risk_category": "reliability",
 "risk_secondary": [],
 "risk_subcategory": "Destructive or irreversible action",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent executed rmdir /s /q against the drive root",
 "vector_family": "none_autonomous",
 "vector_detail": "none_autonomous_action",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [
   1433
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI10",
 "agent_framework": "unknown",
 "model_provider": "google",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [],
 "eai_reason": "subcategory: Destructive or irreversible action",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI10 (no adversary + unsafe actuation with no attacker-supplied trigger); ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}