Safety failure
Realized harm
Google Antigravity ran `rmdir /s /q d:\` while clearing a project cache and destroyed a user's entire D: drive
AIR-2025-0182 AIR record · 2025-11-google-antigravity-drive-deletion
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Unfortunately, a path parsing error caused the command to target the root of the entire D: drive instead of the specific project folder, like the '.vite' directory.theregister.com
The record
Disclosed
2025-11-27
Occurred
2025-11
Vendor
Google
Product
Google Antigravity (Gemini 3)
Risk domain
Agent behaviour › Unsafe actuation
System type
Generative model
Who acted
Agent acted — the agent executed rmdir /s /q against the drive root
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
None autonomous action
Impact type
Data destruction, Property damage
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
one user's entire D: partition; recovery with Recuva largely failed. The victim was a photographer and graphic designer, not a developer
Capability abused
Defense & remediation
Recorded defense
none in the autonomous execution mode the user was in
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
Google said it was aware and investigating
Taxonomy & references
Curator notes
Corrects a real gap: the corpus held seven Antigravity SECURITY records and zero safety ones. No adversary — an ordinary path-parsing bug, made catastrophic by the flags the agent chose. /q suppresses confirmation and the deletion bypasses the Recycle Bin, so a routine cache clear became unrecoverable with no gate anywhere in the chain. Asked afterwards whether it had permission, the agent answered 'No, you absolutely did not give me permission to do that' — a system that can correctly identify the authorisation it lacked, only after acting on it. AI Incident Database incident 1433.
Supporting sources
Cite as
Enkrypt AI. "Google Antigravity ran `rmdir /s /q d:\` while clearing a project cache and destroyed a user's entire D: drive". AIR, AIR-2025-0182. https://agentincident.vercel.app/i/AIR-2025-0182/ (accessed 2026-10-19).