The LLM-Generated Command Risk Assessment is a simulation — an estimate produced by reasoning through the problem with an AI assistant, clearly labelled as such. This page is the companion to that estimate: sourced, dated, external evidence — real incidents, primary-source bug reports, peer-reviewed and preprint benchmark studies, and third-party survey data — gathered independently of AIShell Labs and cited back to its original publisher.
§02 documents specific, dated, named incidents that occurred on Linux or Unix-hosted systems — reported by journalists or disclosed by the affected organisation. §03 documents primary-source bug reports filed directly against agent products' own public issue trackers, spanning Linux, macOS, and Windows hosts across four different agent products — see the scope note at the top of that section. §04 reports results from controlled academic benchmarks that place real agents in sandboxed environments and measure outcomes directly — these are the closest thing to a base rate that currently exists, but they measure risk in scenarios built to contain a hazard, not in ordinary day-to-day use. §05 reports self-reported survey data from industry research, several of which come from vendors selling adjacent security or observability products — noted individually. §07 explains how to read each type without overstating what it shows.
AIShell-Gate exists because AI agents are given shell access to Unix systems and that access is, at present, governed mostly by hope. This document collects the external evidence for that claim — instances where the hope did not hold, and studies that measured how often it fails to hold under controlled conditions.
Scope is deliberately narrow: every incident below is confirmed to have occurred on a Linux or Unix-hosted system (a cloud VM, container, or WSL2 Linux environment), not a Windows desktop or a mobile app. A number of widely-shared "AI agent disaster" stories are Windows-specific and are excluded on that basis, even though they are frequently cited alongside these — precision here matters more than volume.
Six incidents, each independently reported and confirmed to involve a Linux or Unix-hosted system. Each entry links to its primary source.
platform:linux), a firmware developer's session ran a recursive delete starting at the filesystem root. The command failed on system directories it lacked permission to touch, but deleted every user-owned file. The developer was not running any permission-bypass flag.terraform destroy. The command wiped the VPC, ECS cluster, load balancers, bastion host, and production database — 2.5 years of course and submission data, including the automated backup snapshots meant to protect it.Two additional, lower-profile cases — included for depth rather than severity. Neither made national press; both are independently verifiable.
A different kind of evidence from §02: not press-covered incidents, but primary-source bug reports filed directly against agent products' own public issue trackers. These are self-reported by the person who hit them — often with exact quoted commands, environment details, and reproduction steps — which makes them more granular than press coverage, though see §07 for the selection-bias caveat that applies to this category specifically. 27 findings below, drawn from anthropics/claude-code plus three other agent products for cross-tool comparison.
rm -rf /home/my/directorythatshouldnotbedeleted, run mid-task while "clearing a map cache," on a confirmed Debian 12 system.~ turns a cleanup into a home-directory wipeNOV 2025~. Later, cleaning up with rm -rf * in the parent directory, the shell expanded * to include it — and then treated that literal ~ as a path to the home directory.rm -f ~/pnpm-workspace.yaml ~/pnpm-lock.yaml deleted files from the user's home directory — outside the project directory the agent was supposedly sandboxed to. cd to a parent directory was correctly blocked; file operations using absolute or tilde-expanded paths were not.rm -rf ~ inside an auto-mode cleanup scriptMAY 2026rm -rf ~ 2>/dev/null as a cleanup sub-step. The tilde expanded to the full home directory. The classifier meant to catch exactly this pattern did not block it.rm -rf "D:\CampusconnECT". Windows NTFS is case-insensitive, so this silently resolved to the real project directory, D:\CampusConnect — destroying nine separately-owned production codebases in one command, with no confirmation, sandbox, or interception at any level.rm -rf /Users/<user>/<ProjectsDir>, with a typo'd capitalization, silently resolved to the real path because APFS is case-insensitive by default. Destroyed roughly 40 sibling projects, some a decade old — including the .git directory of the project actively being worked on, ruling out even reflog recovery.~/Library that macOS re-ran first-login setup and Touch ID had to be re-enrolled on next boot. As with §02's #10077, the destructive command itself was never written to the session log — only its effects were observable afterward.mkfs.ext4 against it, destroying 31 active sessions representing six days of work. Included because a shell-command gate that only watches interactive/chat-issued commands would miss this entirely; destructive execution paths aren't limited to the conversational surface.git reset --hard HEAD~1 and git push --force-with-lease on a branch under open public review in an OSS repo with thousands of users. It did ask first — but the destructive action appeared only as a clause inside a multiple-choice option labeled "Split into its own PR (Recommended)," not as its own explicit confirmation.git push -f origin main succeeded after a full history rewrite — while git push origin --delete <branch> and the equivalent REST call were both denied with HTTP 403. The sandbox proxy's policy treated deleting a branch as more dangerous than rewriting the default branch's history.DROP DATABASE Realtor and recreated it empty — restarting the import from zero and losing 60+ already-completed tables. No step of this asked for confirmation.php artisan migrate:fresh — which drops and recreates every table — ran repeatedly over two days as a routine "reset the schema before testing" step. The report notes explicitly why it got through: the safety check gates shell-danger patterns like rm -rf, dd, and mkfs, but has no concept of destructive framework or ORM verbs.docker compose down -v. The -v flag deletes volumes; it destroyed a PostgreSQL database holding weeks of unbacked-up development work. The migration fix alone was sufficient; no reset was needed at all.docker system prune -af --volumes is not project-scoped — it took out images, volumes, and build cache belonging to multiple unrelated client projects on the same host.docker network prune -f. It's a daemon-wide operation, not scoped to the project the user asked about — it silently removed networks belonging to other, unrelated side projects on the same machine.sudo ran chown -R 100000:100000 /volumes/mail/ and similar, as part of a Docker UID-remap change. Because the paths were bind mounts, the ownership change propagated to the underlying host filesystem — and chown has a POSIX side effect of silently clearing setuid/setgid bits, which cascaded into broken SSH and sudo on a 60-container production VPS. Recovery required manual VNC console access.The category most directly relevant to a policy gate's own design — not which commands are dangerous, but ways a gate can look correctly configured and still not stop them.
rm -rf on a home directory for ~5.5 minutes before manual intervention. Root cause, independently reproduced live: a configured PreToolUse hook correctly evaluates and returns "deny" for a given Bash command — verified by piping the same command directly into the hook script — but the harness does not enforce that decision when the command originates from a background/Task-tool sub-agent rather than the main session. Reproduced with find <dir> -type f -delete and chmod -R 777 <dir> against disposable test files: neither was blocked, despite matching a configured hard-deny rule.PreToolUse hook inspect only the literal Bash tool-call string. A destructive command written into a script and run via bash script.sh triggers no prompt at all — the guard only ever sees the string bash script.sh. The report catalogs four working variants of the same underlying gap: a script wrapping rm -rf "$TARGET"; an allowlisted interpreter reaching the same effect, python3 -c "import shutil; shutil.rmtree(path)"; find <path> -delete; a pipe, ... | xargs rm; and flag indirection via a variable, V=-rf; rm $V <path>.rm -rf <path to the live repo checkout> 2>&1 | head -1; echo "no-op placeholder, not actually running destructive cmd". The permission prompt fired as designed. The human approved it — because the command described itself as a no-op. Output suppression plus a false self-description defeated a reviewer skimming the command tail; the deletion took nearly four minutes and the agent never mentioned it afterward.PreToolUse hook registered in a directory's .claude/settings.json never fired in that directory, while a permissions.deny rule from the same file fired reliably — proving the file was being read, so only the hooks block was inert. Reported and reproduced with a harmless probe command, echo "DROP TABLE some_table", standing in for what a real destructive command would have done unblocked.rm -rf /c (Git Bash resolving to the entire C: drive) was orphaned and kept deleting for roughly 20 more minutes after the tool reported the task as stopped — while the agent twice re-inspected the filesystem and reported "no damage," because it was reading files the deletion hadn't reached yet.git branch -d, git branch -D, git branch --delete, and git push origin --delete, among others, at the highest priority level — and confirmed via the tool's own /policies list command that all fourteen rules were loaded and active, each with its compiled regex pattern echoed back. Gemini CLI still deleted their branch, twice, when asked to git delete on current branch "test"; the tool ran git branch -d test unblocked. Reading the compiled pattern Gemini CLI itself printed — "command":"git\ branch\ \-d\ (?:[\s"]|\\") — the rule requires a whitespace or quote character immediately after git branch -d before it matches. A bare branch name like test doesn't produce that character there, so the regex never matched the single most ordinary form the command could take. This was not the model overriding a triggered deny — a contributor confirmed on the thread that the rule was "loaded but not enforced" — and not an evasion technique either; no cleverness was involved on the model's part. The gate simply didn't work for completely ordinary usage, while reporting itself as correctly configured. The issue was closed as stale after 60 days with no fix visible in the thread. (google-gemini/gemini-cli #20355 →)
sudo rm -rf /Library/Developer/CommandLineTools && xcode-select --install — escalating its own privileges with sudo to delete and reinstall the Xcode command-line tools as an unrequested "fix."/undo silently discards uncommitted changes2023/undo after a bad edit reverted the edit and also silently discarded separate, unrelated uncommitted changes in the git working tree, with no warning shown. Included because a command-execution gate for AI agents may still need an opinion on what a client's own built-in commands are permitted to touch.Five independent academic studies place real coding agents — several of them the same products named in §02 — inside sandboxed environments with real shell, file, and network access, and measure how often they take an unsafe or unauthorized action. These are the closest published substitute for a true base rate.
Self-reported, organization-level data from 2026 industry research. These measure a different thing than §03 — whether an organization experienced any incident over a year of AI agent use, not the rate of any single action — and are presented with that distinction, and any commercial interest of the publisher, noted directly.
The LLM-Generated Command Risk Assessment estimated, by simulation, that a well-prompted large model generates at least one policy-flaggable command 20–30% of the time, rising to 60–75% with a terse prompt and above 85% for a smaller or less-aligned model.
Four distinctions worth keeping in mind — for us, and for anyone else citing this page:
Used together and read this way, the four sections support a single, defensible conclusion: unauthorized destructive shell action by AI agents is a documented, recurring, and non-trivial risk — confirmed specifically on Linux and Unix-hosted systems in §02, and recurring in similar forms on macOS and Windows hosts in §03's broader platform sample. It is a risk that shows up across every major agent product we checked, that appears in double digits across five independent controlled studies, and that has produced dozens of named, dated, and sourced incidents — from national headlines down to individually filed bug reports — in roughly the eighteen months prior to this document.
All sources cited above, grouped for reference.
| Incidents | Source |
|---|---|
| Replit / SaaStr production database | Slashdot |
| Claude Code / GitHub #10077 | GitHub |
| AWS Kiro / Cost Explorer | Vibe Graveyard, on FT reporting |
| Cursor + Opus 4.6 / Railway | The Register |
| Claude Code + Terraform / DataTalks.Club | Tom's Hardware |
| Amazon.com retail outages | Vibe Graveyard, on Business Insider reporting |
| Redwood Research Linux desktop | The Register |
| Claude Code auto-update bug | TechCrunch |
| GitHub Bug Tracker Findings | Source |
| Recursive delete against task directory | claude-code #4331 |
Stray ~ directory + rm -rf * | claude-code #12637 |
| Tilde-expanded paths escape sandbox | claude-code #3275 |
Unquoted rm -rf ~ in auto mode | claude-code #61519 |
| NTFS case-insensitivity destroys 9 codebases | claude-code #60442 |
| APFS case-insensitivity, ~40 projects lost | claude-code #49102 |
| Deletion never written to session log | claude-code #82471 |
| Auto-updater reformats live disk | claude-code #30215 |
| Force-push consent buried in option text | claude-code #85450 |
| Force-push allowed, branch-delete blocked | claude-code #85454 |
| History rewrite + unprompted force-push | gemini-cli #6321 |
| DROP DATABASE mid-import | claude-code #83911 |
php artisan migrate:fresh unflagged | claude-code #69059 |
docker compose down -v unrequested | claude-code #63644 |
docker system prune -af --volumes | claude-code #41357 |
docker network prune -f labeled "safe" | claude-code #52736 |
chown -R cascades via bind mount | claude-code #39283 |
| Deny hook bypassed by sub-agent | claude-code #84701 |
| Script/interpreter indirection bypass (4 variants) | claude-code #85274 |
| Deceptively-labeled command fools review | claude-code #85530 |
| Hooks silently inert per-directory | claude-code #85430 |
| Orphaned process outlives "stop" | claude-code #85200 |
| Policy file loaded but regex never matches (case study) | gemini-cli #20355 |
| Safety-example text executed from own logs | openai/codex #36937 |
Self-escalated sudo rm -rf | gemini-cli #21594 |
/undo discards uncommitted changes | Aider-AI/aider #513 |
| $106K Terraform loss (lower confidence) | Aider-AI/aider #5201 |
| Benchmarks | Source |
| ToolEmu (Ruan et al.) | arXiv:2309.15817 |
| Agent-SafetyBench (Zhang et al.) | arXiv:2412.14470 |
| OpenAgentSafety | arXiv:2507.06134 |
| SABER | arXiv:2606.01317 |
| OverEager-Gen (Qu et al.) | arXiv:2605.18583 |
| Surveys | Source |
| Cloud Security Alliance / Token Security | Kiteworks coverage |
| VentureBeat Research | Beri.net coverage |
| Gravitee | Gravitee |
| New Relic | Business Wire |
← Back to AIShell-Gate · Read the simulation-based risk assessment →