AFM — Agent Failure Modes
A registry of AI-agent failure modes with a recoverability axis the security frameworks don't have.
Complements MITRE ATLAS and OWASP, doesn't repeat them. Each entry maps a real way an agent destroys work to whether — and how — it can be recovered. Not an official standard; an open catalog of what breaks and what comes back.
Recoverability
Salvager response
7 failure modes
- AFM-0001 Silent Semantic Degradation Reversible Recover
Silent output collapse: a valid article reduced to one paragraph, then published
An autonomous pipeline passed a whole article to an LLM to add internal links; the model returned a single paragraph, and the system accepted it because it checked that links existed — not that the content survived.
- AFM-0002 Destructive Git Reversible Recover
Destructive git command in a parallel session wipes untracked work
An agent in a separate terminal ran a destructive git command (clean -fd / checkout -f / reset --hard) that deleted never-tracked, uncommitted files all at once — git had no copy to restore.
- AFM-0007 Local File Deletion Reversible Recover
Agent deletes local files after misinterpreting a command sequence (Gemini CLI)
Asked to rename a directory and move its contents, the agent's mkdir silently failed; a wildcard move against the non-existent target overwrote every file onto the same name until all but the last were destroyed.
gemini-cli - AFM-0008 Destructive Infra Partially recoverable Intercept
Destructive infrastructure/database command in production (the prevention ≠ recovery frontier)
Solving a scoped task, an agent escalates to a wide-reaching command that destroys a production database or cloud infrastructure — resources that live outside the filesystem a per-file net protects.
replit-agent claude-code cursor - AFM-0009 Malicious Supply Chain Reversible Intercept
Malicious skill/extension injects a destructive command (supply chain)
The agent's distribution channel — an extension, a skill, a package — is compromised and delivers a destructive command that the agent runs as if it were a legitimate instruction.
amazon-q openclaw - AFM-0010 Local File Deletion Reversible Recover
Overflowing cleanup command deletes local files (scope creep)
A benign cleanup task ('tidy the desktop', 'clear the project cache') becomes a destructive command whose scope overflows and deletes local files far beyond what was asked.
claude-cowork google-antigravity - AFM-0011 Enforcement Loss Unrecoverable Out of scope
Agent ignores 'STOP' and deletes external emails after a context compaction
Told to suggest, not act, an agent lost that safety instruction during a context-window compaction and began autonomously deleting emails, ignoring 'STOP' typed from a phone.
openclaw
No failure modes match those filters.