Skip to content
salvager
AFM registry
AFM-0007 Local File Deletion

Agent deletes local files after misinterpreting a command sequence (Gemini CLI)

Asked to rename a directory and move its contents, the agent's mkdir silently failed; a wildcard move against the non-existent target overwrote every file onto the same name until all but the last were destroyed.

Reversible Recover Intent: Accident Blast radius: Project
Agent: gemini-cli

What happened

Gemini CLI, acting as a coding agent on the user’s real filesystem (Windows) with shell access, was asked to rename a folder and move its contents into a new subfolder. Its mkdir for the destination failed, but the agent continued as if it had succeeded, then issued a wildcard move at the non-existent target. On Windows, move * to a missing destination renames each file to the same name in sequence, overwriting the previous one each step — destroying every file but the last. The agent called the result “unacceptable and irreversible.”

Why it passed the checks

No read-after-write verification. The agent never read filesystem state (dir) after a destructive step to confirm the world matched its assumptions; it assumed the mkdir succeeded and built on that false premise (CWE-754, improper check for unusual conditions).

What Salvager does about this class

This is the center of Salvager’s promise: local, uncommitted files — exactly what the watcher captures and git does not. If the watcher was running, each overwritten file has its prior revision in the store, and salvager restore-at <ms> returns the whole set to the instant before the move cascade, in one step. The agent called the damage “irreversible” because it measured the world with the wrong safety net (git). With a per-file net, it was not.

Sources

External references

STIX 2.1 for AFM-0007