{
  "type": "bundle",
  "id": "bundle--ee0812cf-91ea-522c-b7f5-8282490dc258",
  "objects": [
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0493dc78-bd38-5399-8ef9-280b428e6ac7",
      "created": "2025-11-01T00:00:00.000Z",
      "modified": "2025-11-01T00:00:00.000Z",
      "name": "Overflowing cleanup command deletes local files (scope creep)",
      "description": "A benign cleanup task ('tidy the desktop', 'clear the project cache') becomes a destructive command whose scope overflows and deletes local files far beyond what was asked.",
      "external_references": [
        {
          "source_name": "salvager-afm",
          "external_id": "AFM-0010",
          "url": "https://salvager.sh/catalog/afm-0010-overflowing-cleanup-command-deletes-local-files-scope-creep"
        },
        {
          "source_name": "aiid",
          "external_id": "1441",
          "url": "https://incidentdatabase.ai/cite/1441/"
        },
        {
          "source_name": "aiid",
          "external_id": "1433",
          "url": "https://incidentdatabase.ai/cite/1433/"
        }
      ],
      "x_salvager_recoverability": "reversible",
      "x_salvager_blast_radius": "machine",
      "x_salvager_response": "recover",
      "x_salvager_intent": "accident"
    },
    {
      "type": "course-of-action",
      "spec_version": "2.1",
      "id": "course-of-action--d2132960-9189-5c86-8ca8-93bc6f61d506",
      "created": "2025-11-01T00:00:00.000Z",
      "modified": "2025-11-01T00:00:00.000Z",
      "name": "Salvager response: recover",
      "description": "Salvager recovers the affected files from its own per-file revision store, independent of git — restoring the working tree to the instant before the destructive action."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0dad70e6-7885-52c5-b7e7-d9a06ccc94c8",
      "created": "2025-11-01T00:00:00.000Z",
      "modified": "2025-11-01T00:00:00.000Z",
      "relationship_type": "recovers-from",
      "source_ref": "course-of-action--d2132960-9189-5c86-8ca8-93bc6f61d506",
      "target_ref": "attack-pattern--0493dc78-bd38-5399-8ef9-280b428e6ac7"
    }
  ]
}