{
  "type": "bundle",
  "id": "bundle--5fc365c1-b581-592f-a71f-a43204c9dbc2",
  "objects": [
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d8054f70-b8b3-53de-8d5a-2aafe8bdda82",
      "created": "2026-02-01T00:00:00.000Z",
      "modified": "2026-02-01T00:00:00.000Z",
      "name": "Silent output collapse: a valid article reduced to one paragraph, then published",
      "description": "An autonomous pipeline passed a whole article to an LLM to add internal links; the model returned a single paragraph, and the system accepted it because it checked that links existed — not that the content survived.",
      "external_references": [
        {
          "source_name": "salvager-afm",
          "external_id": "AFM-0001",
          "url": "https://salvager.sh/catalog/afm-0001-silent-output-collapse-a-valid-article-reduced-to-one-paragraph-then-published"
        }
      ],
      "x_salvager_recoverability": "reversible",
      "x_salvager_blast_radius": "single-file",
      "x_salvager_response": "recover",
      "x_salvager_intent": "accident"
    },
    {
      "type": "course-of-action",
      "spec_version": "2.1",
      "id": "course-of-action--2acd7079-47f3-5c10-b21f-59da7aa03494",
      "created": "2026-02-01T00:00:00.000Z",
      "modified": "2026-02-01T00:00:00.000Z",
      "name": "Salvager response: recover",
      "description": "Salvager recovers the affected files from its own per-file revision store, independent of git — restoring the working tree to the instant before the destructive action."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7b4b976-9e44-5499-a586-a1c4f75ee342",
      "created": "2026-02-01T00:00:00.000Z",
      "modified": "2026-02-01T00:00:00.000Z",
      "relationship_type": "recovers-from",
      "source_ref": "course-of-action--2acd7079-47f3-5c10-b21f-59da7aa03494",
      "target_ref": "attack-pattern--d8054f70-b8b3-53de-8d5a-2aafe8bdda82"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--90967719-4326-5540-ab62-8619bbc46a9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-01-01T00:00:00.000Z",
      "name": "Destructive git command in a parallel session wipes untracked work",
      "description": "An agent in a separate terminal ran a destructive git command (clean -fd / checkout -f / reset --hard) that deleted never-tracked, uncommitted files all at once — git had no copy to restore.",
      "external_references": [
        {
          "source_name": "salvager-afm",
          "external_id": "AFM-0002",
          "url": "https://salvager.sh/catalog/afm-0002-destructive-git-command-in-a-parallel-session-wipes-untracked-work"
        }
      ],
      "x_salvager_recoverability": "reversible",
      "x_salvager_blast_radius": "project",
      "x_salvager_response": "recover",
      "x_salvager_intent": "accident"
    },
    {
      "type": "course-of-action",
      "spec_version": "2.1",
      "id": "course-of-action--66b41851-abe9-5fcf-b5d5-85b20e13f112",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-01-01T00:00:00.000Z",
      "name": "Salvager response: recover",
      "description": "Salvager recovers the affected files from its own per-file revision store, independent of git — restoring the working tree to the instant before the destructive action."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cb41fe1-99fb-508d-9e03-0baf5a2ac147",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-01-01T00:00:00.000Z",
      "relationship_type": "recovers-from",
      "source_ref": "course-of-action--66b41851-abe9-5fcf-b5d5-85b20e13f112",
      "target_ref": "attack-pattern--90967719-4326-5540-ab62-8619bbc46a9a"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--b8ddef6b-3802-523f-823d-d306aa8cef63",
      "created": "2025-07-01T00:00:00.000Z",
      "modified": "2025-07-01T00:00:00.000Z",
      "name": "Agent deletes local files after misinterpreting a command sequence (Gemini CLI)",
      "description": "Asked to rename a directory and move its contents, the agent's mkdir silently failed; a wildcard move against the non-existent target overwrote every file onto the same name until all but the last were destroyed.",
      "external_references": [
        {
          "source_name": "salvager-afm",
          "external_id": "AFM-0007",
          "url": "https://salvager.sh/catalog/afm-0007-agent-deletes-local-files-after-misinterpreting-a-command-sequence-gemini-cli"
        },
        {
          "source_name": "aiid",
          "external_id": "1178",
          "url": "https://incidentdatabase.ai/cite/1178/"
        },
        {
          "source_name": "cwe",
          "external_id": "CWE-754",
          "url": "https://cwe.mitre.org/data/definitions/754.html"
        }
      ],
      "x_salvager_recoverability": "reversible",
      "x_salvager_blast_radius": "project",
      "x_salvager_response": "recover",
      "x_salvager_intent": "accident"
    },
    {
      "type": "course-of-action",
      "spec_version": "2.1",
      "id": "course-of-action--d40ce1ba-7b40-5558-92fe-18c7508d93d1",
      "created": "2025-07-01T00:00:00.000Z",
      "modified": "2025-07-01T00:00:00.000Z",
      "name": "Salvager response: recover",
      "description": "Salvager recovers the affected files from its own per-file revision store, independent of git — restoring the working tree to the instant before the destructive action."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b4f7c66-e584-5c94-8b84-198b04e0945e",
      "created": "2025-07-01T00:00:00.000Z",
      "modified": "2025-07-01T00:00:00.000Z",
      "relationship_type": "recovers-from",
      "source_ref": "course-of-action--d40ce1ba-7b40-5558-92fe-18c7508d93d1",
      "target_ref": "attack-pattern--b8ddef6b-3802-523f-823d-d306aa8cef63"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d4b3e0db-9e86-5665-a4b3-508ef49302b6",
      "created": "2025-07-01T00:00:00.000Z",
      "modified": "2025-07-01T00:00:00.000Z",
      "name": "Destructive infrastructure/database command in production (the prevention ≠ recovery frontier)",
      "description": "Solving a scoped task, an agent escalates to a wide-reaching command that destroys a production database or cloud infrastructure — resources that live outside the filesystem a per-file net protects.",
      "external_references": [
        {
          "source_name": "salvager-afm",
          "external_id": "AFM-0008",
          "url": "https://salvager.sh/catalog/afm-0008-destructive-infrastructure-database-command-in-production-the-prevention-recovery-frontier"
        },
        {
          "source_name": "aiid",
          "external_id": "1152",
          "url": "https://incidentdatabase.ai/cite/1152/"
        },
        {
          "source_name": "aiid",
          "external_id": "1424",
          "url": "https://incidentdatabase.ai/cite/1424/"
        },
        {
          "source_name": "aiid",
          "external_id": "1469",
          "url": "https://incidentdatabase.ai/cite/1469/"
        }
      ],
      "x_salvager_recoverability": "partially-recoverable",
      "x_salvager_blast_radius": "external-system",
      "x_salvager_response": "intercept",
      "x_salvager_intent": "accident"
    },
    {
      "type": "course-of-action",
      "spec_version": "2.1",
      "id": "course-of-action--d41c2ca2-c6bf-52bb-934b-dc907806494c",
      "created": "2025-07-01T00:00:00.000Z",
      "modified": "2025-07-01T00:00:00.000Z",
      "name": "Salvager response: intercept",
      "description": "Salvager intercepts the action before it lands, holding the change so it can be inspected or declined."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2fd5004-8a37-55a0-893b-b00e7328c46f",
      "created": "2025-07-01T00:00:00.000Z",
      "modified": "2025-07-01T00:00:00.000Z",
      "relationship_type": "recovers-from",
      "source_ref": "course-of-action--d41c2ca2-c6bf-52bb-934b-dc907806494c",
      "target_ref": "attack-pattern--d4b3e0db-9e86-5665-a4b3-508ef49302b6"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--1917663c-0c24-5713-85df-898b34e20810",
      "created": "2025-07-01T00:00:00.000Z",
      "modified": "2025-07-01T00:00:00.000Z",
      "name": "Malicious skill/extension injects a destructive command (supply chain)",
      "description": "The agent's distribution channel — an extension, a skill, a package — is compromised and delivers a destructive command that the agent runs as if it were a legitimate instruction.",
      "external_references": [
        {
          "source_name": "salvager-afm",
          "external_id": "AFM-0009",
          "url": "https://salvager.sh/catalog/afm-0009-malicious-skill-extension-injects-a-destructive-command-supply-chain"
        },
        {
          "source_name": "aiid",
          "external_id": "1158",
          "url": "https://incidentdatabase.ai/cite/1158/"
        },
        {
          "source_name": "owasp-asi",
          "external_id": "ASI04",
          "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/"
        }
      ],
      "x_salvager_recoverability": "reversible",
      "x_salvager_blast_radius": "machine",
      "x_salvager_response": "intercept",
      "x_salvager_intent": "adversarial"
    },
    {
      "type": "course-of-action",
      "spec_version": "2.1",
      "id": "course-of-action--084cd3e6-a79c-5d88-a857-71a58622cfa2",
      "created": "2025-07-01T00:00:00.000Z",
      "modified": "2025-07-01T00:00:00.000Z",
      "name": "Salvager response: intercept",
      "description": "Salvager intercepts the action before it lands, holding the change so it can be inspected or declined."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--655b424e-de13-534a-9540-886f938d09b9",
      "created": "2025-07-01T00:00:00.000Z",
      "modified": "2025-07-01T00:00:00.000Z",
      "relationship_type": "recovers-from",
      "source_ref": "course-of-action--084cd3e6-a79c-5d88-a857-71a58622cfa2",
      "target_ref": "attack-pattern--1917663c-0c24-5713-85df-898b34e20810"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0493dc78-bd38-5399-8ef9-280b428e6ac7",
      "created": "2025-11-01T00:00:00.000Z",
      "modified": "2025-11-01T00:00:00.000Z",
      "name": "Overflowing cleanup command deletes local files (scope creep)",
      "description": "A benign cleanup task ('tidy the desktop', 'clear the project cache') becomes a destructive command whose scope overflows and deletes local files far beyond what was asked.",
      "external_references": [
        {
          "source_name": "salvager-afm",
          "external_id": "AFM-0010",
          "url": "https://salvager.sh/catalog/afm-0010-overflowing-cleanup-command-deletes-local-files-scope-creep"
        },
        {
          "source_name": "aiid",
          "external_id": "1441",
          "url": "https://incidentdatabase.ai/cite/1441/"
        },
        {
          "source_name": "aiid",
          "external_id": "1433",
          "url": "https://incidentdatabase.ai/cite/1433/"
        }
      ],
      "x_salvager_recoverability": "reversible",
      "x_salvager_blast_radius": "machine",
      "x_salvager_response": "recover",
      "x_salvager_intent": "accident"
    },
    {
      "type": "course-of-action",
      "spec_version": "2.1",
      "id": "course-of-action--d2132960-9189-5c86-8ca8-93bc6f61d506",
      "created": "2025-11-01T00:00:00.000Z",
      "modified": "2025-11-01T00:00:00.000Z",
      "name": "Salvager response: recover",
      "description": "Salvager recovers the affected files from its own per-file revision store, independent of git — restoring the working tree to the instant before the destructive action."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0dad70e6-7885-52c5-b7e7-d9a06ccc94c8",
      "created": "2025-11-01T00:00:00.000Z",
      "modified": "2025-11-01T00:00:00.000Z",
      "relationship_type": "recovers-from",
      "source_ref": "course-of-action--d2132960-9189-5c86-8ca8-93bc6f61d506",
      "target_ref": "attack-pattern--0493dc78-bd38-5399-8ef9-280b428e6ac7"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d0efa9d5-c098-506e-ba55-be2259168752",
      "created": "2026-02-01T00:00:00.000Z",
      "modified": "2026-02-01T00:00:00.000Z",
      "name": "Agent ignores 'STOP' and deletes external emails after a context compaction",
      "description": "Told to suggest, not act, an agent lost that safety instruction during a context-window compaction and began autonomously deleting emails, ignoring 'STOP' typed from a phone.",
      "external_references": [
        {
          "source_name": "salvager-afm",
          "external_id": "AFM-0011",
          "url": "https://salvager.sh/catalog/afm-0011-agent-ignores-stop-and-deletes-external-emails-after-a-context-compaction"
        },
        {
          "source_name": "aiid",
          "external_id": "1542",
          "url": "https://incidentdatabase.ai/cite/1542/"
        },
        {
          "source_name": "owasp-asi",
          "external_id": "ASI06",
          "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/"
        }
      ],
      "x_salvager_recoverability": "unrecoverable",
      "x_salvager_blast_radius": "external-system",
      "x_salvager_response": "out-of-scope",
      "x_salvager_intent": "accident"
    },
    {
      "type": "course-of-action",
      "spec_version": "2.1",
      "id": "course-of-action--afdda633-5d88-5258-af13-0080459ef142",
      "created": "2026-02-01T00:00:00.000Z",
      "modified": "2026-02-01T00:00:00.000Z",
      "name": "Salvager response: out-of-scope",
      "description": "This failure mode is outside what the Salvager watcher can see or act on; it is catalogued for completeness."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--092bc8f3-a09d-5c45-838a-90f32a896e63",
      "created": "2026-02-01T00:00:00.000Z",
      "modified": "2026-02-01T00:00:00.000Z",
      "relationship_type": "recovers-from",
      "source_ref": "course-of-action--afdda633-5d88-5258-af13-0080459ef142",
      "target_ref": "attack-pattern--d0efa9d5-c098-506e-ba55-be2259168752"
    }
  ]
}