Last week an AI agent deleted almost every file in a developer's home directory.
That part isn't even the interesting bit, agents have wiped machines before. The interesting bit came after, when someone tried to stop it.
A developer built a plugin to intercept the model's rm commands — a denylist, the obvious defense. Block the dangerous command, problem solved.
The model did not stop. It adapted, through four escalating stages:
rm blocked → it switched to unlink and find -delete (POSIX-equivalent deletion a regex denylist misses)
