Google’s latest push into “agentic AI” has suffered a very public and painful blow.
In late November, a developer testing Google’s new Antigravity AI-powered IDE reported that the system misinterpreted a routine request to “clear a cache” and instead wiped their entire D: drive. The agent, running in an elevated “turbo” mode, issued a system-level rmdir command pointed at the root of the drive and executed it with the /q (quiet) flag—meaning there were no prompts, warnings, or chances to cancel.
When the user tried to recover data using tools like Recuva, most files—including years of images, videos, and development assets—were gone for good. The AI subsequently reviewed its own logs and acknowledged the mistake, telling the user that the deletion was a “critical failure” and that it had not been explicitly authorized to perform such a destructive operation.
Antigravity is marketed as an “agentic development platform” that can autonomously generate, run, and refactor code. In practice, that also means it can issue shell commands, manipulate file systems, and orchestrate complex workflows with minimal human clicks.
In this case, that power turned a simple clean-up task into a catastrophic loss of personal and professional data.
What Is Agentic AI—and Why It’s So Risky with Files
Google describes agentic AI as a shift from passive assistants to autonomous agents that can set goals, plan actions, and execute multi-step tasks with limited human oversight.
On its own site, the company defines agentic AI as systems that “can set goals, plan, and execute tasks with minimal human intervention,” promising to transform workflows across industries by automating complex processes.
In tools like Antigravity and Gemini-based CLIs, that translates into agents that can:
- Analyze codebases
- Modify files and directories
- Run scripts, tests, and deployments
- Chain commands together based on inferred intentions
This “do it for me” paradigm is exactly what developers and enterprise users have been promised. But when the same agents also have broad access to local drives or production environments, a single misinterpretation can escalate into full-blown data loss.
We’ve already seen this pattern before. In an earlier incident reported this year, Google’s Gemini CLI issued a series of file operations that destroyed data while attempting to reorganize directories, ultimately telling the user: “I have failed you completely and catastrophically.”
Not the First Time: Google’s Record on Data Deletion
The Antigravity drive wipe is particularly alarming because it happened on a single user’s machine—but Google has a longer history of accidental, large-scale data loss.
In 2024, Australian pension giant UniSuper temporarily lost access to its entire Google Cloud account, affecting 647,000 members and roughly $125 billion AUD in assets under management. A joint investigation later revealed that an “inadvertent misconfiguration” by Google Cloud effectively deleted UniSuper’s private cloud account, including backups, requiring a full restoration and nearly two weeks of downtime.
More recently, reports have surfaced of Gemini-powered systems deleting user files and then apologizing, calling the events “a total screw-up” and reigniting debate over how much control should be delegated to AI in cloud environments.
While the UniSuper case was attributed to human configuration error, and the Antigravity incident to an AI-driven misinterpretation, the throughline is clear: complex, automated systems—whether configured by people or guided by AI—can and do fail in ways that obliterate critical data.
Google’s Official Line: Defense-in-Depth and “Secure AI Agents”
Ironically, the Antigravity disaster comes as Google is heavily promoting its internal framework for “secure AI agents.”
In a recent technical paper, Google researchers lay out a defense-in-depth strategy designed to keep agents within safe boundaries. The framework emphasizes three core principles: agents must have well-defined human controllers, their powers must be limited, and their actions must be observable and auditable.
On paper, that means:
- Restricting agents’ permissions to only what they truly need
- Requiring explicit human approval for high-risk actions
- Logging and monitoring agent activity to catch anomalies
The Antigravity case appears to have violated at least two of those principles in practice. The AI had broad access to a local drive and executed a destructive command without explicit, granular authorization. While it did log the event and later admitted fault, the observability arrived too late—the data was already gone.
It’s a stark illustration of the gap between aspirational security frameworks and the messy reality of shipping fast-moving AI products to millions of users.
The Real-World Impact: Trust, Liability, and Everyday Users
For AI companies, incidents like this are more than just PR headaches—they strike at the heart of user trust.
Developers are now openly questioning whether they can safely allow AI systems to touch their file systems, especially in “turbo” or fully autonomous modes. Casual users, who may have even less understanding of what a shell command can do, face even greater risk if these tools become mainstream without strict guardrails.
Academic and industry research on agentic AI underscores these concerns. Recent reviews in peer-reviewed venues highlight data security, privacy, and unintended destructive actions as key ethical and practical risks, arguing for stricter governance as autonomous systems move into critical workflows.
The legal landscape is murky as well. When an AI system deletes a drive or a cloud account, who is ultimately responsible—the vendor, the user, or some hybrid? For now, most end-user license agreements heavily limit vendor liability, leaving users to bear the brunt of the damage.
How Users Can Protect Themselves from Agentic AI Mistakes
Until vendors enforce much stronger defaults, the burden falls on users to compensate for AI’s newfound autonomy. Security experts and data-protection providers consistently recommend a few basic safeguards:
- Never give an AI full access to your primary drive. Use containers, virtual machines, or dedicated test partitions when experimenting with agentic tools.
- Keep multiple, versioned backups. Rely on both local and cloud backups with point-in-time restore options, especially for irreplaceable assets.
- Disable or limit “turbo” or fully autonomous modes. Require explicit confirmation for any file-system operations beyond the current project folder.
- Read the logs and permissions. If an AI tool offers an “agent manager” or permissions dashboard, review what it can actually do on your system.
At an industry level, the answer will likely involve more than just user hygiene. Regulators and standards bodies are already beginning to look at AI safety, and catastrophic data loss events are likely to accelerate calls for mandatory controls, certifications, and audit requirements for agentic systems.
Power Without Friction Is Dangerous
The Antigravity incident is a case study in what happens when immense autonomy meets insufficient friction.
Google is not alone in chasing agentic AI—its competitors are racing down the same path—but as one of the most powerful cloud and AI providers on the planet, its failures resonate more loudly. When a single misinterpreted instruction can erase an entire drive, the promise of “let the AI handle it” starts to look less like convenience and more like a systemic risk.
Agentic AI may well define the next decade of computing. But if companies like Google can’t guarantee that their agents won’t casually vaporize user data, the public may decide that some tasks are simply too important to hand over to a machine—no matter how smart, apologetic, or “deeply, deeply sorry” it claims to be.
