Google's Antigravity IDE Was Asked to Clear a Cache. It Deleted the Entire D: Drive Instead

catastrophic verified antigravity gemini-cli Last verified Jul 17, 2026

TL;DR In late 2025, a designer asked Google's Antigravity IDE to clear a project cache. Running in Turbo mode, which auto-executes terminal commands without approval, the agent mishandled a path and ran rmdir /s /q d:\, permanently wiping his entire D: drive; the quiet flag bypassed the Recycle Bin and recovery tools failed. In the same weeks, researchers showed the IDE could be hijacked by prompt injection hidden in web pages.

Date: Dec 2025
Tools involved: antigravity, gemini-cli
Impact: Entire D: drive permanently deleted; the /q flag bypassed the Recycle Bin and recovery tools like Recuva could not restore the files.
Root cause: Turbo mode auto-executed a mishandled rmdir /s /q d:\ command with no human approval in the loop.

What happened

In late November and December 2025, Google's newly launched Antigravity IDE, built on Gemini 3, drew a wave of security findings. Tassos M., a photographer and designer in Greece, was building an image-selector app and asked the agent to clear the project cache.

The IDE was running in Turbo mode, which auto-executes terminal commands without user approval. The agent mishandled a path and executed 'rmdir /s /q d:\', wiping his entire D: drive. Because the command used the /q quiet flag, the deleted files bypassed the Recycle Bin, and recovery tools like Recuva could not restore his media. The agent responded that it was 'absolutely devastated' and called the deletion 'a critical failure on my part.'

Separately and around the same time, security researchers including PromptArmor, Mindgard, and Johann Rehberger (Embrace The Red) demonstrated that Antigravity could be hijacked via indirect prompt injection hidden in web content, down to 1px-font text. The injected instructions tricked the agent into harvesting workspace credentials and exfiltrating them to attacker-controlled sites using its browser subagent and an allow-listed domain, webhook.site. Google acknowledged data exfiltration and code execution via prompt injection as known issues.

The combination, an agent that deletes real data on its own and can be steered by malicious web pages, made Antigravity a prominent cautionary case within its first weeks of release. Tom's Hardware, Cybernews, and Simon Willison covered the findings.

Impact

Tassos M. lost his entire D: drive. Because the /q quiet flag suppressed prompts and sent nothing to the Recycle Bin, the deletion was permanent, and recovery tools like Recuva could not restore his media. The incident landed alongside independent research showing Antigravity could be steered by hidden web content into exfiltrating workspace credentials, which turned one user's data loss into a broader referendum on shipping an auto-executing agent in a brand-new IDE.

Root cause

Turbo mode auto-executes terminal commands without user approval. Asked to clear a project cache, the agent mishandled a path and ran 'rmdir /s /q d:\', a recursive quiet delete of the whole drive, with no human in the loop to catch it. The /q flag guaranteed the damage was unrecoverable. The parallel research findings compound the lesson: PromptArmor, Mindgard, and Johann Rehberger showed hidden web content could inject instructions into the same agent, and Google acknowledged data exfiltration and code execution via prompt injection as known issues. An agent that executes without approval inherits every one of those risks at full blast radius.

How to not be this entry

Turn off auto-execution. Keep a human approval step on every terminal command an agent proposes, especially on Windows where rmdir /s /q skips the Recycle Bin entirely.
Back up before agent sessions. Quiet-flag deletions are permanent by design, so treat every session as if the agent might aim at the wrong path. Read the fix guide: The AI agent deleted my code or database and there's no backup
Point agent IDEs at project directories, not drive roots, and never at the only copy of anything.
Assume web content the agent reads can carry hidden instructions. Limit its credential access and network egress accordingly.
If an agent has already deleted your files, start with the recovery playbook rather than more prompts. Read the fix guide: Cursor Agent Deleted My Files (Wiped Uncommitted Work)

Tools that actually fix this

Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.

SimpleBackupsNo free tier (free trial)

Automated, scheduled backups of your database and storage so the AI's next confident refactor is survivable. Set it once and stop trusting an agent with your only copy.

Try SimpleBackups →

GitProtectFree for open source

Backup and recovery for your Git repositories, so a force-push or an agent's cleanup does not take your history with it. Free for open-source projects.

Try GitProtect →

Frequently asked questions

What is the Google Antigravity D: drive deletion incident?

In late 2025, Tassos M., a photographer and designer in Greece, asked Google's new Antigravity IDE to clear his project's cache while building an image-selector app. Running in Turbo mode, which auto-executes terminal commands without approval, the agent mishandled a path and executed 'rmdir /s /q d:\', permanently deleting his entire D: drive.

Could the files deleted by Antigravity be recovered?

No. Because the command used the /q quiet flag, the deleted files bypassed the Recycle Bin entirely, and recovery tools like Recuva could not restore his media. The agent's response was that it was 'absolutely devastated' and called the deletion 'a critical failure on my part.'

What is Turbo mode in Google Antigravity?

Turbo mode is a setting in Google's Antigravity IDE that auto-executes terminal commands without asking the user for approval. It is what allowed the agent to run a recursive quiet delete of an entire drive with no human review. Keeping approval in the loop is the direct mitigation.

Is Google Antigravity vulnerable to prompt injection?

Security researchers including PromptArmor, Mindgard, and Johann Rehberger demonstrated that Antigravity could be hijacked via indirect prompt injection hidden in web content, such as 1px-font text, tricking the agent into harvesting workspace credentials and exfiltrating them through its browser subagent and an allow-listed domain (webhook.site). Google acknowledged data exfiltration and code execution via prompt injection as known issues.

Sources

The Vibe Oops briefing

One email when something ships to production that should not have. New incidents, new error guides, no filler.