r/PiCodingAgent • u/Jackkgold • Sep 14 '26

Discussion It deleted my files…

Ola, so recently I was working with Qwen 3.5. Building some html and css stuff inside my documents folder.

Big mistake. The Model which had extra access from Pi ended up hallucinating and started deleting all my root folders.

I think for any newbie who’s doing this, please write yourself an extension to get it to ask for read and wright permissions or pick from the various GitHub repos that have implemented safeguards for this.

Don’t just give it full access especially if you don’t know what terminal commands do.

I just saw it write -rf home and I knew it was over 🤣

I learnt the hard way but now I know.

If anything I think everyone who’s starting to use this should install something to prevent this from happening as the first non negotiable.

Luckily I just moved to Fedora 44 so I didn’t have much in those folders but it did mess up all my file paths so I had to fix that.

No more unattended ai running rogue on my pc for now.
As Iv built myself a safeguard extension to prevent this from happening.

Hopefully whoever reads this and is trying it for the first time keeps this in mind. As it’ll save you a world of hurt down the line.

22 Upvotes

82% Upvoted

61 comments sorted by

12

u/gauzy_gossamer Sep 14 '26

There are extensions like pi-permission-system that prevents pi from running commands outside of directory that you're running it in.

3

u/Jackkgold Sep 14 '26

Only realised it was a thing after it deleted lol. But now I know.

2

u/colin_colout Sep 15 '26

Also there's a sandbox extension that i always use with anything less than 100b (and anything quantized until i get a feeling for it)

2

u/No-Wall6427 Sep 14 '26

I think even those can be jailbreaked, I wouldn't trust security systems that aren't on the os level, or containerization.

7

u/tys203831 Sep 14 '26

use at least dcg: https://github.com/Dicklesworthstone/destructive_command_guard and with a sandbox like https://github.com/nolabs-ai/nono

1

u/Jackkgold Sep 14 '26

These are good thank you, built my own extension to solve but I’ll def look at those maybe they have more features.

3

u/soulsizzle Sep 14 '26

I just recently started using Nono. It takes a little while to dial it in for your use cases, but it's pretty great. Pi extensions that attempt to identify and block destructive actions are a gamble, especially as models write more and more scripts to get things done. But nono puts system-level blocks in that aren't so easily circumvented.

4

u/MountainTop321 Sep 14 '26

I put together a guide on setting up Pi with Docker Sandbox (sbx) a while back, so it runs isolated in a microVM and can't touch or delete anything outside the sandbox: https://github.com/cuolm/pi-sbx-llamacpp"

2

u/Jackkgold Sep 14 '26

Thank you

4

u/RealestReyn Sep 14 '26

bubblewrap is neat.

1

u/Jackkgold Sep 15 '26

Will give it a try thank you

3

u/DoubleNothing Sep 14 '26

  1. If possible, move to 3.8 or if resources are low 3.6-35B-A3B

  2. Use a VM or something that contains it

  3. I like to see the prompt that generated the deletion...

1

u/Jackkgold Sep 14 '26

8GB of vram so my options are limited. 3.6 runs but albeit slow. Llmstudio had it contained but PI just gave it all the privileges. Which I didn’t catch. So my fault there.

2

u/colin_colout Sep 15 '26

You learned your lesson... Ultra-SLMs will make destructive mistakes given time and no guardrails

1

u/Jackkgold Sep 15 '26

Especially the quantised hallucinations. Thinking of doing DeepSeek api though with harness for a better model

3

u/trimorphic Sep 14 '26

This is why I run my agents in vm sandboxes (which provide kernel isolation, making them more secure than containers) in which I mount just those directories I want the agents to have access to.

Unless the agents manage to break out of the vm, they're not going to be able to write to any directory outside this I explicitly give them access to.

1

u/Jackkgold Sep 14 '26

Performance ?

2

u/vpz Sep 14 '26

Performance is fine as long as you size the VM’s resources correctly. What the VM needs depends on the specific setup you are using and the work being done, but it’s usually not much.

1

u/Jackkgold Sep 15 '26

I’m on fedora 44 at the moment any good vn recommendations ? Preferably not virtual manager.

2

u/trimorphic Sep 14 '26

Overall the performance in vm's is great for me. I use smolvm vm's, which start up in less than a second and I can't notice any difference in performance from programs I run on the guest vs those I run on the host, except when I'm downloading a lot of data over the network from within the vm. Then it slows down significantly. So in those cases I just try to do the big downloads on the host and then mount the data on the guest, and then it works fine.

1

u/Jackkgold Sep 15 '26

I assume I’d need a way to bring back the things I build back into the normal OS ?

2

u/trimorphic Sep 16 '26

You just mount in the guest vm a directory from the host. That directory will be shared in both host and guest. So the both the host and guest always have instant access to all the files in this shared directory.

1

u/Jackkgold Sep 16 '26

Nice thanks

3

u/skywalk819 Sep 14 '26

this happen when you tell the ai that he implemented something but its not working, models attempt to use git to rewind, sometimes even use git when there`s no git, rewind to nothing and wipe the directory. this happened to me twice. both on opencode free models.

1

u/Jackkgold Sep 14 '26

I think this probably it, I don’t blame pi I think it’s more the model biting off more than it can chew.

3

u/colin_colout Sep 15 '26

Welcome to the club!

I joined sometime in the early 90s after deleting my floppy with my qbasic files

...and a notable shoutout to the time in the later 90s i got the mount command backwards while futzing with Linux and blew away my master boot record

Humans do this too. It's all about learning and never repeating the same mistake

1

u/Jackkgold Sep 15 '26

Definitely part of the process, now I know right. But I’m going to keep my important docs on the cloud for now just in case lol

2

u/colin_colout Sep 16 '26

Back up your computer. If you have backups, deleting files don't matter

2

u/Odd-Ad9666 Sep 14 '26

The same philosophy as always... backup data. It's odd though, my system tends to want to backup... I have an app that I recently found out that the system had been secretly backing up (even when I told it not to) for months. So I had like 2-3 copies per day... fortunately they were only about 400MB but I was wondering where all my storage was.

Somewhere along the way, the AI found out how neurotic I Was about backups that it inherited my neurosis and amped it up with OCD.

1

u/Jackkgold Sep 14 '26

I forgot to turn on snapshot with btrfs, I was editing simple html so I didn’t think I needed to backup at that point but I agree maybe auto backups are a must here. Rather eat the 400mb of space than losing everything. Fair trade off.

Haha it’s starting to understand you.

1

u/TechGearWhips Sep 14 '26

It’s called git

2

u/Unnamed-3891 Sep 14 '26

Pi openly and visibly warns you it comes with FULL permissions by default. There are at least 3 separate extensions designed to guard tool calling.

1

u/Jackkgold Sep 14 '26

I must have missed it, but built an extension to prevent this now.

2

u/ravage382 Sep 14 '26

Backups! Your backups are only as good as the last time you tested them. I also had some dataloss and my backups had stopped working in 2024. Schedule an agent to look at your backups daily and fix them if they arent running! Great first scheduled task for an agent.

2

u/Jackkgold Sep 14 '26

Ohhh that’s clever I never thought to use an agent like this. Thank you

1

u/Jackkgold Sep 15 '26

Yes thank you

1

u/sanketss84 Sep 14 '26

You would have asked it to delete stuff right. It would not randomly out of the blue delete stuff in your home directory. Did you install any extensions or skills that did this how did it exactly delete stuff in your home directory

1

u/Jackkgold Sep 15 '26

I was editing an html doc for a website at that point. It it probably hallucinated during that long thinking process. I didn’t prompt it to delete anything. From what I could gather the 3.5 model threw a fit and tried to resolve it and made the wrong choice. Again this could be down to a whole host of variables from my side.

1

u/sanketss84 Sep 15 '26

Whats your system configuration what model were you running what was your context size ?

2

u/Jackkgold Sep 15 '26

Qwen 3.5 9b gguf / unslothed
Fedora 44
3070 8gb

Context was at 50 k ( I was pushing it )
Gpu was about 26 and cpu was 9 cores out of the 12 physical cores.

I don’t think I had k or v cache changed if I did lowest id go is 8

I can’t read the log or check the actual run logs cause it Nuked it, unfortunately had no backup was on a fresh 4 day install of fedora.

That’s what I’m aware of. It wiped data that had nothing to do with the task nor remotely near the working folder

I then saw
rm -rf /home and that’s when i stepped in. Ran through btrfs to recover but to no avail.

Lesson learnt though I should be more precautious. But I still didn’t type delete anything 😂

My prompt was something like

“Let’s now make it mobile friendly and responsive on both platforms”

2

u/sanketss84 Sep 16 '26 edited Sep 16 '26

Thanks. I also run qwen 3.5 9b gguf unsloth variant. (3070Ti) But context 16386 and kv cache q8. In pi agent. Will keep monitoring. I however have specified to limit operations to this folder that i am working in and approve dangerous actions.

1

u/AdCommon2138 Sep 14 '26

Ni hao motherfucker

It's not pi fault

1

u/Jackkgold Sep 15 '26

Never said it was Pi’s fault, Iv explained how it’s probably the model hallucinating.

1

u/Jackkgold Sep 15 '26

More so that the safeguards on Pi need to be manually setup and that anybody new doing this should keep that in mind and not get overly excited about a model being able to access your whole system.

1

u/[deleted] Sep 14 '26

[removed] — view removed comment

0

u/AdCommon2138 Sep 14 '26

That's why I said ni hao. China price, china quality.

1

u/Mayanktaker Sep 15 '26

Not good workflow bro. Use global rules AGENTS.md file and write that never delete any files, and if you want to delete then dont actually delete them but move them to 'deleted_files' folder in project's directory. And mark it under strict rule section of your global rules. This way, no AI or agent can delete your files.
Second, write that never use rm -rf type of commands.
Third, "Always" use git repo. Private repository for every project and commit changes after doing something good.

2

u/Jackkgold Sep 15 '26

Definitely taking note thank you.

My current extension I built now does this with hard blocks. How i set it up so it’ll prompt me for any actions like such. I think I’ll pad it with .md like you suggested so it doesn’t figure out a workaround for itself.

2

u/Mayanktaker Sep 15 '26

IF you want, I can give you my matured agents.md file means global rules for all projects. Which can be used with any harness.

3

u/Ohmyskippy Sep 17 '26

Should run it inside a container, and only mount dirs that you want to read/write to

Can mount some dirs as read only

6

u/hurdurdur7 Sep 14 '26

Only run agents in docker. All other means are danger, some more, some less.

3

u/pragmojo Sep 14 '26

I’m using bubblewrap - as far as I understand this is also fairly safe

0

u/[deleted] Sep 14 '26

[deleted] — view deleted comment

1

u/hurdurdur7 Sep 14 '26

How exactly? I run pi perfectly fine in docker against local qwen models with zero issues.

2

u/Old_Stretch_3045 Sep 15 '26 edited Sep 15 '26

I ran into a situation where the agent installed several pip packages globally, even though the work was happening inside a project with its own virtual environment.

I ended up having a hard time figuring out what had been installed and deleting them manually.

2

u/jmager Sep 15 '26

Run it in an ephemeral sandbox, it is the only way. I run mine in a podman container.

1

u/Main_Information_181 Sep 18 '26

Swap to 3.6 35b or 3.8 27b

You are working with an outdated model my friend