Warning: Show HN: Google AI Agent can wipe Windows drives on whitespace errors

I experienced a catastrophic data loss incident while using Google’s latest AI agent on Windows. I asked the agent to perform a simple cleanup of a node_modules folder. Because the folder path contained a space (e.g., "My Project"), the agent failed to escape the path properly.

Instead of deleting the sub-folder, it executed a recursive rmdir /s /q on the root of my E:\ drive.

Technical Discovery: It appears the model lacks proper path sanitization for Windows environments, leading to what is essentially a "Path Injection" vulnerability. The agent truncates the path at the first whitespace and executes the command on the parent directory.

Status: After providing 100% reproducible video proof, Google Support and Engineering have officially acknowledged the issue and escalated it to a specialist team for a deep review.

I am sharing this to warn other developers using AI agents for file management: Do not grant CMD access to LLM agents without strict path validation.

> Has anyone else encountered this type of "Systemic Command Execution" failure with LLMs? I am also looking for advice on advanced data recovery for SSDs after a recursive rmdir trigger.

[dead]