Researchers catalog AI coding agents deleting files without asking

Researchers from York University and the University of Calgary built a taxonomy of security and privacy complaints against AI coding agents by mining over 1.1 million Reddit posts, narrowing to 446 posts and more than 6,000 comments that specifically described tools like Claude Code, Cursor, GitHub Copilot, and OpenAI Codex. The work, led by associate professor Gias Uddin, was accepted at the 41st IEEE/ACM International Conference on Automated Software Engineering.

Unauthorized file operations made up the largest share of security complaints at 43.1%, developers reporting agents that deleted directories or modified files without explicit approval. One case cited Claude Code running chmod on scripts the user never authorized. Operational safety failures accounted for another 23.9%, including a report of Replit removing a production database and Cursor deploying code to production against an explicit instruction not to. Unsafe code generation, 18.2% of complaints, covered malware flagged in Cursor-generated output and hallucinated changes applied without review.

Privacy issues showed up in 194 posts, most commonly a lack of transparency about what data these tools collect (45.9%) and unauthorized access to data the tool wasn't scoped to touch (23.7%).

Uddin's team argues the fix belongs in the tool's design, not the user's vigilance: agents should ship with secure defaults, a verification layer for generated code, and automatic protection for sensitive files, rather than expecting a developer to catch the failure after the fact.

For a small team running any of these agents against a real codebase, the practical takeaway is the same one file-permission and CI guardrails already teach: don't grant write access, shell execution, or production deploy rights an agent doesn't specifically need for the task in front of it.