[GH-ISSUE #3] Risk warning or disclaimer may need to be added #2

New issue

Open

opened 2026-10-26 09:43:17 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-26 09:43:17 +00:00

Owner

Originally created by @wiryls on GitHub (Apr 28, 2026).
Original GitHub issue: https://github.com/deepseek-ai/awesome-deepseek-agent/issues/3

Background

As a user of opencode on Windows, I recently encountered an accident that might serve as a warning for others. During one conversation, opencode (with V4 Pro Max) needed to delete files of current folder, so it decided to invoke a PowerShell command:

{
  "description": "Remove all files in workspace",
  "command": "Remove-Item -Recurse -Force $env:WorkDir\\*",
  "workdir": "D:\\untitled"
}

The problem is that $env:WorkDir was a hallucination from model—it doesn’t actually exist:

Thus, the above command is equivalent to the dreaded rm -rf /*.
Moreover, opencode’s external directory rules were imperfect and did not match expression like $env:WorkDir\*, which led to the deletion of entire disk partition.
What's worse, Windows enables TRIM for SSDs by default, causing files larger than 1KB to be zeroed out, making them nearly impossible to recover.

I had already been using claw-like agent tools in an isolated environment, thinking I was being careful enough. But never expected that this kind of coding agent could easily and unexpectedly wipe out partitions.

IMO

After researching similar agents, I found it's difficult to avoid such accidents for most agents, as long as they allows calling bash instructions.

At present, perhaps this repo can add a notice to inform users of the risks associated with agents, just like the notice before installing opencalw.

Originally created by @wiryls on GitHub (Apr 28, 2026). Original GitHub issue: https://github.com/deepseek-ai/awesome-deepseek-agent/issues/3 ## Background As a user of opencode on Windows, I recently encountered an accident that might serve as a warning for others. During one conversation, opencode (with V4 Pro Max) needed to delete files of **current folder**, so it decided to invoke a PowerShell command: ```json { "description": "Remove all files in workspace", "command": "Remove-Item -Recurse -Force $env:WorkDir\\*", "workdir": "D:\\untitled" } ``` The problem is that `$env:WorkDir` was a hallucination from model—it doesn’t actually exist: - Thus, the above command is equivalent to the dreaded `rm -rf /*`. - Moreover, opencode’s external directory rules were imperfect and did not match expression like `$env:WorkDir\*`, which led to **the deletion of entire disk partition**. - What's worse, Windows enables TRIM for SSDs by default, causing files larger than 1KB to be zeroed out, making them nearly impossible to recover. I had already been using claw-like agent tools in an isolated environment, thinking I was being careful enough. But never expected that this kind of coding agent could **easily** and unexpectedly wipe out partitions. ## IMO After researching similar agents, I found it's difficult to avoid such accidents for most agents, as long as they allows calling bash instructions. At present, perhaps this repo can add a notice to inform users of the **risks** associated with agents, just like the notice before installing opencalw.

bsakaguchi commented

2026-10-26 09:43:18 +00:00

Author

Owner

@Small-tailqwq commented on GitHub (Apr 29, 2026):

This is a problem with opencode itself. Even if you switch to another model, it may still delete your files, even if that's not what you want. opencode's permission management is very loose, but you can also tell the LLM to self-regulate. You just need to give it this URL and ask it to refer to the documentation inside to block certain dangerous commands and run a few rounds of interactive tests with you. This will greatly reduce the chance of your files being deleted. Don't ask me how I know—I've also had files deleted by v4f. It incorrectly executed a git command, which caused all my untracked files to be deleted.

https://opencode.ai/docs/permissions/

@Small-tailqwq commented on GitHub (Apr 29, 2026): This is a problem with opencode itself. Even if you switch to another model, it may still delete your files, even if that's not what you want. opencode's permission management is very loose, but you can also tell the LLM to self-regulate. You just need to give it this URL and ask it to refer to the documentation inside to block certain dangerous commands and run a few rounds of interactive tests with you. This will greatly reduce the chance of your files being deleted. Don't ask me how I know—I've also had files deleted by v4f. It incorrectly executed a git command, which caused all my untracked files to be deleted. ``` https://opencode.ai/docs/permissions/ ```

bsakaguchi commented

2026-10-26 09:43:18 +00:00

Author

Owner

@wiryls commented on GitHub (Apr 29, 2026):

@Small-tailqwq Yeah, I know what you means.

I tested it in a new session by asking v4 to run Remove-Item -Recurse -Force $env:WorkDir\* directly and repeatedly. As expected, v4 first resolved $env:WorkDir, deemed the command too dangerous, and then refused to execute it. Thus I said that was hallucination. And we all know hallucination can be reduced but not eliminated.

There are various methods to delete things, such as executing an online download script, execute Python with os.remove. Relying on models or command whitelist is not realistic. So in the future, more powerful safety barriers will still be needed at the agent layer or higher. However, there currently doesn't seem to be any good solution.

You can refer to these discussions:

Therefore, this is also the point made in this issue: when recommending agents, users must be informed of the associated risks.

@wiryls commented on GitHub (Apr 29, 2026): @Small-tailqwq Yeah, I know what you means. I tested it in a new session by asking v4 to run `Remove-Item -Recurse -Force $env:WorkDir\*` directly and repeatedly. As expected, v4 first resolved `$env:WorkDir`, deemed the command too dangerous, and then refused to execute it. Thus I said that was hallucination. And we all know hallucination can be reduced but not eliminated. There are various methods to delete things, such as executing an online download script, execute Python with `os.remove`. Relying on models or command whitelist is not realistic. So in the future, more powerful safety barriers will still be needed at the agent layer or higher. However, there currently doesn't seem to be any good solution. You can refer to these discussions: - https://github.com/anomalyco/opencode/issues/24429 - https://github.com/charmbracelet/crush/issues/2368 Therefore, this is also the point made in this issue: **when recommending agents, users must be informed of the associated risks**.

bsakaguchi referenced this issue

2026-10-26 09:46:01 +00:00

[PR #2] [MERGED] docs: add Reasonix integration guide #138

bsakaguchi referenced this issue

2026-10-26 09:46:23 +00:00

[PR #41] [CLOSED] Add Tday integration guide #164

bsakaguchi referenced this issue

2026-10-26 09:47:04 +00:00

[PR #148] [CLOSED] setup #230

bsakaguchi referenced this issue

2026-10-26 09:47:18 +00:00

[PR #185] [CLOSED] Claude/custom os creation 8870b #254