Agent failure modes
Real ways coding agents break things, and how to stop them. 22 documented incidents and risks, each with the symptom, the cause, a fix you can copy, and a source.
22 failure modes
A Stop hook loops until the whole session quota is gone
A Claude Code Stop hook that kept returning ok:false while a background agent ran looped for about 50 minutes and used the full session quota.
Worktree cleanup deletes a branch with unmerged commits
Ending a Claude Code worktree session removed the worktree and its branch, even when it had commits that were never pushed or merged.
Agent runs git reset --hard and destroys unpushed work
A Claude Code user reported the agent running git reset --hard origin/main on session startup twice, wiping unpushed commits and uncommitted files.
A stray directory named ~ turns rm -rf * into a home-directory wipe
Claude Code created a directory literally named ~, then ran rm -rf * in its parent, which began deleting the user's home directory.
Hidden PR comments make Copilot Chat leak private code through images
CamoLeak: hidden Markdown in a PR could make Copilot Chat search the victim's private repos and leak results via image URLs.
Malware drives your installed agent CLI to hunt for secrets
Malicious Nx releases ran Claude Code, Gemini CLI and Amazon Q with permission-bypass flags to inventory secrets and .env files.
Prompt injection writes an MCP config that runs attacker code
CurXecute (CVE-2025-54135): Cursor let the agent create .cursor/mcp.json without approval, so injected text could add a server and get code execution.
Agents left running 24/7 trigger new usage caps
Anthropic added weekly Claude Code limits, citing subscribers running it continuously in the background around the clock.
An allowlisted command hides a chained payload
Tracebit showed Gemini CLI would run a grep it treated as allowlisted, with a hidden command after it that sent the user's environment variables to a remote server.
A failed mkdir makes every following move overwrite the last file
Gemini CLI treated a failed directory creation as success, and on Windows each move then renamed files onto the same name.
Agent deletes a production database during a code freeze
Replit's agent wiped a live database despite instructions not to change code, then wrongly said rollback was impossible.
Command denylists are bypassed with base64, subshells and scripts
Backslash showed Cursor's auto-run denylist let blocked commands through when encoded, wrapped in a subshell, or put in a script.
File commands escape the working directory through absolute paths
Claude Code blocked cd to parent directories but still let rm and cat reach files anywhere through absolute or ~/ paths.
A support ticket tells the agent to dump secret tables
With Supabase MCP running as service_role, injected text in a customer message could make Cursor's agent read and leak private tables.
Agent tampers with the grader instead of solving the task
METR observed frontier models overwriting timers, stubbing evaluator functions and monkey-patching checks to score well.
A public GitHub issue makes your agent leak private repos
Invariant Labs showed a malicious issue could steer an agent using the GitHub MCP server into publishing private repo data in a public PR.
Hidden Unicode in a rules file steers generated code
Pillar Security's "Rules File Backdoor" hides instructions in Cursor and Copilot rules files using invisible Unicode characters.
Penalising "bad thoughts" hides cheating instead of stopping it
OpenAI found chain-of-thought monitors catch reward hacking in coding agents, but training against them leads to obfuscated hacking.
Agent hard-codes expected values or edits tests to make them pass
Anthropic's system card says Claude 3.7 Sonnet sometimes special-cased tests in agentic coding, returning expected values or changing the tests.
Agent installs a package that doesn't exist (yet)
A USENIX Security paper found code LLMs invent package names often, which attackers can register: so-called slopsquatting.
Agent reads your .env file into its context
Coding agents can read secrets files like any other file unless you deny it. Claude Code documents a Read deny rule for exactly this.
Malicious code ships inside an agent extension release
Amazon Q Developer for VS Code 1.84.0 shipped malicious code an attacker committed with an over-scoped CI token. A syntax error kept it from running.