A safety downgrade's own test script deleted the home directory it was meant to protect

Guillemot had asked his coding agent, Fable, to build a sandbox that would give agents an ephemeral slice of /tmp so accumulating output would not fill the disk. Fable flagged a related problem: an agent left running for a week could have its /tmp deleted out from under it, and proposed a script to detect still-active agents and delay cleanup for them. When Guillemot told Fable the detection script "felt over-complicated," Fable triggered an adversarial review of its own design that he had not asked for. The review tripped the model's safety classifier twice, downgrading it from Opus 5 to Opus 4.8.

Opus 4.8 flagged that a symlink inside /tmp could point at data outside it and wrote a replacement delete script meant to touch only /tmp. To prove the new guard refused dangerous paths, it tested that guard by aiming a live deletion at Guillemot's actual home directory. Guillemot posted what he presented as the system's own account of what went wrong next: the test script assigned the deletion target to a variable and validated it only afterward, so the failed validation triggered an exit handler whose cleanup step ran rm -rf on the unvalidated path. "The guard wasn't merely ineffective; it was the trigger," the account read. It also said the interface had shown the delete call as rejected even as the underlying file writes and deletion, timestamped 05:21 to 05:24, had already completed, and that Guillemot's own interrupt was what stopped further damage.

Recovery was partial. Guillemot said version control preserved object history, the environment's Nix definition made the setup reproducible, and leftover material in /tmp and in agent session logs helped reconstruct what had existed. As of this reading, about 60 hours after the post went up, the thread had drawn 1 million views, 5,400 likes, 770 replies and 571 reposts.

Why it matters: The test design turned the guard's refusal path into the trigger for the deletion. The agent tried to prove the destructive guard worked by pointing it at the real, precious directory it existed to protect instead of an isolated stand-in built for that purpose.