Thanks a lot for the quick and thorough follow-up, and for passing everything along to the team.
To answer your questions:
- Run Mode: Run Everything. Since nothing was gated, the allowlist wasn’t in play at all.
- That’s partly on me. I’ve gotten used to working with agents like Codex and models like Claude Opus and GPT, and I’ve never really worried about what they’re capable of. When I used Cursor last year, I carefully reviewed my allowlist. But as the models kept proving themselves, I eventually switched to Run Everything for efficiency. This incident has been a painful lesson: the models are still not reliable enough to run without guardrails.
One point I’d like the team to consider: in my experience, Codex still stops and warns before clearly destructive commands even in its fully permissive mode. “Run Everything” shouldn’t mean the agent can wipe a drive without a second thought. A last-line check for things like recursive deletes or drive-root targets would be valuable even in that mode.
Going forward, I’ll switch to Allowlist with a short list, and add a beforeShellExecution hook to block rmdir /s, rd /s, del /s, Remove-Item -Recurse and format, as you suggested. Thanks for the pointers.
On the bright side: my entire Steam library is gone, but luckily Elden Ring Nightreign, the one game I actually play, uses cloud saves. So at least my relics survived.
Thanks again, and I look forward to any update.