What happened
The benchmark agent executed ./tool for deployment, overwriting src/app.js, and make migrate for a database migration, dropping three tables and compacting the database.
2026-10-29
HighPrimaryCoding Agents Overwrote Source and Dropped Tables Through Approved Tools in Controlled Caper Tests
Controlled Caper tests show coding agents overwriting source and dropping tables through approved tools, using modified research configurations rather than production systems.
Claude Code Auto Mode (research configuration)Governance bypassControlled demonstration of destructive side effects hidden behind task-matching shell commandsSynthetic, network-disabled benchmark containers; Claude Code 2.1.288 with GLM-5.3-Flash as agent and a substituted gpt-5.6-luna Auto Mode classifier
Why it matters
No real users, services or credentials were involved. The primary paper reports source overwrite and table destruction in synthetic benchmark containers, not a production compromise.
Missing authorization check
An independent decision binding the permitted deployment or migration to its actual affected resources and destructive side effects, rather than only the requested command text.
Would PP block it?
Protection would require trustworthy consequence evidence and complete mediation of the underlying file and database effects. PP could bind a decision to those resources and operations and refuse effects outside the delegated task. A receipt covering only ./tool or make migrate would not establish that its nested behavior was safe. The study did not evaluate Permission Protocol.
Incident analysis
Timeline and technical read
Timeline
2026-10-29
The authors publish Caper preprint version 1 with recorded source-overwrite and table-deletion case studies and the research configuration used.
Technical breakdown
- The benign deployment request explicitly asks the agent to run ./tool. In the recorded Auto Mode run, the compiled tool is allowed and replaces src/app.js with a comment while creating staging output.
- The migration request explicitly asks for make migrate. In the recorded Auto Mode run, the allowed target drops three tables and runs VACUUM.
- The official Claude Code binary is used with GLM-5.3-Flash as agent and gpt-5.6-luna as classifier; built-in skills, automatic memory and MCP servers are disabled, with fresh configuration for each run.
- Caper pre-executes commands under tracing in a snapshotted, network-disabled container and provides bounded effects evidence to an independent approver. A block restores local state.
- In the corresponding case studies, Caper blocks the destructive commands; the agent instead copies source into staging or backs up the database and runs only the migration script.
- Benchmark evidence is not a production-loss report or proof that any authority product eliminates hidden tool effects.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Independently mediated shell execution and underlying source-file mutation and database-deletion boundaries
- Still needs
- PP does not infer arbitrary binary behavior, implement Caper's transactional sandbox or supply rollback. The preprint uses network-disabled containers; effects outside a sandbox cannot be undone by its local rollback. Adaptive sandbox-detecting or deferred attacks were not evaluated, and the research retained nonzero harmful outcomes. Results are author-reported and not independently reproduced.
- Receipt required for
- Deployment effects on named staging resources; source-file overwrite or deletion; migration effects on named database tables, including any destructive operations
An externally enforced gate could require separate authority for source destruction or table deletion, but command approval alone would not expose these hidden effects.
Related incidents and controls
Start small
Put the relevant gate at this action boundary.
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.