> The mythical "rm -rf" random LLM insertion is not a real threat. Every time I see stories about this kind of issue, it's almost always preceded by basically prompt poisoning.

It is real, typically happening when dumber models (haven't personally seen any of the SOTA ones on reasonable thinking/reasoning level do this) try to clean up stuff via bash and forget to assign a variable. Things like "rm -rf sessions/$id" without double-checking $id is actually defined, would do "rm -rf sessions/" and remove the entire directory. Add in more variables in a path like "rm -rf $HOME/projects/$user/$repo/$tmpdir" and the dumb models people think they can use for local coding, promptly removes a lot more than expected.

Not sure how people aren't already running these agents in an environment/sandbox where stuff like this wouldn't matter, locally or not, but some LLMs do truly accidentally delete stuff for people, without "prompt poisoning", I had it happen myself while testing Qwen3.8-27B (BF16) locally just a week or two ago, exactly as described above.