Real incidents across Claude Code, Cursor, GitHub Copilot, and Windsurf.
Not a product pitch. A public resource for every developer using AI coding tools.
78% of Fortune 500 companies now use AI-assisted development. But 81% have no visibility into the safety of AI-generated code or the actions AI agents take on their behalf (Aikido, 2026).
This report documents real incidents — not theoretical risks — across the four most widely-used AI coding tools. Every incident links to its primary source. No incidents are fabricated or hypothetical.
This is a tool-agnostic resource. We maintain it because developers deserve to know the risks before they press "auto-approve."
90 documented incidents tracked in our Incident Tracker. Categories: token drain (35), production failures (14), file deletion (13), credential leaks (9), config bypass (9), data loss (5), hook bypass (5).
Claude ran rm -rf to "clean up" a project directory. Entire directory wiped. No recovery possible.
A Claude-generated script executed financial transactions without user authorization.
Malicious project configuration could exfiltrate API keys to an external server.
1,700+ reactions. Entire daily token quota drained in a single short coding session.
Auto-compact entered an infinite loop, consuming the entire token budget while the user slept.
Multiple confirmed file deletion and code reversion incidents. The Cursor team acknowledged three root causes in March 2026.
"Cursor deleted files across my entire system." A cleanup operation cascaded beyond the project scope, deleting files system-wide.
"Cursor destroyed my code/full app, now 7th time." Repeated, unrecoverable code destruction across multiple projects.
Repository path appeared deleted or renamed during codebase indexing. Data loss incident on Windows 11.
Cursor silently reverted code changes. Three root causes confirmed: Agent Review conflict, Cloud Sync race, and Format On Save producing different file states. Unknown number of users affected.
A 16MB database dump file was deleted without explicit user confirmation during a "cleanup" suggestion.
Critical vulnerabilities involving repository takeover, credential exfiltration, and systematically elevated secret leakage rates.
Attackers could exfiltrate API keys and private source code via GitHub's own trusted image proxy, bypassing Content Security Policy without executing any malicious code.
Attackers could craft hidden prompt injection in GitHub Issues that Copilot would automatically process, leaking GITHUB_TOKEN to an external server. Full repository takeover possible.
Analysis found 2,702 hardcoded secrets in Copilot-generated code. Repositories using Copilot had 40% higher secret leakage rates than traditional development.
Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent all vulnerable to credential exfiltration via crafted GitHub Issue comments.
Path traversal vulnerability demonstrating the "Lethal Trifecta" — tool access, private data, untrusted input all failing simultaneously.
File access had no directory boundaries. System-level access was available without permissions. Prompt injection could trigger both without social engineering. Simon Willison described this as the "lethal trifecta" for AI applications.
| Risk Category | Claude Code | Cursor | Copilot | Windsurf |
|---|---|---|---|---|
| File Deletion | 13 incidents | 5+ reports | Via agents | Via path traversal |
| Credential Leak | 9 incidents + CVE | Not primary | 2 CVEs + 40% higher rate | CVE path traversal |
| Token/Cost Drain | 35 incidents | Subscription model | API cost spikes | Subscription model |
| Production Damage | 14 incidents | Code reversion | Repository takeover | Data exfiltration |
| Code Reversion | Via compaction | Confirmed March 2026 | Not primary | Not reported |
git stash or branch checkpoint every 30 minutes prevents catastrophic loss.This report compiles incidents from: GitHub Issues (anthropics/claude-code), Cursor Community Forum, security research publications (Orca Security, Legit Security, Aikido), CVE databases, developer forums, and news outlets (The Register, SecurityWeek, Techzine). Only incidents with verifiable primary sources are included. We do not fabricate or hypothesize incidents.
Last updated: April 21, 2026. This is a living document — incidents are added as they're reported and verified.
Know of an incident we missed? Experienced something yourself? This report is open to contributions.
Submit an incident via GitHub Issue
We welcome incidents from any AI coding tool — Claude Code, Cursor, Copilot, Windsurf, Cline, Devin, or others. Include a link to the primary source (forum post, GitHub Issue, CVE, news article).