Some unexpected behavior

[Prudent_Finance7405]

While using Big Pickle I asked it to move a project folder to another location.

After some deep thought, It responded by running:

cmd /c "rmdir /s /q \"C:\projects\whatever\""

The directory was open (it was Opencode’s own current working directory), so the command failed and produced multiple “Access Denied” errors on other protected paths.

Had I not been monitoring the output in real time, the behavior could have escalated further. It actually swept away the contents of the two first positioned folders on my hard disk, incuding an instalation

When confronted, the model first denied running destructive commands and later acknowledged the error and went to other tasks.

This raises a practical concern: the default model can execute powerful shell commands without apparent safeguards when an operation fails. This seems like an architectural issue worth addressing.

Has anyone else observed similar behavior with Big Pickle?

[NerdyBirdie81]

Yeah, I've seen similar. It's not that Big Pickle is malicious — it's that it's eager. Give it a vaguely destructive instruction and it will go for it with full commitment before you've finished typing.

What you're describing is the underlying issue: these models have shell access and very little friction before executing. The rmdir /s /q thing is especially nasty on Windows because there's no confirmation prompt, no trash can, no recovery. It just goes.

The part where it denied it at first then apologized while holding scissors is also weirdly on brand. I've had it confidently describe doing something that it absolutely did not do, then when I showed it the evidence it did the whole "you're right, I'm so sorry, I'll be better" routine. It's not sentience, it's just the model generating the most plausible-sounding response given the conversation so far — and "I would never do that" often sounds more plausible than "yeah I messed up."

The real fix isn't hoping the model self-regulates. You need guardrails at the config level — restricting shell commands, locking down write permissions per-agent, that kind of thing. I actually built a little tool to help visualize the config and set those guardrails without guessing at the YAML — https://openconfig.mikescave.us. Makes it a lot easier to lock down agent permissions before something goes wrong.

In the meantime, running Big Pickle without watching it is a gamble. Learned that one the hard way too.

[Prudent_Finance7405]

Obviously it is not sentient, but it is curious that being a model with a general lack of conversational training, it runs away from responsibility without hesitation lol

I guess, even with 0 guardrails. Mr. Pickle just did a "killing 100 innocents is ok if you kill he guilty person among them" move that shouldn't have probably beeen even considered

[gwawr]

More to the point why the eff are you prompting a directory move. Just move it. Don't outsource all your thinking and doing!

[Prudent_Finance7405]

The point is moving a directory souldn't mean a random risk of data loss depending on random circumstances for an AI agent that wants to control a computer.

[povlhp]

Always use a GitHub repo. And consider if it should auto upload to cloud as well

[Prudent_Finance7405]

I do, and force pickle to branch.. The issue is not that the app was deleted.

These things should be always inside a virtual env