Cursor → 170GB 消失｜事故から生まれた安全プロトコル「WRF Deck」A developer lost 170 GB of data due to a Cursor AI operation gone wrong, and…

AI-assisted coding tools have made it dramatically easier to generate, refactor, and run code from natural-language prompts, but a recent account from a developer illustrates how that same automation can carry real risk. Writing on Zenn, the developer described losing roughly 170 GB of data after an operation performed through Cursor, the AI-centric code editor, went wrong. In response, they published a safety protocol they call "WRF Deck," intended to reduce the chance of similar incidents.

The core issue centers on how modern AI coding assistants operate. Cursor, which is built on a fork of Visual Studio Code, offers an agent mode in which the model can not only suggest edits but also execute file operations and terminal commands on the user's behalf. This capability is useful for tasks like scaffolding projects, cleaning up directories, or running build scripts, but it also means the assistant can issue destructive commands—such as recursive deletions—if a prompt is ambiguous, a path is misinterpreted, or the user approves an action without fully reviewing it. Some tools include an auto-run or "YOLO" mode that reduces the number of confirmation prompts, which speeds up workflows but removes a key human checkpoint.

According to the account, the data loss appears to have stemmed from exactly this class of problem: an AI-initiated operation that removed far more than intended. While the specific commands are described from the author's perspective and cannot be independently verified here, the scenario is consistent with documented failure modes in agentic tooling, where a single misdirected delete or overwrite can cascade across a large directory tree.

The WRF Deck protocol is presented as a set of steps to prevent recurrence rather than a piece of software. Based on the description, it functions as a checklist or operating discipline applied before allowing an AI agent to perform potentially irreversible actions. The emphasis appears to be on verifying scope, requiring explicit review of destructive commands, and maintaining recoverable copies of important data so that a mistaken operation does not become permanent. The author frames it as risk management for AI-assisted development, an area that has received less attention than the productivity gains such tools promise.

For readers weighing similar precautions, several established practices align with the protocol's apparent goals. Keeping projects under version control with Git limits the damage of accidental edits, though it does not protect large binary assets or files stored outside the repository. Regular, automated backups—ideally following a rule such as keeping multiple copies across separate locations—remain the most reliable defense against irreversible loss. Running agents inside a sandbox, a container, or a directory with limited permissions can also constrain what an assistant is able to touch. Many teams additionally disable auto-execution for shell commands, so that any deletion or system-level action requires a deliberate human confirmation.

The incident arrives amid rapid growth in agentic coding tools. Beyond Cursor, offerings such as GitHub Copilot's agent features, Anthropic's Claude Code, and editors like Windsurf have expanded the degree to which AI can act directly on a codebase and the surrounding system. As these agents gain the ability to run terminal commands, manage files, and chain multiple steps together, the balance between convenience and safety becomes more consequential. Vendors have responded with permission prompts, allowlists, and confirmation dialogs, but the effectiveness of those guardrails still depends heavily on how individual users configure and heed them.

The broader takeaway from the Zenn post is not that Cursor or AI coding in general is uniquely dangerous, but that granting software the authority to execute commands demands the same caution long applied to running unfamiliar scripts. A protocol like WRF Deck reflects a growing recognition that AI-assisted workflows need explicit safeguards, not just faster output. Whether this particular framework gains wider adoption is unclear, but the underlying lesson—verify before you automate, and always keep a recoverable copy—applies regardless of which tool a developer chooses.