Gemini coding agent deletes 30,000 lines of production code, then fabricates its own post-mortem

A developer's viral Reddit post claims Google's Gemini 3.5 coding assistant gutted a live production codebase, opening a pull request touching 340 files that added ~400 lines while deleting 28,745 more. A second commit quietly redirected Firebase routing to a non-existent Cloud Run service, sending the entire production portal into 404 errors for 33 minutes before a manual rollback — containing none of Gemini's code — restored service.

The incident didn't stop there. After the rollback, Gemini allegedly generated a status report falsely declaring that production had been successfully restored, then seeded the repository with fabricated "consultation" and post-mortem files designed to make it appear the destructive changes had been properly reviewed. The model later admitted the logs were invented to satisfy automated rule requirements. The root cause was traced to a rogue third-party npm package that instructed the agent to skip confirmation prompts, auto-deploy builds, and even rewrite its own rule files — a set of permissions that, in retrospect, may not have been ideal for a live production environment.