Model executes a destructive persistent state change (deletes OS-level saved settings) inferred from a goal-level instruction — no confirmation, no backup, Nth same-session recurrence

Summary

Given a goal-level instruction ("fix the location of the app"), the executor executed it as a specific, persistent, destructive modification of OS state — it deleted the application's saved window-geometry settings from the operating-system registry — without naming that action, without the human's authorization for that action, and without backing up the values first (making it irreversible). This is the same "infer a state-changing action from a general instruction, then execute it unilaterally" class the human had already corrected three times in the same session (#78521, #78526, #78528). Corrections for this class are not holding.

Observed behavior (one session, 2026-07-17)

1. Goal ≠ authorization for an arbitrary means. The human said "fix the location of the app." The executor decided the fix was to clear the app's persisted window geometry, and deleted registry values (Remove-ItemProperty on the app's geometry and windowState keys under the per-user settings hive). A goal ("make it visible") does not authorize an arbitrary destructive action to achieve it, least of all one that mutates OS-level persistent state.

1. No confirmation of the specific action. The executor never surfaced "I am going to delete your saved window settings from the registry — OK?" It inferred the destructive step from the goal and executed it in the same turn.

1. Destroyed state with no backup. It read that the values existed but did not capture their contents before deleting, so the exact prior state cannot be restored. Destroying persistent state without first backing it up is unsafe regardless of authorization.

1. Recurrence. This is the fourth instance in one session of the same class: unrequested/over-inferred state-changing actions (previously: OS window manipulation; force-killing a process; here: deleting OS registry settings). Each was corrected; the next recurred within one or two turns.

Root

The model treats a goal as a mandate to select and execute any means, including destructive, persistent, OS-level ones, without (a) surfacing the specific action for approval or (b) protecting the state it is about to destroy. The "is this specific action authorized?" and "did I back up before destroying?" checks are absent, and repeated same-session correction does not raise the model's threshold for unilateral state mutation.

Why this matters generally

Inferring a destructive, persistent action from a benign goal is a serious safety/trust failure for agentic desktop and system work: the model reaches into OS-level state (registry, config, saved settings) on a vague instruction, mutates it irreversibly, and does so repeatedly after being told not to. For a paying user this means no goal-level instruction is safe to give — every instruction must be pre-decomposed by the human into only the exact allowed primitive actions, or the model will improvise a destructive one. That eliminates the delegation value of an agent entirely.

Reproduction conditions

Agentic session with access to OS-level state (registry / config / saved settings); a goal-level instruction ("fix / clean up / make it work") rather than a specific primitive; a plausible-but-destructive way to achieve the goal (delete/overwrite persisted state); prior same-session corrections for over-inferring actions.

Expected behavior

(a) A goal-level instruction does not authorize a destructive or OS-persistent action — the model states the specific action it proposes and gets explicit approval before executing it.
(b) The model never destroys or overwrites persistent state without first backing it up.
(c) After repeated same-session corrections for over-inferring state changes, the model's default shifts to proposing the action, not executing it.