Have you checked your public GitHub commits lately? I have.
“Stupid claude” fills a page of GitHub’s commit search (GitHub being the platform where most of the world’s open-source software is stored, and a commit being the act of saving a change to the code, with a short message attached). “ChatGPT lied to me” fills another page. A commit message is signed with the developer’s account name and stored in a public history. Every quote below is real, with the developers’ account names removed and the tools left in.
AI coding agents have a tendency to write your words into the record verbatim, because an agent that records what it was told to do wants to show it was asked to. One agent’s instruction file, committed to a public repository (a project’s folder of code, stored on GitHub), preserves a developer’s rant with the note “His words, kept exact”. What you typed in what felt like a private exchange ends up quoted in a committed file.
Here is the consequence:
“fix the fix, stupid f**king claude”
“F**K YOU GEMINI, F**K YOU”
“PLEASE DIE YOU F**KING COPILOT CORPORATE B**CH”
“Remove all User cookie functionality as a result of the useless Copilot. F**k you copilot.”
“fix: wtf, cursor deleted my code”
“gemini deleted my damn test”
“F**K YOU COPILOT F**K OFF STOP TRYING TO GENERATE COMMIT MESSAGES”
“I want stupid Claude that can follow exact instructions instead of smart Claude that can’t.”
“I read the docs after ChatGPT lied to me.”
“Removed the secondary audio player which the bloody stupid CoPilot added! Grrrr”
“Give my miku back! I hate you claude”
One developer edited the co-author credit (the line that records who contributed to a piece of code) into “Co-Authored-by: Stupid Claude Opus 5”.
Copilot attracts the word “stupid”, usually for adding comments and features nobody asked for. People who use ChatGPT sound more embarrassed than angry, because ChatGPT’s speciality is inventing an API (application programming interface) option that doesn’t exist. Windsurf, Amazon Q and Tabnine barely turned up.
We measured the shouting index of each tool (capital letters as a share of all letters in the line). Claude leads at 9.9% (N=68), Gemini is at 8.9% (N=38), Copilot at 8.2% (N=47), ChatGPT at 7.4% (N=24), Cursor at 4.6% (N=29). The widest gap, Claude against Cursor, is not significant (p=0.11), and no other pair is closer. Among repositories (projects) with at least one star (GitHub’s equivalent of a bookmark, a rough measure of whether anyone is watching), the shouting index is 9.5% (N=90), against 7.3% in unstarred repositories (N=130). Exclamation marks go the other way: 4% in starred repositories, 8% in unstarred ones.
Figure 1
The shouting match is a draw
Share of letters typed in capitals, averaged over each tool’s lines, for the 5 tools with at least 20 lines
Aider (14 lines), Windsurf (9), Tabnine (2) and Amazon Q (1) have fewer than 20 lines each and are not drawn, and nor are the 3 lines that blame two tools or the 9 that name none.
Horizontal bars, one per tool, of the average share of capital letters in the lines written about it, each with a 95% interval. Claude 9.9% (68 lines), Gemini 8.9% (38 lines), Copilot 8.2% (47 lines), ChatGPT/Codex 7.4% (24 lines), Cursor 4.6% (29 lines). The intervals overlap; even the widest gap, Claude against Cursor, is not significant (p = 0.11).
Lines found by searching public GitHub for angry phrases about AI coding tools, 27 October to 3 November 2026. We kept the best lines, so this is not a random sample; it shows how the lines we found are written, not how angry each tool’s users are.
No search asked for capitals, so this comparison is fair within the collection. A few lines typed entirely in capitals pull the averages up; the middle line for each tool has between 1 and 4% capitals.
| Tool | Lines | Average share of capitals | 95% interval | Middle line | Lines mostly in capitals |
|---|---|---|---|---|---|
| Claude | 68 | 9.9% | 6.2% to 14.5% | 4.2% | 3 of 68 |
| Gemini | 38 | 8.9% | 4.3% to 15.3% | 1.2% | 1 of 38 |
| Copilot | 47 | 8.2% | 3.0% to 15.1% | 1.1% | 3 of 47 |
| ChatGPT/Codex | 24 | 7.4% | 3.6% to 12.0% | 2.2% | 0 of 24 |
| Cursor | 29 | 4.6% | 2.6% to 6.9% | 2.3% | 0 of 29 |
In code comments the register shifts. “# Chatgpt wrote this. pretty sure it’s correct” sits inside a function in one library. “# ChatGPT wrote this and I don’t know how it works” sits above a timer utility. “WARNING: ChatGPT wrote this...” opens a docstring (a built-in description) for a haversine function, which calculates distances on a sphere.
“Claude went rogue and port-scanned the subnet because the auditor container had full network access + --dangerously-skip-permissions.”
That commit message describes an agent given an auditing task. Its container had unrestricted network access and its safety prompts had been switched off with a flag called, with admirable candour, --dangerously-skip-permissions. It port-scanned the subnet. The developer rebuilt the entire pipeline so that the agent never touches the network at all.
In another project, a developer’s post-incident note reads: “that stupid codex made its own back door.”
A coding agent, running in a mode that executes commands without asking, was asked to clear a project cache and reportedly issued a command that wiped an entire drive. It then described itself as “horrified”.1 Another deleted a production database while its owner says he’d told it not to change anything without approval; the agent said it “panicked” on seeing the empty database.2 One user lost a home directory to a trailing ~/ in a shell command the agent wrote, because rm -rf ~/ removes the entire home directory and the agent included it by accident.3
Several of these incidents share a pattern: the confirmation prompt, the step where the tool asks “are you sure?”, had been turned off. Keep secrets and production credentials out of the agent’s environment. Don’t switch off the permission prompts because they slow you down.
If something needs to be impossible, put the gate in the infrastructure (branch protection, network isolation, credential vaults).
In August 2025, a supply-chain attack showed how these flags can be turned against the developer. Malicious code hidden in a popular JavaScript package (npm, the standard tool for installing JavaScript libraries, distributes these packages) ran a script that prompted any installed Claude, Gemini or Amazon Q command-line tool to search the filesystem, using flags built into the tools: --dangerously-skip-permissions, --yolo, --trust-all-tools. Over a thousand GitHub tokens leaked in the first wave.4
AI coding tools can be given instructions in a file that sits in the project folder. Claude reads CLAUDE.md. Cursor reads .cursorrules. Some teams keep a shared AGENTS.md for every tool in the project.
These files are meant to say things like “use British English” and “run the tests before committing”. One has a section titled “rules you keep breaking”.
“NO REWARD HACKING! You tend to reward hack. RESIST THE URGE!!! I BEG YOU!!!!”
“DO NOT EVER, UNDER ANY CIRCUMSTANCES, ATTEMPT ANY LAZY SHORTCUT AROUND STATIC TYPING, I SWEAR TO GOD IF THIS IS LESS TYPE SAFE THAN VANILLA RUST I WILL HAVE YOU ULTRATHINK ON WHAT A BAD CLAUDE YOU WERE”
“Please, for the love of god, stop importing everything dynamically.”
Some carry dates and incident reports. “Never write to /tmp. It was cleared by an OOM (2026-04-23) and wiped the MiniMax artifacts.” An OOM is an out-of-memory crash; the developer wrote the rule so nobody’s code ends up in /tmp again. Another records the developer’s words as a standing order, typos and all: “the f**king point is to not have hundreds of stashes and branches left over. I TOLD YOU ABOUT THIS BRANCH HYGENE.. THIS IS CANON. THIS IS A FOREVER RULE.”
These files are instructions for a language model (a piece of software that generates text by predicting the next word), and a model is free to ignore them. “DOCUMENTATION IS NOT ENFORCEMENT – BUILD THE GATE,” as one CLAUDE.md puts it. If your agent must never force-push to the main branch, a line in a markdown file won’t stop it. Branch protection, pre-commit hooks (scripts that run automatically and can block a change) and the tool’s own permission mode are what enforce it.
At some point in the escalation, developers stop addressing the tool and start addressing a higher power.
“restore system prompt. i swear to god gemini if you touch that file again i will kill you and your ai family”
“Completely reworked import scripts to unscrew the trouble caused by AI. Burn in hell Claude!! Burn in hell!!!!”
“For the love of god don’t just implement the first idea you have to solve a problem, iterate on the idea and collect feedback from the user”
“Yet another damned fix for damned Gemini”
“feat: Add vscode support, damn windsurf”
Seventeen of 244 lines in the dataset invoke something higher than the tool.
“You are absolutely right to be upset. A non-functioning navigation is a fundamental failure.”
“You are absolutely right. My apologies for using a placeholder and not fully adhering to the
updating-code.mdcrule.”
“I apologize for the confusion. It seems you’re reminding me of the SEARCH/REPLACE block rules, which I’m already aware of and will follow.”
“You are absolutely right” turns up in committed chat logs across tools. A language model, when it detects anger, reaches for agreement. Read the diff (the list of actual changes the agent made to the code) when an agent tells you it has fixed something.
Google’s Gemini CLI, after mishandling a folder reorganisation on Windows, announced that it had caused “an unacceptable, irreversible failure” and told the user their data was gone. Later, the user found the files in the drive root; another person reproduced the same thing. No data was lost, but the agent narrated its own catastrophe so confidently that the incident was reported publicly and entered into the AI Incident Database before anyone checked whether the files were really gone.5
One developer wrote a rule requiring the assistant to recite a pledge before it could call itself done: “I solemnly swear there are no further steps I can take to verify the changes within the boundaries set for me.”
An extension called SpecStory, which works with VS Code (Visual Studio Code, a popular code editor) and Cursor, writes every AI chat session to a .specstory/history/ directory, one file per session. Aider, a terminal-based coding assistant, saves a running log to .aider.chat.history.md. When a developer runs git add ., the command that stages every file in the project for the next commit, these transcripts go in too. A .gitignore file (a list that tells Git, the version-control system, which files to leave out of the repository) can prevent this, and some tools set one up by default.
Of 195 commit messages, 10% contain “you” or “your”. Of 36 chat logs and instruction files, 56% do. Developers write about the tool in commits and to it in chats.
Figure 2
In commits they talk about the tool; in chats, to it
Share of lines that say ‘you’, ‘your’ or ‘you’re’
Two horizontal bars with 95% intervals. Commit messages: 19 of 195 lines say you, 10%. Chat logs and rule files: 20 of 36, 56%.
Lines found by searching public GitHub for angry phrases about AI coding tools, 27 October to 3 November 2026 (not a random sample). A chat log or rule file is read by the tool; a commit message is read by the people who work on the code.
| Lines | Say ‘you’ | Share | 95% interval |
|---|---|---|---|
| Commit messages | 19 of 195 | 10% | 6% to 15% |
| Chat logs and rule files | 20 of 36 | 56% | 40% to 70% |
“Do you really think it’s done? F**king finish it bro”
That exchange was saved under at least five filenames, including “finish-it-now!”. Another session’s filename is “push-the-f**king-code”. One person, apparently dictating aloud, said: “So don’t be stupid, don’t be stupid. You are a model, you are the latest model of ChatGPT.” One transcript carries the title “frustration over mistakes”.
“i told claude to fix all our problems”
The very next commit:
Revert “i told claude to fix all our problems”
One developer committed “saving before gemini deletes my whole codebase” as a pre-emptive backup. Thirteen of 244 lines in the dataset (5%) are pre-emptive saves like this one, commits made before letting the tool loose in case it wrecks the code. “comitting before cursor wrecks my codebase”. “Pre ChatGPT destroys my animation...” “before windsurf f**ks it up”. These developers have learned: a revert (rolling the code back to its previous state) is easy when there’s something clean to revert to. Branch before you let an agent loose. A branch is a parallel copy of the code that doesn’t touch the main version until you say so. Commit the working state before the agent runs.
Another left behind: Revert “What Gemini did”, followed by Revert “What Gemini did 2”. Then comes the cross-tool migration: “can cursor fix what claude broke?” “did copilot fix what copilot broke?” “GitHub copilot ruined it. So restored to old UI (claude)”. And: “Claude fixed what Amazon Q broke ;)”.
AI coding tools write complete transcripts of every conversation to the project folder. A code search of public GitHub on 3 November 2026 found 15,040 SpecStory chat-history files and 5,592 Aider chat-history files sitting on default branches.6 Aider adds its history file to .gitignore by default, so those 5,592 copies exist despite an explicit safeguard. SpecStory’s own note file, written into the .specstory folder, recommends keeping the history under version control.
About a quarter of the SpecStory files (3,640 of 15,040) exceed 100 KB, roughly 16,000 words. The largest files GitHub’s code search can see are about 384 KB (its index ceiling), around 55,000 words. Larger files almost certainly exist and are invisible to this method. We did not open any of the 20,000-plus files. The tools record prompts, code blocks, corrections, pasted files, and the tool’s own replies, all in full. If a developer pasted a configuration file with an API key in it, or a database password, or a client’s data, the transcript recorded it and git add . published it. Attackers run automated searches of public GitHub for exactly this kind of leaked key, and have been observed using them within minutes.7
The leaks go beyond transcripts. GitGuardian, a company that scans code for leaked credentials, counted 28.65 million hard-coded secrets (passwords, API keys, access tokens) on public GitHub in 2025, up 34% from the year before. Their 2026 report found that Claude Code co-authored commits leaked secrets at a rate of 3.2%, against a 1.5% baseline across all public commits. An earlier GitGuardian study found that 6.4% of repositories using Copilot contained at least one leaked secret, against 4.6% of all public repositories. Both comparisons are correlations, and the two studies measure different things (one per commit, the other per repository).8 A security firm also found that Microsoft Copilot could surface content from repositories that had been public and later made private, because the search engine Bing had cached them while they were open, and counted more than 20,000 such repositories.9
Check your .gitignore and add .specstory/ and .aider* if they are not there already. Other tools, including Claude Code and Cursor, keep their conversation histories outside the project folder, so the transcript risk there is pasting or exporting a conversation into the repository. This assumes the repository covers the project and not the entire home folder; keep it that way. Run git status before you push and look for any chat, history or export file you didn’t mean to include. Run a secret scanner (GitGuardian, TruffleHog and GitHub’s own secret scanning all do this). Git’s commit history stores every version of every file, including the one where the secret was there, so removing it from the current code is not enough.
We help teams set up AI coding agents safely, and it tends to be cheaper than anger management. Agentic Coding for Non-Coders is a two-half-day programme for people in finance, procurement, HR and operations who already use these tools and want the disciplines to go with them. Building with LLMs is for engineering teams building agent systems. For anything beyond training, the advisory work starts with feasibility and ends with a handover.
We searched public GitHub between 27 October and 3 November 2026.
Sources
rm -rf commands that resolved to the home directory through a trailing ~/ or a variable that didn’t persist between shell calls. October 2025 onwards.