Destructive Burst

Counts destructive-looking actions in a short window—not every tool call, only risky kinds (deletes, force pushes, sensitive writes, wipe-style shell).

Part of Behavior Guards. Thresholds are configurable in Console.

What it catches

• Delete tools, force / wipe shell patterns, writes to secrets-like paths
• Complements Privilege Streak (elevated rights). Sensitive writes can hit both—by design.
• Filtered content, not raw volume like Tool Storm

Example

“Clean up” a refactor → many deletes, git push --force, and cache wipes in a few minutes. Each action may pass allowlists; Destructive Burst still warns or blocks the burst.

Try it

Relay → Guards → Destructive Burst — Configure, run Sample, confirm the nested incident.