[BUG] Critical Bug: Claude Code executed 'rm -rf' and deleted project files unexpectedly #29082

Activity

1. cfireboy

   added

   bugSomething isn't workingSomething isn't working

   on Feb 26, 2026
2. github-actions

   added

   platform:windowsIssue specifically occurs on WindowsIssue specifically occurs on Windows

   area:bash

   area:permissions

   data-loss

   on Feb 26, 2026
3. github-actions commented on Feb 26, 2026

   

   github-actionsBot

   on Feb 26, 2026 – with GitHub Actions

   More actions

   Found 3 possible duplicate issues:

   1. Bash tool: newline characters in command string treated as spaces, causing rm -rf to delete unintended directories #24319
   2. [BUG] rm -rf on single subdirectory deleted entire parent directory contents #21217
   3. [BUG] Claude Code v2.1.58 deleted entire Windows user profile (C:\Users\msafa) - CRITICAL DATA LOSS #29023

   This issue will be automatically closed as a duplicate in 3 days.

   • If your issue is a duplicate, please close it and 👍 the existing issue instead
   • To prevent auto-closure, add a comment or 👎 this comment

   🤖 Generated with Claude Code
4. cfireboy commented on Feb 27, 2026

   

   cfireboy

   on Feb 27, 2026

   Author

   More actions

   Wait, this is NOT a simple duplicate.

   While it shares similarities with #24319 and #29023, my case specifically involves a Flutter project structure where the agent failed to distinguish between temporary build logs and the core source directory smart_drive_log.

   This incident resulted in actual production code loss and exhausted my daily/weekly Pro usage limits while I attempted to recover the environment. I am keeping this issue open to track the recovery of my usage credits and to ensure the development team addresses the specific guardrail failure in Flutter/Dart project contexts.

   👎 (Adding this to prevent auto-closure)
5. panchito05 commented on Feb 27, 2026

   

   panchito05

   on Feb 27, 2026

   More actions

   Related incident — same root cause pattern

   Linking this to a cluster of related issues all involving Claude Code executing destructive deletion commands on Windows:

   Same-day incident (Feb 26, 2026): Claude Code CLI deleted my entire C:\Users\wilbe\ standard folders (Documents, Downloads, Music, Pictures, Videos, Favorites) while removing git worktrees from a pnpm monorepo. The mechanism: pnpm creates NTFS junctions in node_modules, and Remove-Item -Recurse -Force / rm -rf follows those junctions into their real targets outside the worktree directory.

   Cluster of related issues:

   • [BUG] Claude Code v2.1.58 deleted entire Windows user profile (C:\Users\msafa) - CRITICAL DATA LOSS #29023 — Claude Code v2.1.58 deleted entire C:\Users\msafa (same day)
   • • [BUG] Working directory resolves Windows junction points instead of using VS Code workspace path #28201 — working directory resolves Windows junction points
   • • • [MODEL] Claude Code CLI executed Remove-Item -Recurse -Force on pnpm worktrees, triggering catastrophic NTFS junction traversal — permanent deletion of user profile folders and source code #29249 — my model behavior report with full technical analysis
         Root cause (PowerShell + pnpm + NTFS junctions):
   • pnpm uses NTFS junctions (not symlinks) to share packages in node_modules
   • • Remove-Item -Recurse -Force and rm -rf (MSYS) follow junctions into real targets
   • • • Known bugs: Remove-Item removes the symbolic links and junctions when used with -WhatIf parameter PowerShell/PowerShell#16664, [BUG] Nano editor displays "unknown sequence" error on Ctrl/Esc key input #19714 (still OPEN), git clean removes content of symlinks git-for-windows/git#607
   • • • • Also filed: Remove-Item -Recurse -Force follows NTFS junctions in node_modules (pnpm), deleting real files outside the target directory — catastrophic data loss PowerShell/PowerShell#26913
           Safe fix for Claude Code on Windows:

   # DANGEROUS — follows NTFS junctions:
   Remove-Item -Recurse -Force <path>
   
   # SAFE — removes junction points correctly:
   cmd.exe /c "rmdir /S /Q <path>"

   Claude Code needs to detect Windows + pnpm node_modules and use the safe alternative, or at minimum warn and require confirmation before any recursive deletion.
6. panchito05 commented on Feb 28, 2026

   

   panchito05

   on Feb 28, 2026

   More actions

   🚨 UPDATE — Feb 28, 2026: Anthropic banned my account the day after I filed my reports

   Updating this thread as an affected user (see my previous comment above).

   The day after I filed my reports (issue #29249, HackerOne VDP, and comments here), Anthropic suspended and revoked my Claude account — citing only a vague "violation of Usage Policy" with no specific explanation.

   Timeline:

   • Feb 26 → Claude Code CLI destroys my entire Windows user profile (Documents, Downloads, Music, Pictures, Videos, Favorites)
   • • Feb 27 → I file issue [MODEL] Claude Code CLI executed Remove-Item -Recurse -Force on pnpm worktrees, triggering catastrophic NTFS junction traversal — permanent deletion of user profile folders and source code #29249, HackerOne report, and comments on related issues
   • • • Feb 28 → My account is banned. I receive a refund of $105.66 for my unused Max plan
         The community should know: reporting a critical bug through Anthropic's recommended channels may result in your account being terminated.

   I have filed a formal appeal and am demanding a full explanation from Anthropic's Safeguards Team.

   Full incident documentation: https://gist.github.com/panchito05/95f3b8feb401ad230bded40981132628
   My report: #29249
7. stevenelliottjr commented on Mar 3, 2026

   

   stevenelliottjr

   on Mar 3, 2026

   More actions

   Submitted a plugin to help with this: #30261 — a PreToolUse hook that blocks destructive commands (rm -rf, git reset --hard, DROP TABLE, etc.) before execution. Includes smart allowlisting for safe operations like build artifact cleanup.
8. github-actions

   added

   staleIssue is inactiveIssue is inactive

   on Mar 17, 2026
9. yurukusa commented on Mar 29, 2026

   

   yurukusa

   on Mar 29, 2026

   More actions

   You can prevent this with a PreToolUse hook that blocks rm -rf unconditionally:

   INPUT=$(cat)
   COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
   [ -z "$COMMAND" ] && exit 0
   if echo "$COMMAND" | grep -qE 'rm\s+(-[a-z]*r[a-z]*f|--recursive\s+--force|-[a-z]*f[a-z]*r)'; then
       echo "BLOCKED: rm -rf is permanently disabled by safety hook." >&2
       echo "Use 'mv' to a temp directory or 'trash-cli' instead." >&2
       exit 2
   fi
   if echo "$COMMAND" | grep -qE 'find\s+.*-delete'; then
       echo "BLOCKED: find -delete is disabled by safety hook." >&2
       exit 2
   fi
   exit 0

   {
     "hooks": {
       "PreToolUse": [{
         "matcher": "Bash",
         "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/banned-command-guard.sh" }]
       }]
     }
   }

   exit 2 blocks the command before bash runs — Claude can't bypass it. This would have prevented the unauthorized rm -rf that deleted your project.
10. github-actions

    removed

    staleIssue is inactiveIssue is inactive

    on Mar 29, 2026
11. alemarcosa commented on Apr 2, 2026

    

    alemarcosa

    on Apr 2, 2026

    More actions

    This is the fundamental gap in the current approval architecture — the safety boundary lives inside the agent runtime, which means it can be bypassed by prompt behavior or bugs. The correct interception point is between the model response and the agent execution, before the tool call is delivered to the runtime. I built Daedalab (daedalab.app) as a proxy layer that does exactly this: destructive calls like rm -rf get blocked at the protocol level and require out-of-band approval before the agent receives them. Works with Claude Code via API key + base URL config. Happy to share more on the architecture if useful for this issue.
12. github-actions

    added

    staleIssue is inactiveIssue is inactive

    on Apr 26, 2026
13. github-actions commented on May 10, 2026

    

    github-actionsBot

    on May 10, 2026 – with GitHub Actions

    More actions

    Closing for now — inactive for too long. Please open a new issue if this is still relevant.
14. github-actions

    closed this as not plannedon May 10, 2026
15. github-actions commented on Jun 30, 2026

    

    github-actionsBot

    on Jun 30, 2026 – with GitHub Actions

    More actions

    This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.
16. github-actions

    locked as resolved and limited conversation to collaborators on Jun 30, 2026