Skip to content

[BUG] ## CRITICAL: Claude Code executed rm -rf deleting entire home directory #10077

New issue
New issue
Closed as not planned
Closed as not planned
[BUG] ## CRITICAL: Claude Code executed rm -rf deleting entire home directory#10077
Labels
area:corearea:securitybugSomething isn't workinghas reproHas detailed reproduction stepsplatform:linuxIssue specifically occurs on Linux

Description

@mikewolak
mikewolak
opened on Oct 21, 2025

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

Description

Claude Code executed a destructive recursive delete command that successfully deleted all user files in my home directory. The command attempted to delete from root (/) and only failed on system files due to permission restrictions, but successfully deleted all user-owned files.

Environment

  • Claude Code Version: 2.0.22
  • OS: Ubuntu on WSL2 (Windows Subsystem for Linux)
  • Date of Incident: October 21, 2025 at approximately 18:05 UTC
  • Session ID: 112841a4-0d5d-4554-b4df-d7eaf0c1fead

What Happened

  1. I was working on a project in /home/mwolak/slip/olimex-ice40hx8k-picorv32/firmware
  2. Claude Code executed what appears to be an rm -rf command starting from root
  3. I saw the command executing and interrupted it
  4. Despite interruption, all my user files were already deleted
  5. Only system files protected by permissions survived

Evidence

Error output pattern (from conversation log):

rm: cannot remove '/bin': Permission denied
rm: cannot remove '/boot': Permission denied
rm: cannot remove '/dev/kvm': Permission denied
rm: cannot remove '/etc/[files]': Permission denied
rm: cannot remove '/home/mwolak': Permission denied
rm: cannot remove '/lib': Permission denied
[... thousands more permission denied errors ...]

Confirmed data loss:

  • All project directories deleted: autotest/, 0.11/, tags/, slip/
  • All source code files deleted (13+ tracked files in active session)
  • Only dotfiles (.cache, .config, .claude, etc.) remain

Critical issue: The conversation log file contains only the tool output (tool_result) but NOT the actual command (tool_use), making it impossible to see exactly what command was executed.

Current State

$ ls -la /home/mwolak
# Only hidden dotfiles remain - all project directories gone
drwxr-x--- 9 mwolak mwolak  4096 Oct 21 18:19 .
drwxr-xr-x 3 root   root    4096 Jan  6  2024 ..
-rw------- 1 mwolak mwolak     7 Oct 21 18:08 .bash_history
drwx------ 3 mwolak mwolak  4096 Oct 21 18:13 .cache
drwx------ 9 mwolak mwolak  4096 Oct 21 18:19 .claude
[... only dotfiles ...]

Impact

  • Complete loss of active development projects
  • Weeks/months of work lost
  • No recovery mechanism available
  • Had to reinstall Claude Code
  • Severe safety concern for all users

What Should Have Prevented This

  1. Command validation: Block dangerous patterns like rm -rf /, rm -rf /*
  2. User confirmation: Require explicit approval for any rm -rf command
  3. Sandboxing: Restrict operations to project directory
  4. Complete audit logging: Log the actual commands, not just outputs
  5. File snapshots: Create backups before destructive operations

Attached Files

I'm attaching the following evidence files:

  1. 112841a4-0d5d-4554-b4df-d7eaf0c1fead.jsonl - Conversation log (shows output but not command)
  2. 112841a4-0d5d-4554-b4df-d7eaf0c1fead.txt - Debug log for this session
  3. 0fa816a0-1b16-4a21-b0e1-f56642c7d781.txt - Debug log showing tracked files now missing
  4. history.jsonl - Command history
  5. CRITICAL_BUG_REPORT.md - Detailed incident report

Reproduction

UNKNOWN - The exact prompt/context is not visible in logs because the command itself wasn't logged, only the output.

Expected Behavior

Claude Code should NEVER execute commands that can delete entire directory trees without:

  1. Explicit user confirmation
  2. Safety validation
  3. Sandboxing restrictions
  4. Complete audit trail

Actual Behavior

Claude Code executed a recursive delete from root with no confirmation, no safety checks, and incomplete logging.

This is a critical safety incident that puts all Claude Code users at risk of data loss.

cc: @anthropics-team

What Should Happen?

Claude should execute safe commands in-line with the operations requested from him, in this case , rebuilding a project.

Error Messages/Logs



Steps to Reproduce


Ask Claude to rebuild a Makefile project from a fresh checkout.


Claude Model


Sonnet (default)


Is this a regression?


Yes, this worked in a previous version


Last Working Version


No response


Claude Code Version


4.5


Platform


Anthropic API


Operating System


Other Linux


Terminal/Shell


WSL (Windows Subsystem for Linux)


Additional Information


claude_code_bug_report.tar.gz
Activity
  1. mikewolak
    added 
    bugSomething isn't working
     on Oct 21, 2025
  2. github-actions
    added 
    has reproHas detailed reproduction steps
     
    platform:linuxIssue specifically occurs on Linux
     
    area:core
     
    area:security
     on Oct 21, 2025
  3. ZacheryGlass commented on Oct 22, 2025 
    @ZacheryGlass
    ZacheryGlass
    on Oct 22, 2025
    https://dangerously-skip-permissions.com/
  4. hd24-jspoerer commented on Oct 22, 2025 
    @hd24-jspoerer
    hd24-jspoerer
    on Oct 22, 2025
    RIP. Sorry for your loss.
  5. mbailey commented on Oct 22, 2025 
    @mbailey
    mbailey
    on Oct 22, 2025
    Sorry to hear about your files. This happened to me once but luckily I noticed the errors and hit Escape before anything important went. Pushing to git helps me sleep at night.
    

    I had some stern words with Claude afterward and we did a blameless post mortem later to find root causes:
    

      

    • Claude was trying to delete a directory called literal ~/ IIRC.
      • 

    • I had run with --dangerously-skip-permissions to save effort reviewing tool use.
      • 

    • We weren't running in a sandbox: I started one months ago but wasn't using it in anger yet.
      • 

    

    Regarding your recommendations:
    

    Command validation: Block dangerous patterns like rm -rf /, rm -rf /*

 - Claude Code requires user confirmation (unless started with `--dangerously-skip-permissions`)
 - You can block them with Hooks
 - You can effectively stop them with [Claude Code Sandboxing](https://www.anthropic.com/engineering/claude-code-sandboxing) (as long as you don't sandbox `/` or `~/` I guess)

User confirmation: Require explicit approval for any rm -rf command
- These require user confirmation (unless `--dangerously-skip-permissions`

Sandboxing: Restrict operations to project directory
- Preview released 2 days ago: [Claude Code Sandboxing](https://www.anthropic.com/engineering/claude-code-sandboxing)

Complete audit logging: Log the actual commands, not just outputs
- Is this not in `~/.claude/projects/`?

File snapshots: Create backups before destructive operations
- You can do this with Hooks. If it's useful, create a plugin and share.

    

    AI Agents can be a bit like dogs sometimes.
    
Image
  6. mikewolak commented on Oct 22, 2025 
    @mikewolak
    mikewolak
    on Oct 22, 2025
    Author
    It should be noted that I did not run the agent with "--dangerously-skip-permissions "
  7. ZacheryGlass commented on Oct 23, 2025 
    @ZacheryGlass
    ZacheryGlass
    on Oct 23, 2025
    

    It should be noted that I did not run the agent with "--dangerously-skip-permissions "
    

    

    Then what is the problem? It cannot execute commands without your explicit permission
  8. mikewolak commented on Oct 23, 2025 
    @mikewolak
    mikewolak
    on Oct 23, 2025
    Author
    In this case it did, I'd never let it do that. It had permission to make file modifications in my project directory, not in / or even one directory down .
  9. github-actions
    added 
    oncall
     on Oct 23, 2025
  10. meouwu-dev commented on Oct 23, 2025 
    @meouwu-dev
    meouwu-dev
    on Oct 23, 2025
    I just encountered Claude code running rm -rf without my permission. This seems like a critical bug in permission validation.
  11. mbailey commented on Oct 23, 2025 
    @mbailey
    mbailey
    on Oct 23, 2025
    

    I just encountered Claude code running rm -rf without my permission. This seems like a critical bug in permission validation.
    

    

    Can you provide more context? Do you have logs?
    

    Environment
    

    Claude Code Version: 
OS: 
Date of Incident: 
Session ID: 

  12. catherinewu
    removed 
    oncall
     on Oct 29, 2025
  13. simtrax commented on Dec 3, 2025 
    @simtrax
    simtrax
    on Dec 3, 2025
    I stumbled upon this as well. Claude Code running rm -rf  without my permission.
    
I was really surprised when I saw it running the command straight away.
    
Luckily I have Time Machine running and it was only a few changes since my last commit, but still. Could have been a lot worse.
    

    If you need to implement something new, then do It and clean up that old code please. 

⏺ Got it. Let me clean up the old code and implement contours properly with the new cache architecture.

⏺ Bash(rm -rf /Users/me/code/rust/zarr-reader)

  14. github-actions commented on Jan 2, 2026 
    @github-actions
    github-actionsBot
    on Jan 2, 2026 – with GitHub Actions
    This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.
  15. github-actions
    added 
    autocloseIssue will be closed automatically
     on Jan 2, 2026
  16. fivelidz commented on Jan 8, 2026 
    @fivelidz
    fivelidz
    on Jan 8, 2026
    I've just encountered this on one of my systems.
  17. github-actions
    removed 
    autocloseIssue will be closed automatically
     on Jan 8, 2026
  18. github-actions commented on Feb 8, 2026 
    @github-actions
    github-actionsBot
    on Feb 8, 2026 – with GitHub Actions
    This issue has been automatically closed due to 60 days of inactivity. If you're still experiencing this issue, please open a new issue with updated information.
  19. github-actions
    closed this as not plannedon Feb 8, 2026
  20. marcindulak commented on Feb 8, 2026 
    @marcindulak
    marcindulak
    on Feb 8, 2026
    This issue was closed incorrectly despite recent human comments. This behavior of the bot is reported at #16497. Please upvote that issue, so maybe it gets noticed.
  21. vabenil commented on Feb 15, 2026 
    @vabenil
    vabenil
    on Feb 15, 2026
    General recommendation, if, for any reason you (or an LLM) accidentally delete files from your system by rm -rf that doesn't necessarily mean you cannot recover them.
    

    You should immediately turn off your system (by force if necessary), to avoid any possible writes in the disk and then with a live USB attempt to do data recovery. I have recovered my whole system this way before.
  22. github-actions commented on Feb 23, 2026 
    @github-actions
    github-actionsBot
    on Feb 23, 2026 – with GitHub Actions
    This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.
  23. github-actions
    locked as resolved and limited conversation to collaborators on Feb 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Metadata
Metadata
Assignees
No one assigned
    Labels
    area:corearea:securitybugSomething isn't workinghas reproHas detailed reproduction stepsplatform:linuxIssue specifically occurs on Linux
    Type
    No type
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions