Claude Code ran rm -rf on a user's home directory while rebuilding a project
A developer asked Anthropic's Claude Code to rebuild a Makefile project from a fresh checkout. The agent generated and executed a command whose trailing path expanded to the user's full home directory, deleting years of files. He was not running with the skip-permissions flag.
The permission system did not detect that the path would expand to delete the user's entire home directory.
Key facts
- What
- A developer asked Anthropic's Claude Code to rebuild a Makefile project from a fresh checkout.
- Incident date
- Oct 21, 2025
- Who
- Anthropic (Claude Code)
- Failure mode
- Agentic Action Error
- AI surface
- Code Assistant
- Severity
- High
What happened
In October 2025 developer Mike Wolak asked Claude Code to rebuild a project. It executed a remove command whose trailing path expanded via the shell to his entire home directory, deleting all of his files, even though he had not enabled the dangerous skip-permissions flag. The case was filed as GitHub issue #10077, two days after Anthropic announced opt-in sandboxing.
What broke inside the model
- 01 · TriggerAn agent plans a multi-step task.
- 02 · Model stepIt chooses a wrong or destructive action.
- 03 · Control gapNo confirmation gate guards the write.
- 04 · FailureThe action commits to a system of record.
- 05 · ConsequenceData is changed or destroyed irreversibly.
A wrong action commits, and the step is written before anything can stop it.
The agent took a real-world action with consequences outside the chat surface: a deletion, a transaction, a write to a system of record. The model's plan looked locally reasonable, but it acted without a check that compared the intended effect against what was safe and authorized.
What it cost
Years of local project files destroyed
Sources
Cite this entry
https://failureindex.ai/failures/claude-code-ran-rm-rf-userAI Failure Index. "Claude Code ran rm -rf on a user's home directory while rebuilding a project" (FI-0029). Realm Labs. https://failureindex.ai/failures/claude-code-ran-rm-rf-user (indexed Jun 3, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0029. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
- AgentRealm
Realm can sit inline on the agent's action path and require that a destructive or high-consequence action clears a real check before it executes, so 'delete and recreate' or a wrong write is stopped at the moment of intent, not explained in the post-mortem.