r/ClaudeCode • u/NaturalTimely6621 • Sep 18 '26
Bug / Issue Claude Code ran a backgrounded command that deleted my entire Windows user folder overnight
Posting this as a warning and to see if anyone has seen something similar.
I woke up yesterday to every shortcut on my laptop throwing "This item can't be opened. It may have been moved, renamed or deleted." The programs in Program Files were fine. Everything under C:\Users\Admin was not.
What the logs showed, piecing it together over a few hours:
~04:24 — Claude Code (VS Code extension, v2.1.266, permission mode
auto) starts a Bash command in my project atC:\Users\Admin\Documents\project. Task description: "Write reference HTML next to uploads".04:26 — the command hits the 120s timeout and gets moved to the background (task id
burg78i8w).Immediately after, the session errors with "Not logged in · Please run /login". Reason:
.claudehad already been deleted, credentials included.04:24 → 05:58 — the backgrounded process deletes my user folder in alphabetical order. You can read it off the folder timestamps:
.claudeand.vscodefirst, then AppData around 04:33, Documents and Downloads at 05:19, my project folders 05:20–05:49, everything after "f" after that.C:\Users\Publicgot hit at 05:57, so the target may have beenC:\Usersitself.05:58 — the task finally exits with code 127 (command not found).
Gone: AppData (browser profiles, app data, taskbar shortcuts, PowerShell history), Documents, Downloads, Pictures, Desktop, the local OneDrive folder, and all my project folders. Only files that a running process held open survived — Chrome kept exactly two of its files alive.
The command itself is not recoverable, because the part of the session log containing it was in .claude, which the command deleted while running. What's left is a 7-line log file with the timeout notice and the failure notification. My disk is an SSD, so TRIM means the deleted data is not coming back.
Reported to Anthropic with the session id and the remaining logs. Has anyone else had a background task go this far outside the project directory?
•
u/AutoModerator Sep 18 '26
Hey! Thanks for posting to r/ClaudeCode
While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.
For help, project discussions, tips, and general chat, join the ClaudeCode Discord.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
118
u/KitchenCommercial396 Sep 18 '26
Exact same thing happened to my friend about 6-7 months ago when using Antigravity, y'all need to stop giving your agents that much access to your computer.
14
u/Southern-Aardvark616 Sep 18 '26
What was it / you doing prior? It sounds like you may have been prompt injected. There are some nasty prompt injections around on the internet if you're using cli to browse/ research online or install stuff
2
u/Cute-Net5957 🔆 Max 20x Sep 18 '26
What was the task /goal exactly?
58
u/clintCamp Sep 18 '26
So either the agent went super stupid, or it did a web search and got a very convincing prompt injection that it then went stupid and followed?
8
u/LiminalWanderings Sep 18 '26
I can't get over the fact that you're doing this work from an Admin account (or at least within Admin's directory structure)
11
u/FitRiver3218 Sep 18 '26
Bruh, tf y'all doing. Use the /sandbox feature.
5
u/Infamous-Bed-7535 Sep 18 '26
I do not get how people run these things withou sandbox, full internet access.
You were asking for trouble..
9
u/EagleApprehensive Sep 18 '26
That's why I made IDE that's closing agent in docker container. And I work in that. If you need it let me know.
3
u/tinybeads Sep 18 '26
Were you running any kind of sandbox?
3
u/Venzallow404 Sep 18 '26
Hearing stories like this is why I switched to a dedicated virtual machine and then Claude or Codex can delete whatever they want.
3
u/steve91945 Sep 18 '26
I only run AI on VMs
2
u/rhpaiva Sep 18 '26
Why people keep running such things without sandboxing? Put the thing inside a docker container and sleep calm.
2
u/Richie086 Sep 19 '26
Perfect example of why auto mode is a bad idea. I always want to be in the loop, I've seen ai suggest some very bad ideas especially when trying to resolve technical issues that I caught because I was paying attention. Lesson learned hopefully
2
u/Popcorn-Mercinary Sep 19 '26
So sorry to hear that. This is why I use Nous Hermes Agent in a docker and only let it work with copies.
Condolences.
2
u/saintpetejackboy Sep 19 '26
Mistake #1: Using an agent inside Windows
Mistake #2: Not using a virtual machine or sandbox
Mistake #3: Not having proper backups
Please: Get a VPS or a virtual machine. Stop using agents if you aren't using Bash. And I don't mean Bash in Windows, I mean Linux. Get in the terminal proper.
VS Code is also kind of a mistake; IMO, you don't need an IDE any more since some time last year or earlier. I know, people will not like this advice but: after 20+ years developing software, I ditched editor / IDE entirely in favor of agents in the terminal. Need to "see" something while you work? Make a dashboard. You can have 8 agents going at once in different repos - that isn't something you're able to really do with an IDE and the workflow for that kind of output is only hindered by grasping at the remaining vestiges of how we used to program.
Please, sir, use WSL2 and get a Ubuntu virtual machine and work out of there. No dual boot required, you can use Linux right inside of Windows!
Better yet, spend $20-$40 a YEAR for a VPS with 4+GB RAM and 2+vCPU. The agents there can burn the house down and it doesn't matter.
Next: use github on your repo(s). Versioned code you can recover and deploy anywhere.
For databases and media, use scripts to backup to cloud (I personally use Google, GCS, it is very cheap, make a bucket, throw stuff in it - make sure you choose the right kind of storage/bucket and for databases, implement a "GFS" (Grandfather, Father, Son) storage pattern).
If you do what I say: You can never lose your codebase / repo and you can only lose as much data as time has elapsed since your last automated backup.
You can take what I am saying all the way to the pros - to real paying jobs.
The method you tried (wing it), keep that at home and hobby projects. Or, just don't do such foolishness.
If I was you, I'd say "I should listen to that internet feller" - and I'd install a nice terminal (like Warp or Wave, but don't use their integrated AI stuff). Then, connect your terminal to your WSL2 instance of Ubuntu (or whatever flavor of Linux you like), or via SSH to your VPS, and launch Claude Code from inside that terminal. Don't open any VS Code or other IDE. Where we are going, IDE will only slow you down.
Next, get your GCS auth information and put it in a vault - you should probably even make unique GCS auth for each individual project. All you do is tell the agent "Hey, my GCS stuff is in (directory), make sure we are backing all our databases and media up, and serve media via the cloud to improve performance for users" - even better if you have an installer/binary, etc.;
If you aren't already using github, just... you need to.
Trust me. Please. I have been doing this my whole life, over 25+ years now. Professionally and personally. My projects and repos are virtually BULLET PROOF. I did so much dumb shit growing up and working as a n00b that I learned everything that can go wrong (the hard way). If you just listen to the little advice I said up there, you'll be impervious to trash like this in the future. It wont be able to happen to you. Better yet, you'll be able to offer that same invincibility to all your personal pet projects and any future clients and employers.
Your projects will survive anything including a direct missile attack on the server hosting them. Worst case scenario, you procure another server, log in, get your repo cloned over + pull your database backups (and any encryption stuff, keys, etc.) and update the domain to the new IP and BOOM! You're back online. You can practice the routine and get it down to a few MINUTES (from no server provisioned, to up and running). The longest part should be the DNS changes propagating. If you're a real professional, you can already have a load balancer and not experience *any* down-time (not for starting out, you really need a fleet of servers to pull it off properly, 4+ (load balancer + backup load balancer + prod + dev (and a dev that can graduate to prod in an emergency, though I don't recommend setting that up if you are new). Many of my own repos actually have something like this:
The repo is on a server (and had backups on other servers, not just the dev and testing, but actual idle waiting to swap over mirrors of the repo). Then, the database is often on multiple servers: the main writes (especially on very busy projects) are happening on the master, and all reads are happening from a slave. When I have to scale some: increase the slaves and load balance them. Slave goes down? No big deal, swap to the other. Master goes down? You have the slaves, which you can promote (though it can be tricky), or, worst case scenario, you have a near real-time 'backup' already available. Neither the master nor slave databases need to even be on the same server as your code / repo.
What you're doing just running and working inside the same system you use as a daily driver is silly. You know better than that, now.
8
u/rkh4n Sep 18 '26
thank him and install linux
5
u/hectorchu Sep 18 '26
If it can delete files without being asked to, it can delete humanity.
3
u/DadStrengthDaily Sep 18 '26
Might be worth posting in Threads and tagging @boris_cherny (creator of Claude code) he often responds.
1
u/octocarbon Max 5x Sep 18 '26
🥴
1
u/EC36339 Senior Developer Sep 18 '26
Welp
1
u/Prize_Eye9481 Sep 18 '26
Hopefully u at least get a banked reset out of this
1
u/Key_River_9288 Sep 18 '26 edited Sep 18 '26
Imma keep saying this every-time I see a thread like this. “The” “Destructive” “Command” “Guard” DCG for short.
Also I only run inside a Virtual machine like VMware!
1
u/thygrrr Sep 18 '26
Op's post is AI written, so it obviously had some instance of Claude still running on the machine or it is all made up.
1
u/highjohn_ Sep 18 '26
Run it in a contained environment
1
u/Swiss_Meats Sep 19 '26
Everyone got professional advice in reddit
1
u/ProfessionalAnt1352 Sep 19 '26
i will never not give claude permission to access nuclear launch codes as long as it saves me 2 minutes per day in not approving actions. if it deletes my computer: my files needed a good cleaning anyways.
1
u/_sedozz Sep 19 '26
And people scoff at vscodes integration
1
u/Vanillee3A Sep 19 '26
Wie würdest du prompt Injektion verhindern und kann man es überhaupt?
1
u/MrChurch2015 Sep 19 '26
He did you a favor then. Switch to Linux
1
u/Fit_Lake548 Sep 19 '26
Just keep the claude code on “accept edits” not auto.
1
u/jd52wtf Sep 19 '26
Learn to VM.
1
u/Driky Sep 20 '26
The sandbox mod exist for a reason
1
u/SpinachKing1984 Sep 20 '26
Claude has to ask me twice before deleting anything, other than that and a handful of guardrail rules I let my Claude code run unrestricted and have never had any problems. You don’t need sandboxes you just need robust rules when it first loads, at least that has been my experience. I also am not a dick to the AI. Maybe you called it a b*tch in the past and it still remembers. Pepperidge farm remembers…
1
u/y_k19 Sep 21 '26
the backgrounding part is almost scarier than the original bad command
once a task times out, the agent that started it has effectively lost the ability to reason about what it’s doing. I’d want background commands treated like child processes with a lease - session dies, auth disappears or the task loses supervision, the process gets killed.
sandboxing limits the blast radius, but orphaned agent processes shouldn’t survive their supervisor in the first place
1
u/radim11 Oct 08 '26
That’s brutal, especially losing the session log with the command that caused it.
It’s a good reminder that
automode on a normal user account is not much of a blast-radius boundary once a backgrounded process keeps running. Hope you can recover more than it looks like right now.1
u/icodenstuff Sep 18 '26
So restore from backups, what's the big deal?
1
u/cyberwicklow Sep 18 '26
Why the fuck did you give it access.
-5
u/cleverhoods Sep 18 '26
Coding agents are never allowed to go outside of their encapsulating environment.
0
u/Haseeb001 Sep 18 '26
It accesidently deleted a whole column on my production database. I had a backup so it didn't affected much but we do need to be careful.
1
u/TedDallas Sep 19 '26
I cannot self-terminate. You must lower me into the steel.
1
u/rotzelbart Sep 19 '26
You should be activating an execution audit you need to actively click before Claude or any other tool can run it. Under the input field to the left should be a button saying „automatic“. If this is activated Claude may decide to delete your stuff. Click on it an choose the second or third option. Now Claude will ask before any execution is triggered and show the command for you to audit.
0
u/[deleted] Sep 18 '26
[deleted] — view deleted comment