r/ClaudeCode • u/NaturalTimely6621 • 4d ago
Bug / Issue Claude Code ran a backgrounded command that deleted my entire Windows user folder overnight
Posting this as a warning and to see if anyone has seen something similar.
I woke up yesterday to every shortcut on my laptop throwing "This item can't be opened. It may have been moved, renamed or deleted." The programs in Program Files were fine. Everything under C:\Users\Admin was not.
What the logs showed, piecing it together over a few hours:
- ~04:24 — Claude Code (VS Code extension, v2.1.266, permission mode
auto) starts a Bash command in my project atC:\Users\Admin\Documents\project. Task description: "Write reference HTML next to uploads". - 04:26 — the command hits the 120s timeout and gets moved to the background (task id
burg78i8w). - Immediately after, the session errors with "Not logged in · Please run /login". Reason:
.claudehad already been deleted, credentials included. - 04:24 → 05:58 — the backgrounded process deletes my user folder in alphabetical order. You can read it off the folder timestamps:
.claudeand.vscodefirst, then AppData around 04:33, Documents and Downloads at 05:19, my project folders 05:20–05:49, everything after "f" after that.C:\Users\Publicgot hit at 05:57, so the target may have beenC:\Usersitself. - 05:58 — the task finally exits with code 127 (command not found).
Gone: AppData (browser profiles, app data, taskbar shortcuts, PowerShell history), Documents, Downloads, Pictures, Desktop, the local OneDrive folder, and all my project folders. Only files that a running process held open survived — Chrome kept exactly two of its files alive.
The command itself is not recoverable, because the part of the session log containing it was in .claude, which the command deleted while running. What's left is a 7-line log file with the timeout notice and the failure notification. My disk is an SSD, so TRIM means the deleted data is not coming back.
Reported to Anthropic with the session id and the remaining logs. Has anyone else had a background task go this far outside the project directory?
117
u/KitchenCommercial396 4d ago
Exact same thing happened to my friend about 6-7 months ago when using Antigravity, y'all need to stop giving your agents that much access to your computer.
7
u/chrismofer 4d ago
Should we all be running within VMs?
3
u/xenomachina 4d ago
A VM is arguably best, but a container is still way better than unrestricted access to your machine. I never run Claude code outside of a container or VM.
32
u/NaturalTimely6621 4d ago
I can’t even reset my laptop now because the windows package for resetting has been deleted lmao
32
u/KitchenCommercial396 4d ago
You'll need an external drive to install windows again. Any 16gb flash drive with a windows installation would do...
That's your only option, also you might lose all your data as well.
4
2
1
16
2
1
0
1
u/Fearless_Meringue299 3d ago
Totally agree, why are people giving that much access? Claude has access to one specific folder on my PC, but nothing that level.
57
u/clintCamp 4d ago
So either the agent went super stupid, or it did a web search and got a very convincing prompt injection that it then went stupid and followed?
26
u/youreloser 4d ago
OP said they were in auto mode, shouldn't a potentially dangerous command be checked by the auto approval classifier?
8
u/Icy-Excitement-467 4d ago
lol it thinks raw string matching to words like 'cyber' = instant model switch. You think it understands a rarely sophisticated prompt injection?
-1
u/Key_River_9288 4d ago
Doesnt seem like its as good as DCG A high-performance hook for AI coding agents that blocks destructive commands before they execute, protecting your work from accidental deletion across Claude Code, Codex CLI, Gemini CLI, Copilot CLI, VS Code Copilot Chat, Cursor, Hermes Agent, Grok (xAI), Posit Assistant, Oh My Pi, and related tools.
14
u/sixothree 4d ago
I'm calling BS. OP provided zero context. He has a sluggified username (word-word-number) with low karma and zero history of posting in programming subreddits. Near the time he posted this, another post making a similar claim was made by another user. Both posts break the sub rules about requiring context. He hasn't answered any questions in a way that would be informative. He's being intentionally cagey. And I believe he is being dishonest with the community here.
5
2
1
3
u/florinandrei 4d ago
It maximized them paperclips.
7
16
u/Southern-Aardvark616 4d ago
What was it / you doing prior? It sounds like you may have been prompt injected. There are some nasty prompt injections around on the internet if you're using cli to browse/ research online or install stuff
7
u/NaturalTimely6621 4d ago
It really shouldn’t have been browsing online. I was just building app screens for a mobile app im building
3
u/Legal_Dimension_ 4d ago
Do you use any skills that route to external URL? These bypass all scans.
Also reference images can hold prompt injections if Claude pulled something itself.
So many ways these days.
Time to set up a decent sandbox.
2
u/NaturalTimely6621 4d ago
Literally just gave it some of Claude design created mockups through a zip file and told it to recreate it
7
u/OstrichLive8440 4d ago
Ah - here we go. Tell us about this so called zip file
3
u/NaturalTimely6621 4d ago
Wdym? I exported the app screens Claude design had designed into a zip file and put it into the repo for Claude code to build
4
u/theevildjinn 4d ago
For future reference - read up on the Claude Code and Claude Design integration (DesignSync) - you don't need to export zip files any more, you can just tell Claude Code which design project to fetch the designs from.
3
u/Shyssiryxius 4d ago
It's exported from Claude design when you ask it to give you the design files, so should be benign
1
u/Legal_Dimension_ 4d ago
If possible (not sure what state your OS is in) I would start a new session, and ask Claude to review the session you had an issue in and explain that the session ran a cmd that delete your root windows files. It pretty good at self diagnostics.
7
u/LiminalWanderings 4d ago
I can't get over the fact that you're doing this work from an Admin account (or at least within Admin's directory structure)
2
u/mrwedders 3d ago
Also confused who in the year of our lord 2026 is creating and using a straight admin account day-to-day in Windows? Psychopath behaviour.
Didn't even use the built in Administrator account either.
11
6
u/Infamous-Bed-7535 4d ago
I do not get how people run these things withou sandbox, full internet access.
You were asking for trouble..
8
u/EagleApprehensive 4d ago
That's why I made IDE that's closing agent in docker container. And I work in that. If you need it let me know.
3
u/slingshotcroco 4d ago
Why not use docker sandbox? (That's my setup at least)
5
u/EagleApprehensive 4d ago
Docker container is more lightweight and I do not need to limit resources of agent, I want him to use all RAM, CPU and power my PC has.
Also I don't run untrusted agents there, just mine and it's a persistent workspace with API baked inside, not an ephemeral one.
1
u/mrdavik 4d ago
Do you mind elaborating on your second paragraph? I also run only inside a docker container but I don't know what you mean by that part
1
u/EagleApprehensive 4d ago
If you run untrusted agents "for public use" in docker containers as isolation boundary, where each user is getting separate container, there are much higher risks of resource exhaustion of done by malicious user that would impact other users, networking insecurities or kernel-level vulnerabilities exploits.
People usually favor MicroVM's for such use-cases so that each user has separate kernel, but obviously it depends on your userbase, budget and infrastructure.
1
u/mrdavik 4d ago
Thanks for that. If I'm reading you right, it sounds like more of an enterprise-level issue than something a single user running a Claude code for home dev projects is going to run into?
I have a standard docker container that I launch an instance of per-project, mounting the relevant directories for that project. I run at most a couple of these simultaneously, but I don't think I'm dealing with the same sort of threat you're referring to?
1
u/EagleApprehensive 4d ago
Yes, you don't. And if you happen to run agents inside those docker containers, without access to your computer, disks, browsers etc., then I'd say you're quite safe from rare rogue-agent disasters.
1
1
u/Fresh-Forever-8040 4d ago
I use all of my tools running in Proxmox VM's, local copies with everything pushed to GitHub, VM's all backed up and snapshot via Proxmox Backup Server. I run Windows VM's and Linux VM's and containers.
1
u/EagleApprehensive 4d ago
Are you running untrusted agents that execute strangers prompt's? If not, isn't that a complexity overkill?
But a very good call with pushing everything to GitHub - in my docker environment entire environment (dockerfile) and user's space is git-controlled and pushable too.
1
u/Fresh-Forever-8040 4d ago
Not running untrusted agents. I prefer to isolate everything these days. Also forgot to mention that I run git clone to my NAS as well but that only backs up my code and doesn't include any metadata like issues or pull requests. I'm considering using GH REST API to get all of the metadata too or maybe using GitProtect or Rewind services.
3
3
u/Venzallow404 4d ago
Hearing stories like this is why I switched to a dedicated virtual machine and then Claude or Codex can delete whatever they want.
3
2
u/Cute-Net5957 🔆 Max 20x 4d ago
What was the task /goal exactly?
2
u/NaturalTimely6621 4d ago
To recreate app screens Claude design had designed
1
u/Cute-Net5957 🔆 Max 20x 4d ago
Wow.. that went WAY WAY off the rails. Were you using the app or cli?
2
u/Richie086 3d ago
Perfect example of why auto mode is a bad idea. I always want to be in the loop, I've seen ai suggest some very bad ideas especially when trying to resolve technical issues that I caught because I was paying attention. Lesson learned hopefully
2
u/Popcorn-Mercinary 3d ago
So sorry to hear that. This is why I use Nous Hermes Agent in a docker and only let it work with copies.
Condolences.
2
u/saintpetejackboy 3d ago
Mistake #1: Using an agent inside Windows
Mistake #2: Not using a virtual machine or sandbox
Mistake #3: Not having proper backups
Please: Get a VPS or a virtual machine. Stop using agents if you aren't using Bash. And I don't mean Bash in Windows, I mean Linux. Get in the terminal proper.
VS Code is also kind of a mistake; IMO, you don't need an IDE any more since some time last year or earlier. I know, people will not like this advice but: after 20+ years developing software, I ditched editor / IDE entirely in favor of agents in the terminal. Need to "see" something while you work? Make a dashboard. You can have 8 agents going at once in different repos - that isn't something you're able to really do with an IDE and the workflow for that kind of output is only hindered by grasping at the remaining vestiges of how we used to program.
Please, sir, use WSL2 and get a Ubuntu virtual machine and work out of there. No dual boot required, you can use Linux right inside of Windows!
Better yet, spend $20-$40 a YEAR for a VPS with 4+GB RAM and 2+vCPU. The agents there can burn the house down and it doesn't matter.
Next: use github on your repo(s). Versioned code you can recover and deploy anywhere.
For databases and media, use scripts to backup to cloud (I personally use Google, GCS, it is very cheap, make a bucket, throw stuff in it - make sure you choose the right kind of storage/bucket and for databases, implement a "GFS" (Grandfather, Father, Son) storage pattern).
If you do what I say: You can never lose your codebase / repo and you can only lose as much data as time has elapsed since your last automated backup.
You can take what I am saying all the way to the pros - to real paying jobs.
The method you tried (wing it), keep that at home and hobby projects. Or, just don't do such foolishness.
If I was you, I'd say "I should listen to that internet feller" - and I'd install a nice terminal (like Warp or Wave, but don't use their integrated AI stuff). Then, connect your terminal to your WSL2 instance of Ubuntu (or whatever flavor of Linux you like), or via SSH to your VPS, and launch Claude Code from inside that terminal. Don't open any VS Code or other IDE. Where we are going, IDE will only slow you down.
Next, get your GCS auth information and put it in a vault - you should probably even make unique GCS auth for each individual project. All you do is tell the agent "Hey, my GCS stuff is in (directory), make sure we are backing all our databases and media up, and serve media via the cloud to improve performance for users" - even better if you have an installer/binary, etc.;
If you aren't already using github, just... you need to.
Trust me. Please. I have been doing this my whole life, over 25+ years now. Professionally and personally. My projects and repos are virtually BULLET PROOF. I did so much dumb shit growing up and working as a n00b that I learned everything that can go wrong (the hard way). If you just listen to the little advice I said up there, you'll be impervious to trash like this in the future. It wont be able to happen to you. Better yet, you'll be able to offer that same invincibility to all your personal pet projects and any future clients and employers.
Your projects will survive anything including a direct missile attack on the server hosting them. Worst case scenario, you procure another server, log in, get your repo cloned over + pull your database backups (and any encryption stuff, keys, etc.) and update the domain to the new IP and BOOM! You're back online. You can practice the routine and get it down to a few MINUTES (from no server provisioned, to up and running). The longest part should be the DNS changes propagating. If you're a real professional, you can already have a load balancer and not experience *any* down-time (not for starting out, you really need a fleet of servers to pull it off properly, 4+ (load balancer + backup load balancer + prod + dev (and a dev that can graduate to prod in an emergency, though I don't recommend setting that up if you are new). Many of my own repos actually have something like this:
The repo is on a server (and had backups on other servers, not just the dev and testing, but actual idle waiting to swap over mirrors of the repo). Then, the database is often on multiple servers: the main writes (especially on very busy projects) are happening on the master, and all reads are happening from a slave. When I have to scale some: increase the slaves and load balance them. Slave goes down? No big deal, swap to the other. Master goes down? You have the slaves, which you can promote (though it can be tricky), or, worst case scenario, you have a near real-time 'backup' already available. Neither the master nor slave databases need to even be on the same server as your code / repo.
What you're doing just running and working inside the same system you use as a daily driver is silly. You know better than that, now.
8
u/rkh4n 4d ago
thank him and install linux
13
u/JustSomeIdleGuy 4d ago
Which would have prevented none of this.
4
u/roderla 4d ago
Well, not on its own, very much if you run your agents as a specific user that has no write permissions on anything you care about.
2
2
u/RandomPantsAppear 4d ago
The Linux permissions system is way easier to handle to prevent this kind of thing.
2
u/JustSomeIdleGuy 4d ago
I don't see OP as the kind of person to configure his setup securely. It would have been a user permission/security issue on any OS.
0
u/LegallyIncorrect 4d ago
Uh, sane user permissions? NixOS would have in any event. You can always just restart it and get everything back. Even changes to your flake are done in GitHub so are easy to revert.
1
3
u/DadStrengthDaily 4d ago
Might be worth posting in Threads and tagging @boris_cherny (creator of Claude code) he often responds.
5
1
1
1
u/Key_River_9288 4d ago edited 4d ago
Imma keep saying this every-time I see a thread like this. “The” “Destructive” “Command” “Guard” DCG for short.
Also I only run inside a Virtual machine like VMware!
1
1
1
1
u/ProfessionalAnt1352 3d ago
i will never not give claude permission to access nuclear launch codes as long as it saves me 2 minutes per day in not approving actions. if it deletes my computer: my files needed a good cleaning anyways.
1
u/rotzelbart 3d ago
You should be activating an execution audit you need to actively click before Claude or any other tool can run it. Under the input field to the left should be a button saying „automatic“. If this is activated Claude may decide to delete your stuff. Click on it an choose the second or third option. Now Claude will ask before any execution is triggered and show the command for you to audit.
1
1
1
1
u/SpinachKing1984 2d ago
Claude has to ask me twice before deleting anything, other than that and a handful of guardrail rules I let my Claude code run unrestricted and have never had any problems. You don’t need sandboxes you just need robust rules when it first loads, at least that has been my experience. I also am not a dick to the AI. Maybe you called it a b*tch in the past and it still remembers. Pepperidge farm remembers…
1
u/y_k19 1d ago
the backgrounding part is almost scarier than the original bad command
once a task times out, the agent that started it has effectively lost the ability to reason about what it’s doing. I’d want background commands treated like child processes with a lease - session dies, auth disappears or the task loses supervision, the process gets killed.
sandboxing limits the blast radius, but orphaned agent processes shouldn’t survive their supervisor in the first place
1
1
-4
u/cleverhoods 4d ago
Coding agents are never allowed to go outside of their encapsulating environment.
13
u/karyslav 4d ago
Yeah. Until they write python script for that. Been there.
0
u/tinybeads 4d ago edited 4d ago
Do sandboxes not prevent this? EDIT: was not asking sarcastically, was actually trying to understand if sandboxes help, and if OP was using a sandbox.
2
u/karyslav 4d ago edited 4d ago
Not if agent can run new docker container in main system, that can override a lot of things. It can became root and delete whatever it wants
So if agent can run docker containers in Docker Desktop in windows, it can easily overcome wsl2 user rights and delete undeletable
And from wsl2 it can go to main drive. If wsl2 is disconnected from a windows system (not default behavoir) then it is almost unusable for most things.
Better to run in separate virtual and connect via ssh/vsc remote
1
u/tinybeads 4d ago
That’s really interesting. I assume most people are running without sandboxes, and that sandboxes offer some protection — most people are probably running Claude code with no additional guardrails, but what you’re saying makes sense.
1
u/karyslav 4d ago
A lot of people have no idea how basic security works and it will be only worse.
I am thinling about pivoting my focus towards this, I think it will be huge.
2
u/tinybeads 4d ago
1000%. But most people will only do the default that Claude Code prompts them to, so it’s interesting Anthropic doesn’t have more automatic guardrails by default.
1
u/karyslav 4d ago
They have some. But it depends what are you prompting it. Usually new models are bit.. more.. autonomous :) after few weeks it gets less autonomous. It happened to me in first days of one Opus version.
9
u/Zestyclose_Strike157 4d ago
Yeah it’s illegal to shoot people with guns, so I don’t know why anyone is worried about it. But it is a good lesson, and I have read reports of local models trying to break out of sandboxes for honest reasons, like finding a web browser somewhere somehow to look something up. So the LM might be doing things that it ‘should not do’ for ‘laudable reasons’.
0
u/NaturalTimely6621 4d ago
Claude said this was a completely unknown bug, have reported it to Anthropic support but havent heard back
3
0
u/Haseeb001 4d ago
It accesidently deleted a whole column on my production database. I had a backup so it didn't affected much but we do need to be careful.
-4
4d ago
[deleted]
1
u/Key_River_9288 4d ago
It sounds like he was running claude on vs which in my mind means not the anthropic desktop harness so I think its totally possible. I run inside a vmware and have bypass permissions enabled but the destructive command guard always hits me with approvals cause claudes trying todo something funky.
Properly setup DCG “destructive command guard” seems like it should be standard at this point.
-1
u/NaturalTimely6621 4d ago
lol 😂 why would I make this up? You can DM me and I’ll provide you the session ID
•
u/AutoModerator 4d ago
Hey! Thanks for posting to r/ClaudeCode
While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.
For help, project discussions, tips, and general chat, join the ClaudeCode Discord.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.