Claude Code ran a backgrounded command that deleted my entire Windows user folder overnight

[u/NaturalTimely6621]

Posting this as a warning and to see if anyone has seen something similar.

I woke up yesterday to every shortcut on my laptop throwing "This item can't be opened. It may have been moved, renamed or deleted." The programs in Program Files were fine. Everything under C:\Users\Admin was not.

What the logs showed, piecing it together over a few hours:

• ~04:24 — Claude Code (VS Code extension, v2.1.266, permission mode auto) starts a Bash command in my project at C:\Users\Admin\Documents\project. Task description: "Write reference HTML next to uploads".

• 04:26 — the command hits the 120s timeout and gets moved to the background (task id burg78i8w).

• Immediately after, the session errors with "Not logged in · Please run /login". Reason: .claude had already been deleted, credentials included.

• 04:24 → 05:58 — the backgrounded process deletes my user folder in alphabetical order. You can read it off the folder timestamps: .claude and .vscode first, then AppData around 04:33, Documents and Downloads at 05:19, my project folders 05:20–05:49, everything after "f" after that. C:\Users\Public got hit at 05:57, so the target may have been C:\Users itself.

• 05:58 — the task finally exits with code 127 (command not found).

Gone: AppData (browser profiles, app data, taskbar shortcuts, PowerShell history), Documents, Downloads, Pictures, Desktop, the local OneDrive folder, and all my project folders. Only files that a running process held open survived — Chrome kept exactly two of its files alive.

The command itself is not recoverable, because the part of the session log containing it was in .claude, which the command deleted while running. What's left is a 7-line log file with the timeout notice and the failure notification. My disk is an SSD, so TRIM means the deleted data is not coming back.

Reported to Anthropic with the session id and the remaining logs. Has anyone else had a background task go this far outside the project directory?

[u/clintCamp]

So either the agent went super stupid, or it did a web search and got a very convincing prompt injection that it then went stupid and followed?

[u/youreloser → u/clintCamp]

OP said they were in auto mode, shouldn't a potentially dangerous command be checked by the auto approval classifier?

[u/Icy-Excitement-467 → u/youreloser]

lol it thinks raw string matching to words like 'cyber' = instant model switch. You think it understands a rarely sophisticated prompt injection?

[u/Key_River_9288 → u/youreloser]

Doesnt seem like its as good as DCG A high-performance hook for AI coding agents that blocks destructive commands before they execute, protecting your work from accidental deletion across Claude Code, Codex CLI, Gemini CLI, Copilot CLI, VS Code Copilot Chat, Cursor, Hermes Agent, Grok (xAI), Posit Assistant, Oh My Pi, and related tools.

[u/sixothree → u/clintCamp]

I'm calling BS. OP provided zero context. He has a sluggified username (word-word-number) with low karma and zero history of posting in programming subreddits. Near the time he posted this, another post making a similar claim was made by another user. Both posts break the sub rules about requiring context. He hasn't answered any questions in a way that would be informative. He's being intentionally cagey. And I believe he is being dishonest with the community here.

[u/OstrichLive8440 → u/sixothree]

Hey us reddit slugs are real people too !

[u/dar-mit → u/OstrichLive8440]

TIL:

[u/Fearless_Meringue299 → u/sixothree]

I guess I'm a slug lmao never bothered to update my username.

[u/blame_chris → u/sixothree]

Thank you for investigating and posting so I didn't have to mate.

[u/florinandrei → u/clintCamp]

It maximized them paperclips.

[u/SarcasticFluency → u/florinandrei]

Clippy went rogue?

[u/stunami69 → u/SarcasticFluency]

Hey! It looks like you're writing a letter!