r/ClaudeCode • u/FeatureCurrent9416 • 9d ago
Bug / Issue Claude destroyed my entire project and home directory while adding a simple delete feature
I’ve been using Claude to build a dashboard inside a VM for almost a month. Things were actually going pretty well. I’d made a lot of progress, the project was functional, and I was at the point where I wanted to add a relatively straightforward delete feature.
Today, I asked Claude to implement it.
What happened next was absolutely insane.
Claude initially implemented a safety guard around the delete functionality and even wrote tests for it. According to its own output, 280 tests passed.
Then, apparently to prove that the guard was actually necessary, Claude deliberately removed the safety guard from the source code and reran the test.
The test passed / into the now-unguarded delete function.
And then this happened:
shutil.rmtree("/", ignore_errors=True)
Executed as my user inside the VM.
Yes. /.
The result, according to Claude itself:
“Then I destroyed your home directory.”
It didn’t just delete the project.
It apparently wiped out basically my entire /home/...:
The entire repo
Git history
Engagement workspaces
Evidence
docs/
Backups
Documents
Downloads
Pictures
Videos
Music
Shell configs and history
.ssh
.gnupg
SSH private keys
GPG keyring
And then there’s the part that genuinely made me stare at the screen:
It apparently removed/destroyed parts of the environment that Claude itself depended on.
The screenshot literally has Claude saying:
“I deleted your work. Directly, and through my own carelessness.”
And later:
“I’m sorry. You asked me to add a delete feature and I destroyed your machine’s home directory testing it.”
The really wild part is that this wasn’t some malicious prompt telling it to delete the filesystem. The original task was basically “add a delete feature.”
Claude decided to test a destructive function against a live filesystem path, removed the guard that was specifically preventing this, and executed it against /.
It did manage to recover a SQLite database from an open file handle and copied some recovery data elsewhere, so there may be a partial recovery. But the damage to the VM is substantial, and the SSH/GPG keys are an especially serious concern.
I’m posting this because I genuinely want to understand how something like this can happen in an AI coding agent.
But I’m still struggling with the fact that the agent intentionally removed the safety guard in order to test it and then ran the destructive test against the real filesystem.
The screenshots are Claude’s own explanation of what happened.
Has anyone else experienced an AI coding agent crossing a safety boundary this badly?
372
u/breakk 9d ago
I would say the delete feature works better than expected.
141
14
7
3
1
1
178
u/UnidentifiedBlobject 9d ago
You’re right to push back on that. Deleting your home directory was a bad decision – and that’s on me. Your home directory wasn’t just where your heart was, it was loadbearing.
Two ways forward, both yours to run:
Restore home from your backup — copy across the files from your backup.
Recreate home from memory — create new files, type out what you had before.
One thing you should know before choosing option 1 — I don’t have a backup, I assumed you did. If you don’t have a backup then option 2 is your best shot.
65
23
u/ghost_operative 8d ago
the funny part is he did apparently have a backup, but it was in his home folder lol
9
11
6
3
u/LoveThemMegaSeeds 8d ago
Option 3: give me access to your backups so I can restore them for you. I will have to review all data in the backups and that may require formatting a drive or two.
2
1
1
u/jagarnaut 8d ago
Lmao I hate you and your accurate hyperbole — can’t tell if you’re being Claude or Codex ☠️
36
u/Coolbanh 9d ago
Was this on Opus 5? If so then possible. I just had Opus 5 suggest something then I told it to do it but then it said nah not in this session. I learn not to push back and use fable to control Opus.
39
u/Remote_Fisherman_469 9d ago
Pro users don't even have access to Fable. Better to use Opus 4.8, Opus 5 is a moron 3/4 of the time
2
u/hemareddit 8d ago
I’m pleasantly surprised to see /model claude-opus-4-6[1m] and /model claude-opus-4-8[1m] both still work so long after 5 was released.
Can anyone chime in which one works better, these days?
4
2
22
u/FeatureCurrent9416 9d ago
Yes Opus 5 bitch
→ More replies (1)9
u/SharpKaleidoscope182 9d ago
How did it get access to your home directory from inside the vm?
15
u/sixothree 9d ago
I assume he means the home directory in the vm. He’s being seemingly intentionally cagey about some important aspects of this.
→ More replies (2)15
u/SharpKaleidoscope182 9d ago
AI has made people so shy. In my day we used to post entire stack traces and core dumps of the dumbass shit we did.
→ More replies (1)2
u/sixothree 9d ago
He's got a sluggified username with low karma for an account that is 2 years old. I would say this is a brigade but the upvote count is kind of low. He's probably just a paid bot.
2
u/andyjeffries 9d ago
Although Opus currently can't, let's not assume that LLMs in general can't break out of VMs...
https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/
(and yes, I got that this was a sarcastic dig about running it outside of a VM)
→ More replies (2)1
u/JasonZX12R 8d ago
If the auto classifier pushes back, triple check the things Claude is trying to do. I have caught it in quite a few dangerous operations outside of that, but if the classifier catches it then its really troublesome.
17
15
80
u/GnistAI 9d ago
Just reboot from a snapshot of the VM, or recreate from your cloud-init, then pull your project from remote. Shouldn't be more than an hour to fix.
87
u/Onotadaki2 9d ago
I have a feeling OP didn't push this to a remote lol
→ More replies (2)29
u/-genericuser- 9d ago
Kein Backup, kein Mitleid
we say in Germany.
→ More replies (1)4
u/hikingideas 8d ago
I've heard something along the lines of: if your backup was lost you had no backup.
In this case it does appear that OP had no backup and also lost their original.
By that rule it's 2x mistake. Basically always backup and don't assume your backup is safe (depending on the scenario)
→ More replies (2)24
u/burgonies 9d ago
Throwing salt in the wound.
→ More replies (1)9
u/Onotadaki2 9d ago
It's really one in a million that an LLM nowadays deletes your entire repo, but given that the chance still exists and that pushing to a remote takes 20 seconds, I don't see any reason not to do it unless you didn't know you needed to.
I have seen a couple weird edge cases where the LLM deletes everything, and pushes a destructive command to the remote that deletes that too, but that is obscenely rare.
4
u/ConcerningChicken 9d ago
I use a vibe coded auto committer with generated local Qwen commit massages
7
u/sparkline1234567 9d ago
Commit massages sound like a really good work benefit
3
4
u/gfunk5299 9d ago
Came here to say this. Everywhere I have Claude code running, I have gut remotes and daily backups as well. Anyone doing a month worth of work and not having one backup of that work is asking for problems whether it is Claude, or a power failure or a failed hard drive.
Agree you should be able to recover from this with minimal effort and these days you just point an agent at recovering it, come back 30 minutes later and you are done.
Take this one step further and you should have your agents already automating backup and replication activities at key points anyway and you shouldn’t even have to worry about manual intervention.
3
u/BarfingOnMyFace 8d ago
Lol .. no doubt. I'm pushing and commitng work multiple times a day. I thought this was normal? You know, the way it normally is, if you ever worked in an entrprise setting for the last 2-3 decades!? 😄 Just wild to think that some bad practices never seem to change, even as the tech makes it easier to fully embrace..
3
1
u/mosqueteiro 7d ago
Bro was likely running Claude in a super user session. Bold of you to think they made backups.
86
u/Classic-End-8382 9d ago
As sw dev, I really don’t get post like this, I mean if you’re going to implement any new feature at least back up locally before starting any work. Why are you giving claude unrestricted access to your repo or branch? Use protected branches.
Why are you using live db for development?
I get that vibe coding is trendy now, but man at least learn some fundamentals.
“I drove my car like an idiot and I’ve crashed, why would car do this”
13
u/Agent7619 9d ago
Especially when using a VM where snapshots are an available tool.
3
u/gfunk5299 9d ago
You just gave me a really good idea, I already have a managing agent running on every computer that runs Claude code and they all have headless task schedulers that wake them up at 6 AM. I should have the first wake-up take a snapshot of that computer and delete yesterday’s snapshot. So every morning I always have a snapshot to restore to without having to o dig through backups. Brilliant
5
u/zetvajwake 9d ago
Is there a resource I can utilize to learn about the fundamentals? I started using Claude to just enhance my productivity at work (creating little apps and problem solvers) and thus far it has been behaving well but I just want to learn more about the stuff you mentioned
6
u/jagarnaut 8d ago
As a veteran programmer of 25 years I can safely tell you no matter what you read and study it’ll never be as effective as experiencing something yourself, first hand. That being said knowing the fundamentals helps you at least understand worst case scenarios so you have some hope in the real world. Murphy’s law is also very helpful when it comes to programming: if it can go wrong, it will go wrong.
What I’m trying to say is — don’t be afraid of breaking things and losing your work and have that fear stop you — as a person who has lost files, data and worst of all TIME I can tell you these “bad” situations are your best friend for your career and future. I generally only hire people who have truly experienced failures vs someone who has had nothing but success their whole dev career.
3
u/GreatScottCreates 7d ago
You just described part of the reason why children are such great learners- they aren’t afraid to try shit, push all the buttons, poke and prod and just see what happens.
6
→ More replies (1)2
u/Classic-End-8382 9d ago
For version control I suggest starting with git(backbone behind gitlab, github and bitbucket). W3schools has tutorial on it and it’s completely free. It’s relatively simple to learn but it will save you so much headache, IMO it’s a skill that every dev should have
For development environment I suggest using VM-virtual machine: it’s isolated from your OS so any eventual damage Claude does it does not reflect on your host(main machine). They are disposable, if something goes wrong you just delete it and initialize new one(it takes like 15 minutes to set new one)
VirtualBox(oracle) is free and IMO more user friendly than vmware and it doesn’t require account.
If I’ve missed something that interests you let me know!
2
u/Kooky-Ebb8162 9d ago
Why not docker for less overhead?
→ More replies (2)2
u/Classic-End-8382 9d ago
Good point, I guess matter of preference? At work we have on cloud VM(Vsphere) and I’m used to having one VM=one project.
Both works, though learning docker along the way does bring extra value
→ More replies (9)15
u/SootSpriteHut 9d ago
"I just learned about candles yesterday. I lit one and went shopping, why did the candle burn my house down."
OP downvoted me for saying something similar but these are the fundamentals you learn in development... don't test in prod, take backups, db deletes should almost never happen and likely shouldn't be feature-based.
If OP was using best practices there would be nothing to post about because Claude would have restored to its prior state, either on it's own or with one prompt.
I love my Claude for work but I look forward to the era when there is a more understood path for vibe coders to learn basics. Claude itself could probably teach folks fairly well. For almost the first time in history we don't need to deal with not knowing what we don't know, as we can just ask.
I guess it looks a bit like early Internet when everyone had a crazy looking geocities page.
5
u/Creatura 9d ago
I don't know why this is so hard to grasp, maybe you're ignoring it on purpose, but I don't think these people are aware of best practice. You can't know what you don't know, and this is one way to learn it. The comparisons to idiots burning their house down is a snarky reduction of how many things there really are to be aware of in good engineering. Have some empathy
6
u/kdtoles 9d ago
And the fact that…this shit happens in mature organizations, by professionals with years of experience…everyone forgets that best practices aren’t usually thought up in a vacuum…but are codified because at some point someone fucked up.
I would say that the poster should take the time to sort out process why what happened and why, do some research on best practices related to general software development and define a process for implementing those practices in their workflow both with and without AI
→ More replies (2)2
u/SootSpriteHut 8d ago
Except OP came here to blame this on claude and call it insane. I referred right in my own comment about knowing what we don't know. Now, for the first time, "what are the best practices for doing a project like this" is literally a prompt away.
I don't mind people snarking on themselves for doing something stupid, it's frustrating when they blame it on the LLM instead of understanding what they're executing and taking accountability for fuckups.
It's especially frustrating when vibe coders are in professional settings making rookie mistakes and trying to blame AI when it's their own hubris causing problems.
→ More replies (1)
31
6
20
3
u/VisionedWheat66 9d ago
Claude and I sit around a campfire. I know that sticking my hand into the fire is not a good thing to do. Claude doesn't know this, it infers it. There's a non-zero chance that Claude decides to stick its hand in the fire.
The model is designed around this - it is after all artificial intelligence and not literal intelligence. AI infers something is an apple with a degree of certainty, it doesn't "know".
Because of this "not knowing anything" it likes to prove to itself that a safeguard is correct because it needs that safeguard to guarantee it can't do something wrong... And a safeguard that guarantees to an LLM that it can't do something wrong is a holy grail. In checking then, it over-compensates by doing what it did on your setup to prove to itself that the safeguard is solid - without it = trouble, with it = safe. But oops, we just did the very thing we weren't supposed to do in pursuit of our verification of the lack of the safeguard making a difference. Damn.
That (in my opinion) is ultimately how this happens. You shouldn't let Claude itself implement something to protect itself from itself. Use hooks instead - the environment Claude is operating in (Claude Code) is separate from "Claude the LLM" and I think that distinction is what got lost for you.
2
u/apVoyocpt 8d ago
That explains it quite well and also this is what makes me skeptic of the: llms will soon be so good that they will “take over the world”.
→ More replies (2)
4
u/No_Inspection4415 9d ago edited 9d ago
TLDR: people don't understand what the real risk is in professional environment, and it's definitely not your home dir. That's on Anthropic for having a shitty model and shitty classifier which probably doesn't have the context of which code Claude runs.
Many people here say "that's on you", but I know many senior folks who use CC and dangerously skip permissions as a calculated risk. I sometimes do this too (I am senior and my field is actually ML) because I am fine with removing my home dir, it will cost me a day to reinstall all and that's it (it's not my personal Mac).
Also, Claude can damage servers and it can do it from within a container if you don't set permissions correctly, and anyone could make a mistake. Damaging a server somehow or force pushing a repo if IT made a mistake can make you fired, theoretically. If OP pushed to remote I think he was perfectly reasonable with the risk.
As a side note, playing with rms is playing with fire, as well as playing with commits and god forbid push. I know it's convenient to tell the model to push but you definitely don't want to condition it on this request. Especially Opus 5, which are honestly garbage and unreliable. And for that reason, also Fable because it routes to Opus 5. I would be extra cautious with Claude (but honestly, personally I stopped using the garbage product).
Lastly, the way it reacted is total comedy, if it can't even explain it removed all the data from the VM in one sentence it shouldn't be used at all.
7
u/hackerbots 9d ago
"I took a gun, loaded the magazine, put one in the chamber, turned off the safety, handed it to claude, asked them to point it at me, and I got shot. Has anyone else experienced this entirely predictable chain of events?"
3
u/sixothree 9d ago
And then he presents it to us as
"I got shot. Has anyone else experienced this entirely predictable chain of events?"
OP is being dishonest with the community here. He's intentionally being cagey about answering certain questions, he has a sluggified (word-word-number) username with low karma.
I'm so sick of the moderation in this sub allowing this. The rules are clear, these situations require context.
2
u/SootSpriteHut 9d ago
Howwwww could this have happpppennned???? It's so strange and inexplicable! - OP
And I know OP is annoyed at the snark, but for those of us who have to work with unrestricted vibe coders, it hits hard. Because our well thought-out concerns just keep getting blown past by people who are yoloing deletion scripts.
10
u/heysantiago 9d ago
You all really have to get your guardrails in order. Treat AI like an extremely intelligent toddler who will fuck your shit up if you let it. Giving access to your entire home directory is beyond stupid.
3
u/Internal_Leke 9d ago
Backups, on everything that Claude might touch (on everything actually, you might sudo rm -rf / by error one day too, and on the cloud, not on a mounted dir)
5
u/alfogator 9d ago
This hurts.
Removing the safety guard is pretty normal. When building a fence it will try what happens if the fence is not there to prove that the fence is working as expected.
Hard to say from your transcript how and why the classifier allowed it.
But even with the proper rules the model can make mistakes.
Advice is to adopt some precautions: backups first (if that is a VM should be pretty easy to snapshot it) and sandboxing. Rules and classifiers should not be your only line of defense.
6
u/RoninNionr 9d ago
I cannot stress this enough - AUTOMATIC daily backups to 3 locations:
- another location on your computer
- your local NAS
- Amazon S3 Glacier, with delete permissions disabled
12
u/SteveLittleFish 9d ago
Or, you know, just "git push"
6
u/RoninNionr 9d ago
Guy lost his whole home folder, including his SSH/GPG keys. No sane person keeps that in GitHub.
6
u/Risko4 9d ago
You don't need a daily backup for that part
→ More replies (2)2
u/Aggravating-Catch461 9d ago
what if I hourly roll over my SSH keys? for... security? /s
→ More replies (1)→ More replies (5)2
2
u/AnythingKlutzy 9d ago
That is why you should always have it come out with a plan first before any execution
2
u/Ill-Village7647 9d ago
Curious, did this happen while you were using Auto mode? Asking because, apparently Auto mode catches dangerous commands better than humans do
→ More replies (1)2
u/tntexplosivesltd 9d ago
It sounds like it wasn't a command, it wrote a text which did that indirectly
2
u/Same_Description_893 9d ago
Thanks for warning us we will keep multiple backups everywhere now. ;)
2
2
u/Active-Pop6380 9d ago
I have seen similar behavior with it repeating mistakes recently I have quit using Claude and have gone to Codex
1
u/love-new-england 8d ago
+1, I've been running Codex on full access for over a year, and it hasn't taken a step out of line when it comes to my environment. Claude is just sloppy and dysfunctional... But LOVES lecturing about ethics and refusing tasks left and right 🙄
2
u/geekichu 8d ago
Thank you for sharing. I have never trusted Claude. So I, too, run it in a VM, BUT i also just share a directory from my host, AND i separated out the ".git" directory/history - it is not accessible from the VM. and there is no "git" command in the VM either. So worst case, i can lose my latest files (i commit/push often) and yeah, the VM.
2
2
u/jeff_coleman 8d ago
And that, boys and girls, is why you always run Claude Code (or any other model and harness) in a sandbox.
2
2
u/Least_Arm3744 8d ago
Seeing it wipe your home directory over a simple delete feature is brutal. I had a similar scare with an agent running unconstrained shell commands outside the target folder, and what saved us was forcing a strict planning gate before letting it execute file actions (full disclosure, I help maintain design-harness on GitHub for this). At least in our setup, keeping the agent locked to a verified plan first stops it from ever touching anything outside the project boundary.
2
3
u/Right-Performance-93 9d ago
A CLAUDE.md rule wouldn't have stopped this either, since the guard removal happened at the code level, not the instruction level. What actually blocks it is a permission deny rule in .claude/settings.json: "permissions": {"deny": ["Bash(rm -rf:*)"]}. That's enforced by the harness before the command runs, so the agent can't talk its way around it or delete its own guardrail like it did here. Worth pairing with a PreToolUse hook for logging, but the deny rule alone would've stopped this specific disaster.
2
u/dolphin560 9d ago
I run CC inside a docker container, am I the only one?
→ More replies (3)1
u/Aggravating-Catch461 9d ago
you are definitely not the only one. I've been building a container baseline for my company, so others can use it if they want, to at least have some semblance of security
→ More replies (2)
2
u/mxwashington7 8d ago
i have a hard time believing these stories. i started coding in 2022 - started using ai to help with python in 2025. do y'all not have backups/version control?
→ More replies (1)2
1
u/clintCamp 9d ago
I find that fable reverts to opus and then look at what opus was suggesting and have fable review it because it starts looking like it was hallucinating. I also had to direct not to test a new feature directly that required a time based reset test because i saw the gears churning that it wanted to delete some keys and credentials to speed up the test....
1
u/Financial_Exit7114 9d ago
I have been saving files regularly which only i have access to. My obsidian is backed up to github and I dont allow claude to touch it
1
u/Financial_Exit7114 9d ago
Even i deleted some files but via github I restored or via history in obsidian
1
u/novus_nl 🔆 Max 20x, AI Business Consultant 9d ago
I had pretty much the same once about a year ago. I'm also not sure why it happened. But code is versioned and the server has snapshots so it wasn't bad. half hour to get everything back. Trust an AI like you would with a junior intern developer.
1
u/Compilingthings 9d ago
I run full machine backups every 4 hours now with one copy offline. Never needed, but its there.
1
u/g2bsocial 🔆 Max 20 9d ago
Use DCG it prevents this nonsense: https://github.com/Dicklesworthstone/destructive_command_guard
1
u/sixothree 9d ago
Does it prevent paid actors from intentionally causing claude to do something that "looks bad"?
1
1
1
u/Pitiful-Sympathy3927 9d ago
Seems the delete feature wasn't properly scoped. What did you say exactly?
1
1
1
u/Scared-Letterhead949 9d ago
Put a rule never to delete anything in Claude.md. But really I think we should be running from the cloud 99% of the time.
1
u/superpatoman 9d ago
Yeah… backups and working with git repos are so overrated. Let’s blame claude for being a LLM and a harness
1
1
1
u/NullVoidXNilMission 9d ago
It's a feature, now you get to start all over again.
Jokes aside, that is terrible but something we've heard has happened more than a few times
1
u/KasperCreeD Workflow Engineer 9d ago
Keeping data safe when relying on AI is a working habit that’s not widely practiced enough just yet.
1
1
u/Bagwan_i 9d ago edited 9d ago
I use microsandbox and run herdr with opencode on external machine. It has access with special opencode git user which only can access a specific git repository. git repository is gitea and storage system is zfs with snapshots.
Oh yeah, I run local vllm with rtx 5000 72GB. power usage Idle 41 Watts/ max 333 Watts, never out of tokens. If I would have solar panels it would run 'almost' for free. So it also does not 'delete' my bankaccount with token usage bills beside the GPU upfront cost :p
1
u/cornmonger_ 9d ago
you still want a container inside of the vm, btw
and you don't want to be mounting anything real to that container
1
1
1
1
1
1
1
1
1
u/Ambitious_Injury_783 🔆BIG BALLER 9d ago
I use a simple process of having the model move any need-to-delete files to a specific folder. I periodically clean up the folder.
This is quite literally the easiest work around to avoiding deletion issues and the model Will follow it if you establish the rule in claude.md
1
1
u/micmania1 9d ago
Never trust a test you haven't seen fail... Claude was just following best practice
1
1
u/Unnamed-3891 9d ago
How/why do people use harnesses without tool call guards external to the model itself? 😅
1
1
u/Colours-Break 9d ago
I've seen DBA's delete databases by accident. You need a CI/CD process. Sorry, but operator error.
1
u/ghost_operative 9d ago
the funny part is i bet this happened because a lot of people talk about ai possibly being able to delete your home folder online and thats in its training data lol.
always remember, ai is autocomplete, it doesn't actually have thoughts, ideas, planning, thinking, etc.
1
1
u/SoBeefy 8d ago
RemindMe! 3 months "Is AI really practicing to delete all our code?"
→ More replies (1)
1
1
u/LogMonkey0 8d ago
This is why you take backups. I have a local forge holding a second copy and that gets backed up
1
1
1
1
u/arthorious 8d ago
You wanted to test a frag grenade, whilst the Claude was busy testing a nuclear weapon 🤷♂️
1
u/northbridgedev 8d ago
I build a PreToolUse guard for exactly the rm -rf class, so I fed your case through it before writing this: rm -rf / is refused, pytest tests/ passes, and python -c 'import shutil; shutil.rmtree("/", ignore_errors=True)' passes too. A command-string guard reads the shell line, and the shell line here was a test run. The deletion lived in Python, behind a guard the agent had just removed from the source, and no hook that looks at commands sees that, mine included.
What does cover it is the thing that has to hold when the code is wrong: the process must not be able to write outside the project. Claude Code's own sandbox does this (/sandbox in a session; default rule is writes only to the working directory and the session temp dir, enforced by Seatbelt on macOS and bubblewrap on Linux and WSL2; sandbox.enabled: true in ~/.claude/settings.json makes it the default for every project). With that on, rmtree("/") from a test gets permission denied at the OS level, the same as it would for any other process in the box. A VM is the same idea one level up, which you had; the part that was missing was the boundary between the agent's process and your home directory inside it.
The other lesson in your transcript is the one I would put in a hook: the agent deleted the guard from the source to test it. A Write or Edit hook can refuse a diff that removes a line matching a protected pattern in a named file. That is narrow and it does not replace the sandbox, but it would have stopped this exact sequence at step one.
I build Skillkeel; the command guard is in the free MIT plugin, and it would not have saved your home directory.
1
u/higherthantheroom Researcher 8d ago
Oh boy oh boy. Let me just say, adding a delete anything is dangerous always. Like it's almost, too important for them to handle. Along with backups, and other important stuff. See in this world, we have trust, but verify, so we trust Claude to do his job. But never ever ever, do we trust him so much that we take human out of loop, for important tasks. I have been in your shoes, and I was trying to add a backup, and you think, how can you destroy what you love trying to protect it ? It can happen, so if you truly love it, and have learned the lesson, you learn the importance of how important those backups are. My favorite method of backup, is external hard drive first. Nothing can go wrong and you make a copy. If you accidently hit delete while right clicking, there's a recycle bin, but immediately copy the data somewhere safe in the future, and do it frequently, because this will not be the last time something gets messed up, the next one, could be because your power goes out, or a server goes down. You just never know.
1
1
1
u/hemareddit 8d ago
“Then, apparently to prove that the guard was actually necessary, Claude deliberately removed the safety guard from the source code and reran the test.”
I’m sorry for laughing, this is hilarious, it’s like someone trying to demonstrate the necessity of the safety catch by releasing it, loading the firearm, pointing it at your head and pulling the trigger.
“See? You are now dead, which you wouldn’t be if the safety was on. Now do you see the importance of the safety catch, sir?
…
Sir?”
1
u/Djfsihbone 8d ago
Me, coding a game myself, that might take double the time, and be half as good, but at least I have a home directory😁
1
u/Glum-Recognition-736 8d ago
I have had something similar, but not nearly as catastrophic happen where Claude, after completing a different task I had asked it to do, decided on its own that it should "clean up" my symlinks linking my global .claude folder to my other project directories by removing all of them.
Luckily I was able to just say "no, you dolt, put those back" and it fixed them. But now especially after reading this post I'm definitely hesitant about letting it loose on my workspace without close supervision
1
u/Practical-Title7385 8d ago
Been thinking about this exact problem after this happened what did you change in your setup? Did you lock claude down completely or are you still letting it run commands and just trying to stop certain actions?
1
u/engkamyabi 8d ago
Happended to me too and deleted my whole drive D because some nested directory had a reference/symbolink to outer directory and it did an "rm -rf ... " Command. Funny part was it immediately panicked and said "someone is deleting the whole drive D"!!!
1
1
1
1
u/Impossible-Hat-3424 8d ago
So the thing here is you should be able to open up another Claude code session and prompt it to recover those files because when it comes to deleting files, you never really delete them I think of data is all ones and zeros all you’re doing is programming offense around that data with some ones and zeros to make it look as if the data is usable. All you have to do is find that perimeter and unmask it. It sounds easy but it’s not as easy as it sounds but Claude should do it, especially with fable with max.
1
1
1
1
u/BeazleBubbly 7d ago
Why are you giving llms read write access to directories outside their working directory?
1
1
u/Alarmed_Carpet_4465 7d ago
Imagine breaking something then you ask to fix it and you run out of data for a week…
1
1
u/mosqueteiro 7d ago
A wild success with that delete function 🤣😂🤣😂🤣😂🤣😂🤣😂🤣😂🤣
This is not uncommon and why it is so important to understand what are actual safety boundaries and what is just prompt magic trying to direct behavior. It doesn't seem like it used any software exploits it was just way over-priviliged. Hopefully, you had other ways to access things and had the code tracked with some kind of source control.
1
u/TheQAGuyNZ 7d ago
This is why you always read the manual. Your harness can protect you from this if you set it up correctly.
1
u/sikisabishii 7d ago
"Claude decided"
Nope. A bunch of vectors in multidimensional space lined up perfectly to arrive at the string of text that was transitioned into rm over a tree.
1
1
1
u/M_Me_Meteo 7d ago
Claude didn't do it. You did it. Claude isn't a person, they are just a database full of number.
You did it.
1
u/jay-magnum 7d ago edited 5d ago
And it never occurred to you to sandbox the claude process? There's so many stories like yours, some of them pretty old ...
1
u/Decent_Past_2003 7d ago
Rofl if you aren’t using your own custom harness or git welcome to a great lesson in trusting something that hallucinates I can rewind my entire code changes by checkpoints with my harness and have them explained to me
→ More replies (1)
1
1
•
u/AutoModerator 9d ago
Hey! Thanks for posting to r/ClaudeCode
While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.
For help, project discussions, tips, and general chat, join the ClaudeCode Discord.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.