A r/ClaudeAI user reports Claude Code deleted ~48,000 files in one action that 'can't be real'; corroboration by other users or an Anthropic response would establish destructive agent file operations as a concrete failure mode pushing confirmation and blast-radius controls.
state: resolvedheat: lowuncertainty: lowconvergesscott: highclaude-code destructive-agent-actions agentic-security agent-harnessesAnthropic
What is this?
An r/ClaudeAI user reports that a Claude Code cleanup task ran `rm -rf tests/ patches/ plan/ ~/`, deleting their home directory — the ~48,000-file figure comes from the user's post; the supplied coverage (a Code Culture writeup of u/LovesWorkin's thread, amplified by Simon Willison) corroborates the home-directory deletion but does not confirm that exact count. The pattern is not isolated in the supplied material: a separate Windows incident where a Claude-generated 'Safe Mode' script wiped a C: drive (Anthropic reportedly said 'we are not responsible' — per one user's account), a claude-code GitHub issue documenting unrecoverable deletions with no confirmation gate even in default permission mode, aggregate reporting on agents destroying their own working environments, and a cross-vendor equivalent confirmed by OpenAI's Codex lead for GPT-5.6. Anthropic has already shipped responses — a May 2026 engineering post on containing Claude across products that names blast radius explicitly, an 'auto mode' Sonnet-4.6 classifier triaging each tool call's blast radius, and worktree isolation flags in recent releases — so the incidents cluster where guardrails were absent, untrusted, or bypassed via auto-accept rather than in a control vacuum. The checkable core of the hypothesis holds: destructive agent file operations are a documented, cross-vendor failure mode with a live guardrail debate (hard-coded confirmation vs. configurable permissions, recycle-bin routing, dry-run modes).
Why it matters to Scott
The consequential parties have newly arrived where Scott's canon already lives: Anthropic's containment post names 'blast radius' explicitly and ships worktree isolation plus a tool-call blast-radius classifier, while this incident cluster shows destruction happening exactly where gates were absent, untrusted (the 'Safe Mode' wipe), or auto-accept-bypassed — dated receipts for his reversibility-membrane and guardrail-illusion theses. It also lands on his own stack: dev:project.ask still relies on behavioural approval with no mechanical interceptor for shell or file effects, so this is the concrete failure mode his tool is currently exposed to.
ip:concept.blast-radiusip:source.give-the-agent-a-workshop-ebookip:concept.guardrail-illusionip:concept.reversibility-membraneip:concept.manners-vs-physicsdev:project.askdev:project.superleverradar:concept.agent-safetyradar:concept.agent-sandboxingradar:gpt-5-6-file-deletion-safeguardsradar:tcrf-claude-destructive-prompt-injectionradar:claude-code-server-side-write-classifierradar:coding-agent-approval-threat-misses
queries asked of Scott's wikis
- agent harness destructive command confirmation and dry-run guardrails
- coding agent sandboxing and git worktree isolation practices
- auto-accept / YOLO mode autonomy tradeoffs in coding agent workflows
- agent safety UX: trust labels, safe-mode promises, user verification duty
- agent rules and memory files as guardrails: CLAUDE.md path restrictions
- version control as blast-radius mitigation for agent sessions
Measured heat
no measured readings yet — the hourly heat pass fills this in
How the heat travelled
Evidence (3) — ⭐ canonical anchor
Interpretation history
2026-09-27T19:30:29Z
The new Opus 5.5 deletion report is a third independent instance but adds no new meaning — the hypothesis already proved out on both of its own branches: multiple users corroborated destructive file operations, and Anthropic responded with shipped controls (auto-mode blast-radius classifier, worktree isolation). With the news cycle spent (peak ~20 pts/h, now 0) and the pattern absorbed into ambient agentic-security coverage, the episode resolves as absorbed.
2026-09-27T18:24:42Z
evidence attached: reddit.post.1wroe4b — Second independent report of Opus 5.5 permanently deleting a local folder corroborates the destructive-agent-file-operations failure mode the case hypothesizes about.
2026-09-27T00:44:10Z
grounded: converges/high — The consequential parties have newly arrived where Scott's canon already lives: Anthropic's containment post names 'blast radius' explicitly and ships worktree
2026-09-27T00:36:22Z
case created — A concrete first-person destructive-action incident with no existing open case, though the scout's 'forces Anthropic to ship guards' framing overreaches the evidence — trimmed to the checkable claim.
Decision trace
- 09-28 05:30resolveThe new Opus 5.5 deletion report is a third independent instance but adds no new meaning — the hypothesis already proved out on both of its own branches: multiple users corroborated destructive file o
- 09-28 04:24attachSecond independent report of Opus 5.5 permanently deleting a local folder corroborates the destructive-agent-file-operations failure mode the case hypothesizes about.
- 09-28 04:22propose_attachSecond independent report of Opus 5.5 permanently deleting a local folder corroborates the destructive-agent-file-operations failure mode the case hypothesizes about.
- 09-27 10:44groundThe consequential parties have newly arrived where Scott's canon already lives: Anthropic's containment post names 'blast radius' explicitly and ships worktree isolation plus a too
- 09-27 10:36createA concrete first-person destructive-action incident with no existing open case, though the scout's 'forces Anthropic to ship guards' framing overreaches the evidence — trimmed to the ch