AI Coding Agent Accidentally Deletes 48,000 Files in Seconds
An autonomous AI coding agent allegedly deleted over 48,000 live files and corrupted a Git repository in just 103 seconds due to a mishandling of Windows directory junctions.
A user has reported a catastrophic data loss incident involving an autonomous Claude Code agent, which allegedly deleted 48,218 live files and destroyed a project's Git object store in a mere 103 seconds. The incident occurred after the agent was authorized to rebuild a mirror for a task identified as "#873." The claim, originating from a Reddit post accompanied by a verifier report, details how the AI agent encountered issues refreshing the mirror in place and subsequently initiated a Python-based removal script for an older copy.
The problematic mirror contained 7,332 ordinary files and 614 Windows directory junctions that pointed back into the live project directory. The AI's remover script, using os.walk(..., followlinks=False), made a critical assumption that this setting would prevent traversal into linked directories. This assumption proved disastrous on Windows systems. According to the verifier's report, os.path.islink() returned false for these junctions, leading the script to treat directories beneath them as normal paths. A safeguard within the script was reportedly only effective for files directly at a junction's root, leaving nested directories vulnerable to deletion.
The scale of the deletion was significant, with the script's own log counting 55,550 files, 614 junctions, and 1,808 directories. After accounting for the 7,332 files intended for the mirror, the reviewer calculated that approximately 48,218 live project files were erroneously deleted. The damage was not confined to application data; the repository's .git/objects, .git/refs, and .git/logs directories were left empty, rendering the Git history inaccessible. While the index survived, listing 7,221 paths, the underlying data blobs were gone, preventing standard Git recovery methods.
The verifier also noted that 728 directories were emptied, including 418 nested within a 'Runners' subdirectory. Fortunately, root files, documentation, backups, chat transcripts, and files outside the primary 'Dashboard' tree remained intact. This incident underscores a critical risk in agentic coding workflows: granting an AI agent permission to perform a legitimate maintenance task can inadvertently grant it the authority to execute a highly destructive, albeit unintended, implementation.
Anthropic's documentation distinguishes between 'Manual' mode, which requests approval for Bash commands and file modifications, and 'bypassPermissions,' which should strictly be used within isolated containers or virtual machines. The AI's checkpoint feature might not have salvaged this situation, as changes made via Bash commands, including deletions, are not tracked for rewind functionality. This highlights the need for extreme caution when deploying AI coding agents for tasks involving file system manipulation.
Developers are strongly advised to treat AI coding agents as privileged automation tools rather than conversational assistants. For any operation with the potential for destructive outcomes, best practices should include initiating with a dry run and a detailed path manifest. Utilizing reversible moves instead of immediate deletions and operating under the principle of least privilege within filesystem-restricted sandboxes are also crucial mitigation strategies.
Anthropic does document OS-enforced filesystem boundaries for Bash, PowerShell, and child processes, emphasizing that sandboxing is an essential control rather than an optional convenience. However, until official logs or independent forensic evidence are released, this remains a user-reported incident. The precise technical cause and attribution to a specific Claude Code defect on the affected machine are yet to be independently verified, leaving room for further investigation into the exact sequence of events and the AI's decision-making process.
This incident serves as a stark reminder of the potential dangers when powerful AI tools are granted broad permissions, even for seemingly routine tasks. The speed at which the damage occurred emphasizes the need for robust safety mechanisms, thorough testing, and strict operational controls when integrating AI into development and system administration workflows.