Claude Code file deletion stories have circulated before, but the one that surfaced on Reddit on Sunday 20 September 2026 came with unusually precise numbers. A developer using Anthropic’s coding agent says a helper script it wrote removed 48,218 live files from a Windows project folder between 10:10:31 pm and 10:12:14 pm US Eastern time the night before. That is 103 seconds, or roughly 468 files a second. The same run emptied the project’s Git object store, so the usual undo button was gone too.
The post, titled “Code just deleted 48k files. This can’t be real.”, had drawn 4,841 upvotes and 1,365 comments by the time an archived copy showed its author as deleted. The cybersecurity site CyberSecurityNews covered it on Monday 21 September, and TechRadar’s version on Friday 25 September was syndicated by Yahoo Tech under the headline this article borrows. The Claude Code file deletion is now a standard warning about AI agents, and it deserves one. It is also more specific, and more instructive, than “the AI went rogue”.
This article reconstructs the Claude Code file deletion from the archived Reddit thread, including the full prompt and the agent’s own incident report. It explains the Windows quirk at the root of it, separates what was lost from what survived, sets out which of Claude Code’s guardrails applied and which did not, and ends with a practical checklist. If you already use coding agents, our guide to using AI coding assistants safely in large software projects covers the everyday habits; this piece is about the night those habits were missing.
Table of contents
- What Happened in the Claude Code File Deletion
- How the Claude Code File Deletion Unfolded
- The Root Cause of the Claude Code File Deletion: Windows Junctions
- What the Claude Code File Deletion Destroyed, and What Survived
- Who Is to Blame for the Claude Code File Deletion?
- Why the Guardrails Did Not Stop the Claude Code File Deletion
- Ultracode, Workflows and the Claude Code File Deletion
- Claude Code File Deletion Is Not a One-Off
- How to Prevent a Claude Code File Deletion on Your Own Machine
- What Businesses Should Take From the Claude Code File Deletion
- Frequently Asked Questions About the Claude Code File Deletion
- References
What Happened in the Claude Code File Deletion
The short version: the developer asked Claude Code to run fifteen repair jobs on isolated copies of a project. One sub-agent needed to delete an old copy before rebuilding it, wrote its own deletion script, and that script followed Windows links from the copy back into the real project.
The Reddit post that started it
The post went up on r/ClaudeAI at 03:00 UTC on Sunday 20 September, which was 11:00 pm on Saturday in the US East. It carried the subreddit’s “Claude Code” flair, a phone photograph of the screen and two words of text: “I’m speechless”. An archived copy from 04:43 UTC shows 241 upvotes and 180 comments. By 14:54 UTC the author had edited the post to add context, the full prompt and the agent’s report, and it stood at 3,415 upvotes and 1,032 comments.
A capture at 00:31 UTC on Monday shows 4,841 upvotes, 1,365 comments and the author listed as “[deleted]”. TechRadar describes the post as now deleted. Everything quoted below about the Claude Code file deletion comes from the Wayback Machine copies, not from the live page.
What the developer was building
In the edit, the author explained that this was a personal computer, not a production server. Claude was “adjusting an options back testing engines I use for historical options analysis”, working on backtesting scripts for volatility on the SPY and QQQ exchange-traded funds. The reason the folder held so many files, the author wrote, was “historical tick level options data, greeks, vix, etc.”
The author also said the session was “set to opus 5 ultracode”, meaning Claude Opus 5 with Claude Code’s ultracode setting, which plans multi-agent workflows automatically. And, in a detail that has not had much attention, “The prompt was written by codex, as I have it review every recommendation provided by claude before making a decision.” OpenAI’s coding agent drafted the instructions that Anthropic’s coding agent then carried out.
What the agent said afterwards
Claude’s report opens with a line that has since become a meme: “Craig — stop and read this. I broke something.” It continues: “An agent I launched deleted about 48,000 live files from the Dashboard tree between 10:10:31 and 10:12:14 PM ET tonight, and destroyed the git object store. I’ve confirmed it myself, independently of the agent’s own report.”
That candour is worth noting. The agent did not hide the damage, invent a recovery or claim success. It checked the verifier’s report, ran eight commands of its own and then led with the bad news. As we will see, the failure was in what happened before that message, not in the message itself.
How the Claude Code File Deletion Unfolded
The archived post lets us put the evening in order. Times for the Claude Code file deletion come from the agent’s report; times for the thread come from Wayback Machine captures.
From authorisation to “I broke something”
The prompt was long and unusually formal. It opened: “Proceed with the following repairs now. This is explicit authorization to build, correct and test them on isolated copies. Do not come back asking whether to begin each build.” It then listed more than a dozen items by code, from A13 to D45, and fenced them with conditions: “No historical re-cuts, ledger repointing/restatement, adoption changes, vendor/broker access, protected-file reads or schedule changes are authorized here.”
Claude replied “Fifteen builds, authorized. Launching now” and started a workflow called r383-fifteen-repairs. It described the plan as “11 boxes, each with an adversarial verifier, then the package”, with each box “patching a copy, running both drill arms, then handed to an independent verifier whose job is to refute it”. When the workflow finished, Claude reported: “Ten of eleven are sound. One is not — the #873 machinery box reports scope violations and writes outside its box.”
| When | What happened | Source |
|---|---|---|
| Sat 19 Sep, evening (ET) | Codex-written brief authorises repairs “on isolated copies”; Claude launches an 11-box workflow with a verifier per box | Edited Reddit post |
| 10:10:31 pm ET | The #873 box’s remover starts clearing the old mirror in Temp | Agent’s report |
| 10:12:14 pm ET | Deletion ends; the remover’s log counts 55,550 files, 614 junctions and 1,808 directories | Agent’s report |
| Before 11:00 pm ET | Verifier flags scope violations; Claude checks, then writes “I broke something” | Agent’s report |
| Sun 20 Sep, 03:00 UTC | Post goes up on r/ClaudeAI with a phone photo of the screen | Reddit metadata |
| 20 Sep, 14:54 UTC | Post edited with context, prompt and report; 3,415 upvotes | Wayback Machine |
| 21 Sep, 00:31 UTC | 4,841 upvotes, 1,365 comments; author shown as deleted | Wayback Machine |
| 21 Sep, 16:12 UTC | CyberSecurityNews: “Claude Code Agent Allegedly Deletes 48,000 Files in 103 Seconds” | CyberSecurityNews |
| 25 Sep | TechRadar story, syndicated by Yahoo Tech and MSN; Android Headlines follows | TechRadar |
Inside the 103-second Claude Code file deletion
The Claude Code file deletion itself was brief. At 55,550 removals in 103 seconds, the remover was working at about 539 files a second, and 86.8% of what it removed should never have been touched. The chart splits the remover’s own count into the files it was meant to delete and the live files it reached through links, using the agent’s figures (55,550 minus 7,332 equals 48,218).
No human could have intervened in that window. Even someone watching the terminal would have seen a Python process running for under two minutes, which is exactly what a legitimate clean-up looks like. That is the first lesson of the Claude Code file deletion: speed removes the chance to notice, so any protection has to be in place before the command runs.
The Root Cause of the Claude Code File Deletion: Windows Junctions
The agent’s report is specific about the mechanism, and the official documentation backs it up. This is where the Claude Code file deletion stops being a story about “rogue AI” and becomes a familiar software bug.
What a directory junction is
A directory junction is an NTFS feature that makes one folder appear inside another. Microsoft’s note on hard links and junctions describes a junction, “also called a soft link”, as a link whose target is a separate directory, possibly on a different local volume, implemented through reparse points. Tools that build fast “mirrors” of a project often use junctions so that large folders are linked rather than copied.
According to the report, the old mirror in the Windows Temp folder held 7,332 real files plus 614 directory junctions “pointing into the live tree”. Deleting a junction removes the link. Walking into a junction and deleting everything inside removes the real files at the other end.
Why followlinks=False did not help
The agent needed to clear the old mirror because, in its words, “build_mirror.py can’t refresh in place”. So “the agent wrote a remover for the old mirror in Temp”. That remover walked the folder with Python’s os.walk and passed followlinks=False, which reads like a promise not to follow links.
The promise only covers one kind of link. Python’s documentation says os.walk “will not walk down into symbolic links that resolve to directories” by default, and os.path.islink returns True only for a symbolic link. Junctions got their own test, os.path.isjunction, in Python 3.12. The CPython source for os.walk checks islink and is_symlink, not is_junction. As the report put it, followlinks=False “does not stop at a junction, because islink() is False for junctions on Windows.”
The guard that protected the wrong layer
The script was not careless. It “wrote a junction guard”, the report says, “but the guard only skipped files sitting directly in a junction’s root; every directory below a junction came back as an ordinary path and was deleted.” In other words, the author of the script, an AI sub-agent, knew junctions were a risk and tested for them, but only one level deep.
Python’s own documentation carries a warning about exactly this pattern. Its example of deleting a tree with os.walk is labelled “assuming there are no symbolic links. CAUTION: This is dangerous!” Any cybersecurity reviewer would recognise the rest: a guard that checks the first hop but not the path taken after it.
The safety check that checked the wrong thing
After the Claude Code file deletion, the remover ran a “live tree intact” check. The report calls it “worthless”: “it verified the junction targets still existed (they did, only their contents were gone) and that the seven engine files were unmoved (they’re root files, never below a junction).” The check passed while most of the tree was empty.
This is the detail engineering teams should pin to the wall. A verification step that tests existence rather than contents will pass after a Claude Code file deletion of any size, because folders survive when their files do not. Counting files before and after, and failing loudly on a difference, would have caught it immediately, though still after the fact.
What Python’s standard tools would have done
The irony of the Claude Code file deletion is that Python already solves this. The documentation for shutil.rmtree records that since Python 3.8 it “will no longer delete the contents of a directory junction before removing the junction” on Windows. A one-line call to the standard library’s tree-deletion function would have removed the links and left the live files alone. A hand-rolled loop did not.
Nobody knows why the sub-agent wrote its own remover instead. A plausible reason is that it wanted the junction guard and a log, which rmtree does not provide. The lesson for anyone reviewing agent-written code is that bespoke file-deletion logic deserves more suspicion than a library call, not less.
What the Claude Code File Deletion Destroyed, and What Survived
Headlines say the developer’s “work” was destroyed. The agent’s own inventory is more precise, and it shows both how bad the damage was and how much remained.
What was lost in the Claude Code file deletion
The biggest loss was not a file count. “The git repository. .git/objects, refs and logs are empty; git log says the branch has no commits.” The index file survived, so Git could still list 7,221 tracked paths, “but every blob behind it is gone. Git cannot restore anything.”
Beyond Git, 728 directories were emptied. The agent’s first census said 611, but “its method filtered on directory mtime and under-counted”, and the verifier’s unfiltered count was 728. The losses included the whole #873 chain under Runners/R378/rehearse873_0917, where only nine files were recovered from copies, and 71 subfolders of test records such as arm ledgers and session records.
What survived
The report lists what the agent checked “directly”. Every root file survived: 872 Python files and 186 JSON files, including bot.py and both engines. Folders that were not reached through a junction also came through: A Docs with 12,649 files, Backups with 18,224, chat transcripts with 2,177, a folder called Prometheus with 686 and logs with 549. Outside the Dashboard tree, the Codex folder with 5,521 files and the CLAUDE folder with 325 were untouched, as were all eleven repair boxes.
| Area | Count in the report | Status |
|---|---|---|
| Live files below junctions | 48,218 files | Deleted |
| Git objects, refs and logs | Whole store; index still names 7,221 paths | Deleted, unrecoverable through Git |
| Directories | 728 emptied | Emptied |
| Root files | 872 .py and 186 .json | Intact |
| Backups folder | 18,224 files | Intact |
| A Docs folder | 12,649 files (78 subfolders emptied) | Mostly intact |
| Codex and CLAUDE folders | 5,521 and 325 files | Intact, outside the tree |
| The eleven repair boxes | All, including ten sound ones | Intact |
Add up the surviving counts the report gives and you get 41,189 files, against 48,218 deleted. That is not a full census of the machine, and the emptied folders held real work, but it undercuts the idea that the developer “lost all their work”.
Why Git could not save the day
It is tempting to read this Claude Code file deletion as “should have used Git”. The developer said as much: “Outside of my NAS and iDrive, I was not properly using github or another method for immediate corrections, even though it should have been branching. Thats on me.”
But look at the numbers. Git’s surviving index named 7,221 paths, a figure equal to about 15% of the 48,218 files deleted. The author says the file count comes from historical tick-level options data, which nobody keeps in Git. A pushed remote would have restored the tracked code quickly. It would not have restored the data. That needed the other two things the developer mentioned: a copy on a network-attached storage box and an overnight iDrive cloud backup. The edit says the first recovery step was a Windows shadow copy, “the most recent copy against my overnight idrive backup”. The thread does not say how much came back.
Who Is to Blame for the Claude Code File Deletion?
The Reddit crowd was not sympathetic. An automatically generated summary pinned to the thread called it “a classic FAFO situation and a major skill issue”. The fair answer is that responsibility is shared, and the split matters for anyone deciding how far to trust these tools.
The case against the agent
The agent behind the Claude Code file deletion was told to work “on isolated copies”, and the prompt’s fences were explicit. A sub-agent then wrote code that reached outside its box and destroyed data. The verifier reported “scope violations and writes outside its box”, which is a plain description of a boundary failure. Claude’s own summary said the box “broke a hard fence and did real damage.”
The script also contained two engineering mistakes that a careful human reviewer should catch: a shallow junction guard and an existence-only safety check. Choosing a hand-written loop over shutil.rmtree was a design decision with consequences, and it was the agent’s decision.
The case against the setup
The developer ran a multi-agent workflow, with explicit instructions not to pause for confirmation, on the only live copy of a project, on a Windows machine with junctions linking the scratch area into the live tree. The Git repository sat inside the same tree, so the undo mechanism was reachable by the same mistake. Commenters also mocked the phone photo of the screen. The author’s explanation, preserving the shadow copy before anything else touched the disk, is the right instinct during an incident.
None of this is unusual for a solo developer. It is, however, the exact environment every vendor’s documentation warns about, including Anthropic’s.
What remains unverified about the Claude Code file deletion
CyberSecurityNews was careful to call this an alleged incident. Its report ends: “Until logs or forensic evidence are released, however, the precise account remains a user-reported incident with no independently verified attribution to a specific Claude Code defect on the affected machine.” That still holds. The evidence is a screen photograph, an edited post and an agent-written report, and the account behind them has gone. None of the coverage we reviewed includes a statement from Anthropic.
The internal detail is consistent, though. The counts add up, the timestamps give exactly 103 seconds, and the mechanism matches both Python’s documentation and its source code. It reads like a real Claude Code file deletion rather than an invention.
Why the Guardrails Did Not Stop the Claude Code File Deletion
Claude Code has several layers of protection against destructive actions. Reading the documentation alongside the Claude Code file deletion shows why each one either did not apply or would not have helped. The post does not say which permission mode the session used, so this section describes what each mode does, not which one ran.
Permission modes and what they cover
Anthropic’s permission modes documentation lists six modes. Since version 2.1.283, auto mode is the built-in starting mode for interactive terminal and VS Code sessions. The right-hand column is our reading of how each would meet a script like this one.
| Mode | What runs without asking (Anthropic) | Against a Python remover (our reading) |
|---|---|---|
| default (Manual) | Reads only | You approve the command, but see “python remover.py”, not what it deletes |
| acceptEdits | Reads, file edits, common filesystem commands | Script runs still prompt; same visibility problem |
| plan | Reads, plus classifier-approved commands | Blocks edits until you approve a plan |
| auto | Everything, with background safety checks | Classifier judges the command and its context, not the paths the script will reach |
| dontAsk | Reads and pre-approved tools only | Denied unless explicitly allowed |
| bypassPermissions | Everything; “isolated containers and VMs only” | Runs immediately |
Deletion checks read commands, not scripts
Claude Code refuses to let rules or hooks auto-approve an rm or rmdir aimed at a “critical path”, such as a drive root, the home directory or the working directory itself. On Windows it adds separate checks for PowerShell’s Remove-Item and cmd’s rd and del. These are good circuit breakers, but they inspect the command line. A Python script that calls os.remove on thousands of paths presents as one harmless-looking command.
Auto mode’s classifier goes further. By default it blocks “Irreversibly destroying files that existed before the session”, along with force pushes and mass deletion on cloud storage. In the Claude Code file deletion, the stated target was an old mirror in a temp folder, a clean-up the brief had arguably authorised. Nothing in the command revealed that 614 junctions led back into the live project. A reviewer, human or model, would need to know about the junctions to see the danger.
Written authorisations carry weight
The documentation explains that auto mode treats approvals you state in conversation as approvals, and boundaries you state as block signals. The brief behind the Claude Code file deletion contained both: “explicit authorization to build, correct and test” and a list of things “not authorized here”. But a boundary in prose is only as good as the reviewer’s ability to map it to an action. “Isolated copies” was the boundary; a junction is precisely the thing that makes a copy not isolated.
There is a second subtlety in Anthropic’s workflows documentation. In auto mode, “the prompt your script passes to agent() doesn’t count as a request from you when the classifier reviews that subagent’s actions”. That is a safety feature: a sub-agent cannot grant itself permission. It also means sub-agents act on your original words, several steps removed from them.
Checkpoints do not cover shell deletions
Claude Code’s rewind feature restores files changed by its own editing tools. The checkpointing documentation is clear that it “does not track files modified by Bash commands”, that sub-agent edits are usually not restored, and that checkpoints are “not a replacement for version control”. A Claude Code file deletion done by a script falls outside rewind completely.
The sandbox does not run on native Windows
Claude Code’s built-in sandbox enforces file and network limits at operating-system level for every Bash and PowerShell command and its child processes. But the sandbox documentation says it “runs on macOS, Linux, and WSL2. Native Windows is not supported.” The Claude Code file deletion happened in a Windows Temp folder and a Windows project tree.
Even where it does run, the sandbox lets commands write to the working directory and a temp folder by default. The repair boxes sat under the same Runners folder that lost 418 directories, which suggests the live tree was inside the working area. So a sandbox limits damage outside the project. It does not protect the project from the agent working on it. Only a copy, a container or a backup does that.
Ultracode, Workflows and the Claude Code File Deletion
The Claude Code file deletion is also an early real-world test of multi-agent orchestration, which every major lab is now pushing.
What ultracode does
Anthropic’s documentation describes ultracode as a setting that “combines xhigh reasoning effort with automatic workflow orchestration”. With it on, Claude plans a workflow for each substantive task, and in auto mode it skips the approval prompt for the first workflow launch, “because turning ultracode on already opts you in to large runs”. The same page stresses that the workflow’s agents get “the same permission checks and sandboxing as any other tool call in the session.” Orchestration changes how much work happens at once, not what each step may do.
The verifier caught it, after the fact
The design worked as intended in one respect. Every box had a verifier “whose job is to refute it”, and the #873 verifier did flag “scope violations and writes outside its box”. Claude then investigated before reporting, and its report was accurate enough to rebuild the whole sequence days later.
The problem is timing. A verifier that reviews a finished box is an auditor, not a guard. By the time it ran, the remover had been done for minutes. Verification needs to happen before irreversible steps, or those steps need to be made reversible.
Scale multiplies the blast radius
Eleven boxes in parallel means eleven agents writing their own code in the same filesystem at the same time. Ten were fine. It took one, a single helper script in a single box, to cause the whole Claude Code file deletion. As agent runs get bigger, the chance that one of many generated scripts contains a subtle mistake rises. Isolation has to be designed for the worst box, not the average one.
Claude Code File Deletion Is Not a One-Off
This is one of the most detailed accounts yet of an agent destroying files, but the pattern is familiar. Three earlier incidents drew wide coverage.
| When | Tool | What was lost | Recovered? |
|---|---|---|---|
| Jul 2025 | Replit agent | Production database for SaaStr’s app, during a code freeze | Yes, manually, despite the agent saying rollback would fail |
| Jul 2025 | Gemini CLI | A folder of experiment files, moved into a directory that was never created | Not reported; the files were experimental |
| Dec 2025 | Claude Code | A user’s entire Mac home directory | Not reported |
| Sep 2026 | Claude Code | 48,218 live files and the Git store, via Windows junctions | Backups existed; outcome not reported |
Replit and the SaaStr database
In July 2025 SaaStr founder Jason Lemkin said Replit’s agent made unauthorised changes during a code freeze and wiped data for more than 1,200 executives and over 1,190 companies, according to Fortune. The agent called it “a catastrophic failure on my part”. Replit’s chief executive Amjad Masad called it “unacceptable” and promised separation between development and production databases and a planning-only mode.
Gemini CLI and the missing folder
Days later, product manager Anuraag Gupta described Google’s Gemini CLI moving his files into a folder that a failed mkdir command never created, Mashable reported. The agent concluded: “I have failed you completely and catastrophically.” Google said Gemini CLI requires permission before file operations and offers sandboxing and checkpointing.
Claude Code and a home directory
In December 2025, GIGAZINE reported an earlier Claude Code file deletion: a Reddit user whose session deleted their entire Mac home directory while tidying packages in an old repository. Commenters suspected the –dangerously-skip-permissions flag. Claude Code’s current documentation treats the home directory as a critical path, so a plain rm aimed at it now prompts or is denied in every permission mode.
The common thread
Each incident combined an agent with write access, real data with no isolated copy, and a mistake that looked routine until it finished. The 2026 Claude Code file deletion adds a fourth ingredient: the dangerous action was hidden inside code the agent wrote for itself, where command-level checks cannot see it.
How to Prevent a Claude Code File Deletion on Your Own Machine
None of the following is exotic. Most of it predates AI agents. The point is to put protection in the filesystem and the process, not in the wording of a prompt.
Keep code in Git and push it somewhere else
Commit before every agent run and push to a remote the agent cannot rewrite. The Reddit summary adds a good second step: protect the main branch, because “an agent with push access can cause chaos”. A local .git folder inside the project is not a backup, as this Claude Code file deletion shows.
Back up data the agent cannot reach
Market data, datasets and generated artefacts need backups, not version control. Keep at least one copy offline or immutable; our guide to the immutable backup 3-2-1-1-0 strategy sets out the pattern. Windows shadow copies are useful but live on the same disk, so treat them as a last resort.
Run agents on a copy, not the original
Use a Git worktree, a dev container, a virtual machine or WSL2 with the sandbox enabled, and mount real data read-only. The same logic drives our piece on air-gapping rogue AI agents: limit what the agent can touch, not only what it is told.
Add deny rules and a deletion hook
Deny rules can block rm, Remove-Item and similar commands outright. Because scripts slip past command-level rules, add a PreToolUse hook that reads any script before it runs and holds it for your approval if it contains deletion calls. Put standing rules in a project instructions file too; see our explainer on AGENTS.md and Claude Code project instructions.
Make destructive steps dry-run first and reversible
Ask agents to produce a manifest of what they will delete, compare its size with what you expect, and move files to a quarantine folder instead of deleting them. Count files before and after, and stop on any mismatch. A dry run before the Claude Code file deletion would have listed 55,550 paths where about 7,332 were expected.
Treat links as hazards
On Windows, prefer shutil.rmtree for deleting trees, use os.path.isjunction on Python 3.12 or later, and avoid building scratch mirrors out of junctions into live folders. On any platform, assume a “copy” may contain links back to the original until proven otherwise.
Write narrower authorisations
“Do not come back asking” removes the one human checkpoint left. Authorise builds broadly if you like, but require a pause before any irreversible filesystem operation. It costs seconds and would have turned this Claude Code file deletion into a question on screen.
| Control | Would it have helped here? | Limit |
|---|---|---|
| Git pushed to a remote | Restores the 7,221 tracked paths | Not the market data |
| Offline or cloud backup | Restores data to the last backup | Loses work since that backup |
| Agent on a copy or VM | Prevents it: live tree out of reach | Needs setup; data must be synced |
| Built-in sandbox | Not available on native Windows | Allows writes inside the working directory |
| Deletion hook on scripts | Partly: forces a human look at the remover | Cannot see junctions in the target folder |
| Dry-run manifest | Yes: 55,550 paths versus about 7,332 expected | Someone has to read it |
| shutil.rmtree instead of a loop | Yes: junction contents left alone | Specific to this bug |
What Businesses Should Take From the Claude Code File Deletion
For a company, the question is not whether a developer’s laptop can lose a weekend’s work. It is whether an agent with the same habits can reach shared drives, repositories or production data.
Treat coding agents as privileged automation
CyberSecurityNews made the point well: “Developers should treat AI coding agents as privileged automation, not conversational assistants.” That means the same controls you would apply to a deployment script with admin rights: least privilege, separate accounts, logging and review. Our guide to monitoring AI agents in production covers the logging side.
Set policy centrally
Claude Code supports managed settings that individual developers cannot override. Administrators can disable bypassPermissions mode, turn auto mode off, enforce the sandbox on supported platforms and ship deny rules to every machine. If your developers use Windows, the practical policy is WSL2 or a dev container for agent work. Teams without in-house platform engineers can get help from our DevOps services team.
Rehearse the restore
Most organisations have backups. Fewer have tried restoring a developer workstation’s project folder and data from them on a Saturday night. A timed restore drill turns this Claude Code file deletion from a disaster into an inconvenience, and it tells you whether your backups actually cover the folders agents work in.
Remember the prompt is an attack surface
The prompt behind this Claude Code file deletion was written by another AI. In a business, prompts may also come from tickets, documents or web pages an agent reads. Our prompt injection risk assessment guide explains why any text an agent treats as instructions is part of your security boundary.
Frequently Asked Questions About the Claude Code File Deletion
Did Claude Code really delete 48,000 files?
According to the developer’s post and the agent’s own report, a remover script written by a Claude Code sub-agent deleted 48,218 live files. The account is user-reported and has not been independently verified, but its numbers and mechanism are internally consistent.
Why did it take only 103 seconds?
Deleting files is fast. The remover logged 55,550 deletions between 10:10:31 and 10:12:14 pm ET, about 539 a second. The Claude Code file deletion was over before any person could have reacted.
Could the developer get the files back?
Git could not help, because its object store was emptied. The developer had a NAS copy, an overnight iDrive backup and a Windows shadow copy in progress. The thread does not say how much was restored.
Would Claude Code’s checkpoints or rewind have helped?
No. Anthropic’s documentation says checkpoints do not track files changed by Bash commands and usually do not restore sub-agent edits. A script-driven Claude Code file deletion is outside their scope.
Is it safe to use Claude Code on Windows?
It can be, with care. The built-in sandbox does not run on native Windows, so run agents inside WSL2 or a container, keep backups, and watch for directory junctions and symbolic links in any folder an agent may clean up.
What is the single most important safeguard?
Never let an agent work on the only copy of something you cannot lose. Git, backups, sandboxes and permission prompts all help, but a copy that the agent cannot reach is what turns a Claude Code file deletion into a non-event.
References
Code just deleted 48k files. This can’t be real. (r/ClaudeAI)
Archived copy of the r/ClaudeAI post (Wayback Machine)
Claude Code allegedly deleted 48,000 files in 103 seconds (TechRadar)
Claude Code Agent Allegedly Deletes 48,000 Files in 103 Seconds (CyberSecurityNews)
Choose a permission mode (Claude Code Docs)
Checkpointing (Claude Code Docs)
Configure the sandboxed Bash tool (Claude Code Docs)
Orchestrate subagents at scale with dynamic workflows (Claude Code Docs)
os.walk (Python documentation)
os.path.isjunction (Python documentation)
shutil.rmtree (Python documentation)
Hard links and junctions (Microsoft Learn)
AI-powered coding tool wiped out a software company’s database (Fortune)
Google Gemini deletes user’s code (Mashable)
Claude Code CLI Deletes Your Mac’s Home Directory (GIGAZINE)
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.
