Claude Code Agent Allegedly Deletes 48,000 Files in 103 Seconds

A Claude Code user has reported a severe data-loss incident in which an autonomous coding agent allegedly deleted 48,218 live files from a Windows project tree and destroyed the repository’s Git object store.

The deletion reportedly occurred in just 103 seconds, between 10:10:31 p.m. and 10:12:14 p.m. ET, after the agent was authorized to rebuild a mirror for a task identified as “#873.” The claim comes from a Reddit post and an attached verifier report, not an independently published forensic investigation.

According to the report shared on Reddit, the agent discovered that build_mirror.py could not refresh the mirror in place and therefore created a Python-based remover for an older copy stored in a temporary location.

Claude Code Agent Allegedly Deletes Files

That mirror contained 7,332 ordinary files and 614 Windows directory junctions pointing back into the live Dashboard tree. The cleanup script used os.walk(..., followlinks=False), apparently assuming this would prevent traversal into linked directories.

That assumption proved catastrophic on Windows. The verifier said os.path.islink() returned false for the junctions, allowing the remover to treat directories beneath each junction as normal paths.

Although the script included a junction guard, it reportedly protected only files located directly at a junction’s root; nested directories were walked and deleted. Its own log counted 55,550 files, 614 junctions and 1,808 directories.

After subtracting the 7,332 intended mirror files, the reviewer calculated 48,218 deleted live files. The reported damage extended beyond application content. The .git/objects, refs and logs directories were empty, leaving git log unable to find commits. The index survived and continued listing 7,221 paths, but the underlying blobs were gone, preventing Git-based recovery.

The verifier also counted 728 emptied directories, including 418 beneath Runners, while root files, documentation, backups, chat transcripts, and files outside the Dashboard remained intact.

The incident exposes a critical weakness in agentic coding workflows: permission to complete a legitimate maintenance task can become authority to execute an unsafe implementation.

Anthropic’s documentation says Manual mode requests approval for Bash commands and file modifications, while bypassPermissions skips prompts and should be used only inside isolated containers or virtual machines.

Claude Code’s checkpoint feature would not necessarily rescue this scenario because changes made through Bash commands, including deletions, are not tracked for rewind.

Developers should treat AI coding agents as privileged automation, not conversational assistants. Destructive operations should begin with a dry run and path manifest, use reversible moves instead of immediate deletion, and run under least-privilege accounts inside filesystem-restricted sandboxes.

Anthropic documents OS-enforced filesystem boundaries for Bash, PowerShell, and child processes, making sandboxing an essential control rather than an optional convenience.

Until logs or forensic evidence are released, however, the precise account remains a user-reported incident with no independently verified attribution to a specific Claude Code defect on the affected machine.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC