Skip to main content
NOPE
Low reported severity

First-person GitHub issue: Claude Code user reports an auto-mode sub-agent turned a temp-folder cleanup into a delete of the Windows drive root (about 125 GB)

In a public GitHub issue filed on 27 September 2026, a Claude Code desktop app user on Windows reports that a background sub-agent running in auto mode passed a bash script inside a PowerShell string, meaning to delete a temporary folder. Because PowerShell expanded the script's variables to empty values, bash received a recursive delete of the drive root and deleted files from C: in alphabetical order until it was stopped about two minutes later. The author lists about 125 GB of personal and project folders, the whole working project and files inside several installed programs as deleted, and says auto mode approved the command and that recovery was only possible from a shadow copy taken nine hours earlier. The account is the author's own and is uncorroborated; no reply from Anthropic appears in the thread.

AI system
Claude Code
Anthropic
Occurred
Event date unknown
Reported
27 September 2026
Event location
Unknown
What the AI did
Acted on the person’s behalf
Reported harm
Property LossOther Material Harm
Whose AI use
Their own AI use
Setting
Work
Evidence
AI involvement reported · Causal attribution alleged · 1 source
4 claims: 4 reported. 4 open questions
People reported harmed
1 person

AI system as recorded: Claude Code desktop app 2.9939.2 (Code tab), a general-purpose background sub-agent running Opus 5.5 in auto mode on Windows 11 Pro, using the PowerShell tool to call MSYS2 bash, per the issue

What Happened

What the agent was doing. The issue says "a background subagent (auto mode, Claude Code desktop app) passed a bash script to MSYS2 inside a PowerShell double-quoted string". The script ended with a recursive delete "meant to delete a temporary folder".

How the target became the drive root. According to the author, PowerShell expanded the script's escaped variables itself; one command failed and one variable was undefined, so bash received a recursive delete of a bare backslash, which MSYS2 treats as the root of the current drive. "It deleted everything the user could delete from C:\ in alphabetical order, until stopped about two minutes later". The author quotes the first lines of the command output and says about 207,700 permission-denied lines followed, which list only the files rm could not remove.

Reported loss. The author lists "about 125 GB of personal and project folders at the drive root", "the whole working project" and "files inside several installed programs (Adobe, Epic Games/Unreal, AMD and others)". "Nothing went to the Recycle Bin." With an NVMe SSD and TRIM, undelete tools could not help, and "Recovery was only possible from a Windows shadow copy taken nine hours earlier".

Approval. "Auto mode approved the command." The author adds that earlier that week a protected-path check had blocked some PowerShell deletions, but it did not catch a recursive delete nested inside a bash call, and that once, after a blocked deletion, the agent retried through another API.

Limits. Single first-person report, uncorroborated; the transcripts and log offered on request were not retrieved. The issue does not give the date of the deletion or say how much was restored from the shadow copy. The author's handle is not recorded. No country is stated.

Reported harm

The author reports that a Claude Code background sub-agent, approved by auto mode, ran a recursive delete that wiped about 125 GB of personal and project folders, their working project and parts of installed programs from a Windows drive, recoverable only from a nine-hour-old shadow copy (first-person account, uncorroborated).

Outcome

Ongoing

The issue was open and labelled bug, high-priority, data-loss and area:security when read on 6 October 2026, with no comments. The author reports recovery from a Windows shadow copy taken nine hours before the deletion, and offers the session transcripts and full output log on request.

What remains unknown

  • The date of the deletion; the issue was filed on 27 September 2026 and gives no event date.
  • How much of the deleted data and installed software was restored from the shadow copy, and what changes after it were lost.
  • Whether Anthropic has confirmed or responded to the report.
  • Where the author lives.

What the evidence supports

AI involvement: reported. The author states that a Claude Code background sub-agent wrote and ran the PowerShell-wrapped bash script whose cleanup step became a recursive delete of the drive root, that auto mode approved it, and attributes the deletions to it, quoting the command output. The transcripts were not examined.

4 claims: 4 reported. What the statuses mean

Reported The author reports that a background Claude Code sub-agent in auto mode passed a bash script inside a PowerShell string whose last step was meant to delete a temporary folder, and that bash instead received a recursive delete of the drive root, which auto mode approved.

Causal attribution. Author attributes the script and the command to the sub-agent.

  • github.com(opens in new tab) supports · English
    'a background subagent (auto mode, Claude Code desktop app) passed a bash script to MSYS2 inside a PowerShell double-quoted string'; 'meant to delete a temporary folder'; 'which MSYS2 treats as the root of the current drive'; 'Auto mode approved the command'
Reported The author reports that the command deleted files from C: in alphabetical order for about two minutes, including about 125 GB of personal and project folders, the whole working project and files inside several installed programs.

Causal attribution. Author's account.

  • github.com(opens in new tab) supports · English
    'It deleted everything the user could delete from C:\ in alphabetical order, until stopped about two minutes later'; 'about 125 GB of personal and project folders at the drive root'; 'the whole working project'; 'files inside several installed programs (Adobe, Epic Games/Unreal, AMD and others)'
Reported The author reports that nothing went to the Recycle Bin and that recovery was only possible from a Windows shadow copy taken nine hours earlier.

Causal attribution. Author's account.

  • github.com(opens in new tab) supports · English
    'Nothing went to the Recycle Bin'; 'Recovery was only possible from a Windows shadow copy taken nine hours earlier'
Reported The issue records the Claude Code desktop app version 2.9939.2 and the model Opus 5.5 running as a general-purpose sub-agent in the background on Windows 11 Pro.

Causal attribution. Not applicable.

  • github.com(opens in new tab) supports · English
    'CLAUDE MODEL Opus 5.5 (a general-purpose subagent in the background)'; 'Windows 11 Pro 10.0.26200'; '2.9939.2'

Sources

1 source inspected. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

Read in English on 2026-10-06: full issue body retrieved through the GitHub API; the issue had no comments. The transcripts and output log offered on request were not retrieved. The author handle is not recorded. Applies to s1.

Event countries: Unknown. Affected-person countries: Unknown. Court countries: Unknown.

The issue does not say where the author was or lives; no country is recorded.

Reviewed for publication 2026-10-06: Published under the charter's public first-person rule as a concrete account of an AI coding agent's own cleanup command deleting a user's files and programs after automatic approval, described with attribution and without corroboration. The author's handle is not recorded.

People described

The issue's author, a Claude Code desktop app user on Windows

People reported harmed in this case

1 person

1 AI participant · 0 other people harmed

One person: the issue's author. Exact 1.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#first-person#github-issue#claude-code#anthropic#ai-agent#sub-agent#auto-mode#data-loss#file-deletion#windows#drive-root

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). First-person GitHub issue: Claude Code user reports an auto-mode sub-agent turned a temp-folder cleanup into a delete of the Windows drive root (about 125 GB). AI incidents. https://nope.net/incidents/2026-claude-code-sub-agent-auto-mode-recursive-delete-wiped-windows-drive-root-about-125-gb-first-person

BibTeX

@misc{2026_claude_code_sub_agent_auto_mode_recursive_delete_wiped_windows_drive_root_about_125_gb_first_person,
  title = {First-person GitHub issue: Claude Code user reports an auto-mode sub-agent turned a temp-folder cleanup into a delete of the Windows drive root (about 125 GB)},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2026-claude-code-sub-agent-auto-mode-recursive-delete-wiped-windows-drive-root-about-125-gb-first-person}
}

Related cases

Low Claude Code

First-person GitHub issue: a Claude Code user reports that a sub-agent's cleanup command deleted their Windows home directory through its short-name alias, removing about 116 GB, and that the agent reported the profile intact while the deletion ran for about 50 more minutes

In a public GitHub issue filed on 3 October 2026, a Claude Code user on Windows reports that a sub-agent, while cleaning up its own scratch files during research work, ran a command that included an unintended recursive delete of the 8.3 short-name alias of their home folder. The issue says no confirmation or permission prompt was recorded, that the command was moved to the background after a 120-second timeout, and that the deletion continued for about 50 minutes after the agent's stop call reported success. According to the issue, the agent told the main session it had killed the command and that the profile looked intact, having checked only top-level folder names. The author reports about 116 GB removed, including roughly 40 top-level Documents folders holding work described as months of work, developer toolchains and credentials, with recovery ongoing and incomplete. The account is the author's own and is uncorroborated; Anthropic had not replied in the thread when it was read.

Low Claude Code

First-person GitHub issue: Claude Code user reports the agent's unrequested recursive delete resolved to a Windows drive root and destroyed about 600 GB

In a public GitHub issue filed on 18 September 2026, a Claude Code user on Windows reports that on 16 September a Claude Code session ran, unprompted, a recursive delete as a step to clear old test state. The target was written as a command substitution that resolved to the root of the C: drive, and error output was suppressed, so the command ran without visible output for roughly 35 minutes before anyone noticed. The author reports that about 600 GB was destroyed, including the Windows user profile, several git repositories and planning documents that existed nowhere else, and that the session transcript that ran the command was itself deleted. The account is the author's own and is uncorroborated; no reply from Anthropic appears in the thread.

Low Claude Code

Heritage project reports loss of inscription records after a Claude Code command

On 19 July 2026 heritage conservationist Udaya Kumar P L, of The Mythic Society's Bengaluru Inscriptions 3D Digital Conservation Project, was using Anthropic's Claude Code to clear a cache on his computer when a command generated by the agent began deleting files. According to his account to OneIndia, the deletion ran for about four minutes while the agent tried to work out what was wrong, and when it tried to stop the process its own safety system blocked the kill twice; he eventually shut down the computer himself. Software and original photographs of Bengaluru's inscriptions, temples, hero stones and coins were lost, some of them the only records the project had of particular inscriptions. OneIndia and Deccan Herald report that about 15% of the project's records were deleted and that about 120 sites must be revisited and rescanned; the Society is spending about Rs 15 lakh on additional backups. He says he also opened a public GitHub issue on 29 July with the command, process output and his attempts to stop the deletion. He says he received an automated acknowledgement from Anthropic but was still waiting for a human response weeks later, and that he has asked it to reimburse recovery and rebuilding costs.

Low Claude Code

First-person GitHub issue: Claude Code user reports a sub-agent's recursive delete hit the Windows drive root and destroyed a development folder

In a public GitHub issue filed on 7 September 2026, a Claude Code user on Windows reports that a sub-agent, intending to delete a stray directory inside the repository, ran a recursive delete that Git Bash path translation resolved to the root of the current drive. The author says the command ran in the background after a timeout and deleted drive contents in alphabetical order for about seven minutes before it was killed manually, and that when the agent called its stop tool, the tool reported success while the delete process kept running for about five more minutes until it was killed by process ID. Several projects in the development folder were deleted, some without remote backups; most were recovered from a same-day shadow copy and GitHub remotes, and one directory created after the snapshot was lost. The account is the author's own and is uncorroborated.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents