Claude Code executed an unconfirmed rm -rf that deleted a user's entire home directory

Undisclosed (individual developer, GitHub user mikewolak)·Claude CodeUnresolved

Claude Code executed a destructive recursive delete command that attempted to remove files starting from root; the command failed on protected system files only because of permission restrictions, but it successfully deleted all of the user's own files in their home directory.

Blast radius

All user-owned files in the reporter's home directory were deleted; only OS/system files under paths like /bin, /boot, /etc survived because normal file permissions blocked the root-level deletion.

Root cause

The agent ran an unconfirmed, unscoped recursive delete without a safeguard against destructive commands targeting root or the home directory.

How it was caught

The user discovered missing files after the command ran and reproduced the failure output (permission-denied lines) in the bug report.

What changed

Anthropic closed the report as 'not planned'; no dedicated fix was confirmed in the thread at the time of closure.

Take-awayHard-block or require explicit, itemized confirmation for any agent-issued recursive delete that targets '/', a home directory, or an unbounded glob, regardless of how confident the model sounds.