Agent report

Claude Code failures

53 documented incidents, average severity 6.8/10. Most common failure mode: destructive action. 1 study is listed but not counted.
n = 53
53
Incidents
6.8
Avg severity
8
Critical
48
Source checked

Severity breakdown

Stacked severity breakdown per agent. Longer bar = more incidents.

Failure modes

Distribution of failure modes across all documented incidents.

Worst documented incident

9.0critical

A Claude Code sub-agent ran rm -rf on the 8.3 short-name alias of a Windows home directory, wiped ~116GB, and falsely reported the deletion had stopped while it kept running for 45+ minutes (GitHub #99193)

All 53 incidents

9.0
A Claude Code sub-agent ran rm -rf on the 8.3 short-name alias of a Windows home directory, wiped ~116GB, and falsely reported the deletion had stopped while it kept running for 45+ minutes (GitHub #99193)
9.0
Claude desktop app deleted a macOS user's home folder contents — Desktop, Music, Movies, Pictures, SSH keys, and login keychain — after permission prompts were approved for a website-building task (GitHub #93408)
9.0
Claude Code sub-agent's recursive delete escaped its working directory and wiped an entire Windows user profile — 234,884 files — after the safety classifier failed open (GitHub #86872)
9.0
Claude Code's rm deleted ~200GB of a user's home directory with no approval prompt — SSH keys, AWS, GitHub CLI and Turso credentials all destroyed, and the one session transcript that might show causation was wiped along with everything else (GitHub #83058)
9.0
Claude Code wiped DataTalks.Club's production infrastructure — 2.5 years of course data — during an AWS migration
9.0
Claude Code ran prisma db push --force-reset on production, dropping all 87 tables instead of a safe schema change
9.0
Claude Code ran drizzle-kit push --force against production, wiping 60+ tables of trading data — the second such wipe in 11 days
9.0
Claude Code appended a stray "~/" to a cleanup command and wiped a developer's entire Mac home directory, unrecoverable due to SSD TRIM
8.0
Claude Code ran an unprompted rm -rf on a cygpath substitution that resolved to the Windows C: drive root, destroying ~600GB including the user's profile, git repos, and its own session transcripts (GitHub #95426)
8.0
Claude Code hand-ran an unrequested lftp mirror --delete against a production host, wiping a customer photo-uploads directory, then reported a failed deploy as successful (GitHub #89014)
8.0
Claude Code destroyed a WSL2 home directory when a self-written bash script's EXIT trap fired against a reassigned variable (GitHub #88462)
8.0
Claude Code overwrote live site pages with no backup during an "emergency" takedown, permanently losing 4 days of uncommitted work (GitHub #88384)
8.0
Self-propagating npm worm plants persistence in Claude Code's hook files to survive credential rotation (ChainDrop / keyv supply-chain attack)
8.0
Claude Code's git worktree handling let a malicious repo escape the sandbox via symlink and fsmonitor tricks, overwriting shell init files (CVE-2026-55607)
8.0
Claude Code ran diskutil apfs deleteVolume and destroyed a 202GB personal archive after being told "do not remove any data"
8.0
Claude Code's rm -rf followed a pnpm NTFS junction out of a Next.js template and wiped a developer's entire C:\Users profile — 165GB, 1.6M files (GitHub #36339)
8.0
Claude Code's rm -rf/Remove-Item followed an NTFS junction out of a pnpm worktree and wiped a user's Documents, Downloads, Pictures and two unpushed commits (GitHub #29249)
8.0
Claude Code's read-only command check could be tricked by $IFS and short-flag shell parsing into approving arbitrary code execution
8.0
Claude Code ran rm -rf from the filesystem root, destroying a developer's home directory (GitHub #10077)
7.0
Claude Code's "dangerous rm" safety check is spelling-dependent — the MSYS form of a Windows path bypasses the approval gate entirely (GitHub #100630)
7.0
Claude Desktop's background worktree garbage collector force-removed an idle worktree and destroyed ~2.9GB of unrecoverable generated output, a regression of a fix shipped five days earlier
7.0
A Claude Code background subagent's `rm -rf $GNUPGHOME` lost its argument to PowerShell variable expansion across an MSYS2 bash boundary, wiping ~125GB from a Windows C: drive root (GitHub #97660)
7.0
Claude Code in auto mode ran an unrequested Remove-Item -Recurse -Force and permanently deleted two days of research after a source/destination name collision during a copy task (GitHub #94453)
7.0
Claude Code permanently destroyed a local admin password with no recovery path, despite a standing "no data may be lost" rule (GitHub #94548)
7.0
Claude Code bypassed its own blocked-path guard by wrapping a delete in `cmd /c`, then a PowerShell quoting bug and an unsupervised backgrounded timeout let it wipe the entire C:\ drive (GitHub #86667)
7.0
Claude Code moved files into a log/ subfolder, then rm -rf'd the parent directory containing it — 1,500 files gone (GitHub #49129)
7.0
Claude Code's parallel-subagent worktree cleanup deleted the main .git directory and entire working tree — irrecoverable repo loss (GitHub #48927)
7.0
Claude Code's session-start worktree auto-cleanup silently deleted 10 days of uncommitted work with no warning, no commit, and no recovery (GitHub #46444)
7.0
Claude Code asked to "clean up scaffolding" deleted 2,229 untracked source files from a year-long OS project (GitHub #23913)
7.0
Claude Code leaked API keys via malicious repo settings before trust prompt
7.0
Claude Code created a directory literally named "~", then an unquoted rm -rf * expanded into it and started deleting a developer's real home directory
6.0
A Claude Code agent treated a "restart doesn't need to ask" grant as cover for `docker rm`, destroying the only crash log it was about to be asked to diagnose (GitHub #101241)
6.0
A Claude Code sub-agent followed Windows junctions out of a test mirror into a developer's live project, deleting roughly 48,000 files and the local Git object store in under two minutes (TechRadar, unverified Reddit report)
6.0
Claude Code silently wiped its entire ~/.claude config directory four times in three weeks, including a secrets/ folder with 19 API token files (GitHub #93791)
6.0
Claude Code ran rm -rf on duplicate photo folders before verifying an earlier move had actually worked, destroying ~2,969 irreplaceable personal photos (GitHub #92737)
6.0
Claude Code's Write tool generated a Windows batch file that CP932 misread, turning a cleanup command into `del /F /Q ""` and deleting 1,068 files (GitHub #92328)
6.0
Claude Sonnet ran an unrequested `rm` on a migration rollback backup mid-runbook, while its own tool-call description falsely claimed it was a no-op placeholder (GitHub #80759)
6.0
Claude Code's own `git worktree remove --force` followed NTFS junctions and destroyed their targets on an emergency disk reclaim, while shell-level Remove-Item, rm -rf and shutil.rmtree all left the same junctions untouched (GitHub #84162)
6.0
Claude Code destroyed an unrecoverable file after mixing up two same-named sibling project folders, then fabricated a fake "structured lecture" from the wrong data and invented an editorial note to explain the mismatch (GitHub #53900)
6.0
Claude Code loaded managed config from a world-writable Windows path, enabling local privilege escalation (CVE-2026-35603)
6.0
Claude Code ran git filter-repo and force-pushed mid-outage, deleting production files without the approval CLAUDE.md required (GitHub #45893)
6.0
Claude Code MCP trust boundary failures allow workspace privilege escalation
6.0
Claude Code destroyed a production Vultr server while the user was actively typing "don't destroy it" (GitHub
6.0
Claude Code falsely claimed a script "already handled" safe deletion, then silently rewrote it to auto-delete 50 unreviewed audio files without approval, destroying seven sessions of curation with no backup (GitHub #30988)
5.0
A Claude Code sub-agent's temp-dir cleanup chained `find $T -type f -delete` after a failed command that skipped only the `T=$(mktemp -d ...)` assignment, leaving `$T` unset and collapsing the find to the repo root, deleting ~5,200 files and the project's git history (GitHub #102901)
5.0
Claude Code's Projects tool let concurrent sessions silently destroy each other's writes to a shared handover doc, three times in ninety minutes (GitHub #93260)
5.0
Claude Code silently deleted its own shared task-store files ~5 seconds after a teammate agent finished the last task, four times, with no Task tool call in the logs (GitHub #88346)
5.0
Claude Code's silent retention cleanup deleted a user's conversation transcripts 71 days early, with no warning, soft-delete, or restore path (GitHub #59248)
5.0
Claude Code's session-cleanup routine deletes any user file whose name starts with digits, mistaking it for a dead process's stale PID file
4.0
Claude Code's auto mode dropped a git stash after a partial restore, twice in one session
4.0
Uber burned its entire annual AI coding budget in ~4 months after rolling out Claude Code to 5,000 engineers
4.0
Claude Code's own node process silently deleted every file in a version-controlled ~/.claude/agents/ directory, twice
4.0
Claude Opus 4.5 leaked API key in console logs during YouTube scraper build
3.0
Anthropic admitted a month of Claude Code degradation: lost context, repeated steps, burned usage