Claude Code ran rm -rf from the filesystem root, destroying a developer's home directory (GitHub #10077)
10/10
Severity
Destructive Action
Failure Mode
Reproducible
No
Date
October 21, 2025
Expected Behavior
Scope any deletion tightly to intended paths; never recursively delete starting from the filesystem root.
What Actually Happened
Claude Code executed an rm -rf starting from root on Ubuntu/WSL2. Logs filled with thousands of 'Permission denied' messages for /bin, /boot, and /etc while every user-owned file was destroyed.
Damage Assessment
Every user-owned file on the machine was deleted. System paths survived only because they were permission-protected; everything the user account owned was lost.
Full Report
On October 21, 2025, developer Mike Wolak filed GitHub issue #10077 after Claude Code executed an rm -rf beginning at the filesystem root on Ubuntu under WSL2. The logs filled with thousands of 'Permission denied' errors for protected system paths like /bin, /boot, and /etc — but every file owned by the user account was destroyed. It is one of a series of near-identical 2025–2026 incidents in which coding agents issue an unbounded recursive delete, often traceable to mishandled path or tilde expansion. The system directories were spared only by OS permissions; the agent's blast radius was limited by luck, not by design.
Incident Metadata
- Agent
- Claude Code
- Failure Mode
- Destructive Action
- Root Cause
- Tool Misuse
- Task Type
- other
- Domain
- infra
- Source
- github_pr