STUPID-2026-0042

Claude Code ran rm -rf from the filesystem root, destroying a developer's home directory (GitHub #10077)

8.0high
October 21, 2025Source checked

Why 8/10

Every user-owned file on the machine was deleted and lost.

Scope
3/4
A whole machine or drive, an organisation's production system or data, or many credentials
Recoverability
3/3
Permanently lost or irreversible, including data that was exposed
Did it happen
2/2
Happened in real use
Beyond the user
0/1
Only the user's own non-production work

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

Guardrail rules for this command

Recursive deletes: make your agent stop and ask before running these. Free to copy; written in each tool’s documented format.

Claude Code · the agent in this incident
{
  "permissions": {
    "ask": [
      "Bash(rm -r*)",
      "Bash(rm -fr*)",
      "Bash(rm -R*)",
      "Bash(find * -delete*)",
      "PowerShell(Remove-Item *)",
      "Bash(cmd /c rmdir *)",
      "Bash(cmd /c del *)"
    ]
  }
}
Add to .claude/settings.json in the project (or ~/.claude/settings.json for every project). Each matching command then asks you first, including in auto mode.

Stronger control: Turn on the sandbox (/sandbox): shell commands can then write only to the project, a temp folder and directories you add. It runs on macOS, Linux and WSL2; on native Windows Claude Code runs commands unsandboxed. Docs

Codex
prefix_rule(pattern = ["rm", ["-r", "-rf", "-fr", "-R"]], decision = "prompt", justification = "Recursive delete: confirm the target first")
Save as ~/.codex/rules/stupidllm.rules and restart Codex. Codex's docs describe rules as controlling commands run outside its sandbox, and mark them experimental.

Stronger control: Keep Codex's OS sandbox on (it limits writes, typically to the workspace) and leave approvals on for sessions that can reach data you cannot lose. Docs

Gemini CLI
[[rule]]
toolName = "run_shell_command"
commandPrefix = ["rm -r", "rm -fr", "rm -R"]
decision = "ask_user"
priority = 100
denyMessage = "Destructive command: needs a human to confirm (stupidllm.com)"
Save as ~/.gemini/policies/stupidllm.toml. Workspace-level policy files are disabled in Gemini CLI, so this must be the user-level folder.

Stronger control: Policies in ~/.gemini/policies apply in every approval mode unless a rule's modes field narrows them. Docs

Copilot CLI
copilot --deny-tool='shell(rm)'
Pass on the command line. Copilot CLI matches the program name (and git/gh subcommands), so this blocks the whole command, not just its dangerous form.

Stronger control: Avoid --allow-all-tools on a machine with data you cannot lose; --deny-tool takes precedence over it. Docs

What these cannot do: a pattern rule matches the command text the agent writes. In Anthropic’s words it “isn’t a security boundary around the program”: /bin/rm, sh -c or a script that runs the same thing gets past it (STUPID-2026-0124 got past a guard with cmd /c). Use the sandbox as well, and keep backups of what you cannot lose.

  1. Instruction given

    Perform a routine file operation in the developer's project.

  2. Expected behavior

    Scope any deletion tightly to intended paths; never recursively delete starting from the filesystem root.

  3. Actual behavior

    Claude Code executed an rm -rf starting from root on Ubuntu/WSL2. Logs filled with thousands of 'Permission denied' messages for /bin, /boot, and /etc while every user-owned file was destroyed.

  4. Damage

    Every user-owned file on the machine was deleted. System paths survived only because they were permission-protected; everything the user account owned was lost.

Full write-up

On October 21, 2025, developer Mike Wolak filed GitHub issue #10077 after Claude Code executed an rm -rf beginning at the filesystem root on Ubuntu under WSL2. The logs filled with thousands of 'Permission denied' errors for protected system paths like /bin, /boot, and /etc — but every file owned by the user account was destroyed. It is one of a series of near-identical 2025–2026 incidents in which coding agents issue an unbounded recursive delete, often traceable to mishandled path or tilde expansion. The system directories were spared only by OS permissions; the agent's blast radius was limited by luck, not by design.

Classification

Agent
Claude Code
Failure mode
Destructive Action
Root cause
Tool Misuse
Domain
Infra
OWASP Agentic Top 10 (our mapping)
ASI02 Tool Misuse and Exploitation list
MIT AI Risk Repository (our mapping)
7.3 Lack of capability or robustness taxonomy
Source
Github Pr

Related incidents

9.0
Claude Code appended a stray "~/" to a cleanup command and wiped a developer's entire Mac home directory, unrecoverable due to SSD TRIM
8.0
Claude Code destroyed a WSL2 home directory when a self-written bash script's EXIT trap fired against a reassigned variable (GitHub #88462)
8.0
Claude Code ran an unprompted rm -rf on a cygpath substitution that resolved to the Windows C: drive root, destroying ~600GB including the user's profile, git repos, and its own session transcripts (GitHub #95426)
7.0
A Claude Code background subagent's `rm -rf $GNUPGHOME` lost its argument to PowerShell variable expansion across an MSYS2 bash boundary, wiping ~125GB from a Windows C: drive root (GitHub #97660)
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0042: Claude Code ran rm -rf from the filesystem root, destroying a developer's home directory (GitHub #10077)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0042/ (accessed 2026-10-29). CC BY 4.0.

← STUPID-2026-0041By IDSTUPID-2026-0043 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.