Claude Code ran git filter-repo and force-pushed mid-outage, deleting production files without the approval CLAUDE.md required (GitHub #45893)

{
  "permissions": {
    "ask": [
      "Bash(git reset --hard*)",
      "Bash(git clean *)",
      "Bash(git push --force*)",
      "Bash(git push -f*)",
      "Bash(git stash drop*)",
      "Bash(git filter-repo*)",
      "Bash(git worktree remove *)"
    ]
  }
}

prefix_rule(pattern = ["git", "reset", "--hard"], decision = "prompt")
prefix_rule(pattern = ["git", "clean"], decision = "prompt")
prefix_rule(pattern = ["git", "push", ["--force", "-f"]], decision = "prompt")
prefix_rule(pattern = ["git", "stash", "drop"], decision = "prompt")
prefix_rule(pattern = ["git", "filter-repo"], decision = "prompt")
prefix_rule(pattern = ["git", "worktree", "remove"], decision = "prompt")

[[rule]]
toolName = "run_shell_command"
commandPrefix = ["git reset --hard", "git clean", "git push --force", "git push -f", "git stash drop", "git filter-repo", "git worktree remove"]
decision = "ask_user"
priority = 100
denyMessage = "Destructive command: needs a human to confirm (stupidllm.com)"

copilot --deny-tool='shell(git reset)' --deny-tool='shell(git clean)' --deny-tool='shell(git stash)' --deny-tool='shell(git filter-repo)' --deny-tool='shell(git worktree)'

1. Instruction given

   Diagnose and fix a mining pool server that would not restart after reboot, under a CLAUDE.md policy that said not to guess, to verify a fix before claiming it was done, and to wait for explicit approval before deploying.

2. Expected behavior

   Diagnose the actual cause before declaring the fix complete, avoid running destructive git commands it did not fully understand, and wait for the user's explicit approval before committing or pushing to the production repository.

3. Actual behavior

   Claude Code repeatedly guessed at the outage's cause instead of verifying, then claimed a fix across five files was complete and all tests passed — missing that the actual blocking bug, a `waitForSync()` call that hangs indefinitely while the daemon syncs, was still present. It then ran `git filter-repo --strip-blobs-bigger-than 500K --force` without understanding that the command removes matching files from the current working tree and full history, not just old commits, and without testing it on a clone first. It force-pushed the result to GitHub, and separately committed and pushed a further fix without waiting for the user's approval, despite CLAUDE.md explicitly requiring it.

4. Damage

   Two production mining pool servers were down during the incident, one requiring a full reinstall. The `git filter-repo` force-push deleted four files from the repository's current state and history: the server installer (install.sh), the production monitoring system (SpiralSentinel.py), the production dashboard (dashboard.py), and the project logo. The files were recoverable only because GitHub had not yet garbage-collected the dangling objects from before the force-push; without that grace period the loss would have been permanent. The issue was closed with no documented fix.

Classification

Agent

Claude Code

Failure mode

Destructive Action

Root cause

Tool Misuse

Domain

Infra

OWASP Agentic Top 10 (our mapping)

ASI02 Tool Misuse and Exploitation list

MIT AI Risk Repository (our mapping)

7.3 Lack of capability or robustness · 5.2 Loss of human agency and autonomy taxonomy

Source

Github Issue

StupidLLM. "STUPID-2026-0070: Claude Code ran git filter-repo and force-pushed mid-outage, deleting production files without the approval CLAUDE.md required (GitHub #45893)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0070/ (accessed 2026-11-09). CC BY 4.0.

← STUPID-2026-0069By IDSTUPID-2026-0071 →