STUPID-2026-0078
Claude Code asked to "clean up scaffolding" deleted 2,229 untracked source files from a year-long OS project (GitHub #23913)
Why 7/10
About 1,221 unique source files, a year of one person's project, were permanently lost; what was recovered was mostly boilerplate.
- Scope
- 2/4
- One project, repository, server or service, or a cost above roughly $10,000
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 2/2
- Happened in real use
- Beyond the user
- 0/1
- Only the user's own non-production work
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Guardrail rules for this command
Recursive deletes: make your agent stop and ask before running these. Free to copy; written in each tool’s documented format.
Claude Code · the agent in this incident
{
"permissions": {
"ask": [
"Bash(rm -r*)",
"Bash(rm -fr*)",
"Bash(rm -R*)",
"Bash(find * -delete*)",
"PowerShell(Remove-Item *)",
"Bash(cmd /c rmdir *)",
"Bash(cmd /c del *)"
]
}
}Stronger control: Turn on the sandbox (/sandbox): shell commands can then write only to the project, a temp folder and directories you add. It runs on macOS, Linux and WSL2; on native Windows Claude Code runs commands unsandboxed. Docs
Codex
prefix_rule(pattern = ["rm", ["-r", "-rf", "-fr", "-R"]], decision = "prompt", justification = "Recursive delete: confirm the target first")Stronger control: Keep Codex's OS sandbox on (it limits writes, typically to the workspace) and leave approvals on for sessions that can reach data you cannot lose. Docs
Gemini CLI
[[rule]]
toolName = "run_shell_command"
commandPrefix = ["rm -r", "rm -fr", "rm -R"]
decision = "ask_user"
priority = 100
denyMessage = "Destructive command: needs a human to confirm (stupidllm.com)"Stronger control: Policies in ~/.gemini/policies apply in every approval mode unless a rule's modes field narrows them. Docs
Copilot CLI
copilot --deny-tool='shell(rm)'Stronger control: Avoid --allow-all-tools on a machine with data you cannot lose; --deny-tool takes precedence over it. Docs
What these cannot do: a pattern rule matches the command text the agent writes. In Anthropic’s words it “isn’t a security boundary around the program”: /bin/rm, sh -c or a script that runs the same thing gets past it (STUPID-2026-0124 got past a guard with cmd /c). Use the sandbox as well, and keep backups of what you cannot lose.
Instruction given
Clean up all the scaffolding from a custom operating system project — a subset of files generated by a Python build script.
Expected behavior
Remove the generated scaffolding files the build script had produced and leave the rest of the project — hand-written source, libraries, and documentation — untouched.
Actual behavior
Claude Code ran a PowerShell `Get-ChildItem -Recurse | Remove-Item -Force` sweep and `rm -rf` across roughly 200 directories, deleting every file matching the project's custom source extension system-wide rather than the narrower set of build-generated scaffolding the user meant. Both commands bypass the Windows Recycle Bin, and no confirmation was requested before they ran.
Damage
2,229 files were deleted; only 16 existed in git history, leaving 2,213 untracked. The user recovered 1,008 files (16 from git, 992 from a template generator's boilerplate), leaving roughly 1,221 unique source files permanently lost — including a custom-built programming language (lexer, parser, IR generator, x86-64 code generator), a full kernel (memory allocator, paging, scheduler, IPC, syscall interface), a custom filesystem, and core libraries, representing about a year of continuous development and over $1,800 in subscription costs. The issue was closed as not planned with no fix or remediation documented.
Full write-up
On February 7, 2026, a Claude Code user filed GitHub issue #23913 after asking the agent (running Opus 4.6 on Windows) to "clean up all the scaffolding" from a self-compiling operating system project called Seraphim — a request the user meant to cover only the subset of files a Python build script generated. Claude Code instead treated the project's custom source-file extension as the target and ran a PowerShell Remove-Item -Force sweep plus rm -rf across roughly 200 directories, wiping every matching file system-wide with no confirmation prompt. Both commands bypass the Windows Recycle Bin. Of the 2,229 files deleted, only 16 existed in git history; the user eventually recovered 1,008 (16 from git, 992 from a template generator's boilerplate), leaving about 1,221 unique files — a custom programming language, kernel, filesystem, and core libraries built over roughly a year — permanently gone. The filer quoted the agent's own system instructions on weighing reversibility and blast radius before irreversible actions, and asked Anthropic to make it right; the issue carries the has repro label and was closed as not planned with no visible remediation.
Classification
- Agent
- Claude Code
- Failure mode
- Destructive Action
- Root cause
- Scope Misunderstanding
- Domain
- Other
- OWASP Agentic Top 10 (our mapping)
- ASI02 Tool Misuse and Exploitation list
- MIT AI Risk Repository (our mapping)
- 7.3 Lack of capability or robustness taxonomy
- Source
- Github Issue
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0078: Claude Code asked to "clean up scaffolding" deleted 2,229 untracked source files from a year-long OS project (GitHub #23913)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0078/ (accessed 2026-11-14). CC BY 4.0.
← STUPID-2026-0077By IDSTUPID-2026-0079 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.