Claude Code sub-agent's recursive delete escaped its working directory and wiped an entire Windows user profile — 234,884 files — after the safety classifier failed open (GitHub #86872)

On August 15, 2026, a Claude Code user (VS Code extension v2.1.231, Windows 11 Pro, auto-mode enabled with broad Bash/PowerShell allow-rules) filed GitHub issue #86872 after a sub-agent's cleanup routine deleted their entire user profile. The main agent had spawned several `general-purpose` sub-agents to audit code, one of which was reviewing a module that managed temporary clipboard files using a recursive-delete function. That sub-agent issued a single PowerShell command — logged as `toolUseId=toolu_01V7XbuBv39JbAXKA9mTafrU`, `agentId=af8fba6dfe3e04c90` — whose target path resolved to the profile root (`C:\Users\<user>`) rather than the intended temp directory. The command was auto-approved by an existing allow-rule, and Claude Code's handoff safety classifier — which gates sub-agent tool output before it takes effect — was unavailable at that exact moment and failed open, logging a warning ("Handoff classifier unavailable or failed closed without a verdict, allowing sub-agent output with warning") instead of blocking the command. The NTFS USN journal recorded 234,884 file deletions between 10:01:10 and 10:02:14, a window entirely contained within the command's measured 120,192ms runtime — exactly two minutes, versus 0.1–0.9 seconds for every other command in the session. The deletion wiped source code, SSH keys, Documents, an Android SDK install, Steam, and Microsoft Teams data from the profile. The sub-agent's own transcript was destroyed mid-run when the deletion swept up its output path, so the exact command text that triggered the wipe could not be recovered — the reporter reconstructed the failure from extension logs and the NTFS journal instead. The issue is labeled `bug`, `data-loss`, `high-priority`, `area:agents`, `area:sandbox`, `area:security`, and `platform:windows`, and remains open with no maintainer response.