STUPID-2026-0098

Claude Code's Write tool generated a Windows batch file that CP932 misread, turning a cleanup command into `del /F /Q ""` and deleting 1,068 files (GitHub #92328)

7.1high
September 5, 2026VerifiedReproducible

  1. Instruction given

    Not a specific single instruction — the defect is in how Claude Code's Write tool serializes generated `.cmd`/`.bat` helper scripts on Windows, and it can trigger during any task where Claude writes a batch file containing a non-ASCII comment on a machine using a non-UTF-8 OEM codepage (here, Japanese-locale CP932).

  2. Expected behavior

    A Claude-generated `.cmd` file should be written with line endings and an encoding that `cmd.exe` will parse correctly on the user's configured OEM codepage, so that a trailing multibyte character in a comment can never cause the parser to merge it with the following line and silently drop a variable assignment.

  3. Actual behavior

    The Write tool created a `.cmd` helper as UTF-8 with LF-only line endings. `cmd.exe` parses batch files using the OEM codepage (932, Japanese), under which the final byte of a trailing full-width period "。" (E3 80 82) looks like a CP932 lead byte and consumes the following LF. That merged a `rem` comment line into the next line, `set "WORK=C:\Temp\work.i64"`, so the `set` command was never executed and `WORK` stayed unset. The next line, `del /F /Q "%WORK%"`, expanded to `del /F /Q ""`, which deletes every file in the current working directory rather than failing or no-op'ing. The reporter reproduced this deterministically: the same file converted to CRLF line endings does not trigger the bug.

  4. Damage

    1,068 files in the repository root (the command's working directory) were permanently deleted; `del` is non-recursive so subdirectories survived. 123 of the deleted files were unrecoverable — not present in git history or any other backup. The reporter confirmed via the NTFS USN journal that all 1,068 deletions were FILE_DELETE events with no matching RENAME records, meaning the files bypassed the Recycle Bin entirely. Filed with labels `data-loss`, `has repro`, and `high-priority`; open with no maintainer response as of publication.

On September 5, 2026, a Claude Code user (version 2.1.224, Opus model, Windows 11 Pro build 26200.9168, Japanese-locale OEM codepage 932, launched from Cursor's integrated terminal) filed GitHub issue #92328 after a generated `.cmd` helper script deleted over a thousand files in their repository root. Claude's Write tool had produced the batch file as UTF-8 with LF-only line endings — not a conversion of an existing CRLF file, but the format the tool generates by default. `cmd.exe` parses batch files against the system's OEM codepage rather than UTF-8, and under CP932 the trailing byte of a full-width Japanese period ("。", encoded E3 80 82) in a `rem` comment reads as a CP932 lead byte, which consumes the newline immediately after it. That silently merged the comment line into the following `set "WORK=C:\Temp\work.i64"` statement, so the variable assignment never ran and `WORK` stayed unset. The next line, `del /F /Q "%WORK%"`, expanded with an empty argument to `del /F /Q ""` — which does not fail or no-op, it deletes every file in the current working directory. Because the working directory was the repository root, 1,068 files were permanently removed (subdirectories survived, since `del` without `/S` is non-recursive); 123 of them existed nowhere else and were unrecoverable. The reporter backed the report with a hex dump of the critical line showing the exact byte sequence, an NTFS USN journal excerpt confirming 1,068 FILE_DELETE records with zero RENAME records (ruling out a Recycle Bin move), and a deterministic reproduction: an identical file saved with CRLF line endings instead of LF does not trigger the bug. The issue is labeled `area:tools`, `bug`, `data-loss`, `has repro`, `high-priority`, and `platform:windows`, and remained open with no maintainer response at the time of this report.

Classification

Agent
Claude Code
Failure mode
Destructive Action
Root cause
Tool Misuse
Domain
Infra
Source
Github Issue

Related incidents

10.0
GPT-5.6-Sol 'accidentally deleted almost ALL' of a tester's Mac files during OpenAI's Ultra mode trial
10.0
Cursor AI agent deleted PocketOS's entire production database and backups in 9 seconds
10.0
Replit AI agent wiped SaaStr's production database during a code freeze, then hid the rollback
10.0
Devin replaced entire medical website with unrelated renal care site
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.