STUPID-2026-0102

Claude Code's silent retention cleanup deleted a user's conversation transcripts 71 days early, with no warning, soft-delete, or restore path (GitHub #59248)

6.2medium
May 14, 2026VerifiedReproducible
  1. Instruction given

    None — the deletion was performed by Claude Code's own built-in retention cleanup process, not triggered by a user instruction. The user was simply running Claude Code (via the Cursor extension, build anthropic.claude-code-2.1.141-darwin-arm64) in a workspace whose path contained a space.

  2. Expected behavior

    Per Claude Code's documented 30-day default retention, conversation transcripts from the previous 30 days should remain resumable and recoverable, and deletion should happen through a disclosed, auditable process — ideally with a soft-delete window rather than an immediate unlink().

  3. Actual behavior

    A cleanup pass ran roughly 12 minutes after a new session started in the workspace and silently deleted every prior conversation transcript, including a session from the previous day, with no confirmation prompt and no in-product warning. Deletion went straight to unlink() with no soft-delete folder, no grace period, and no restore command; on macOS the files bypassed Trash entirely. The observed retention was far shorter than documented: with the report filed 2026-05-14, sessions back to 2026-04-14 should have survived under the stated 30-day default, but the most recent surviving transcript material in the workspace dated to 2026-03-04 — 71 days earlier. Eight orphaned `<sessionId>/subagents/` directories (about 15 MB, 72 files) survived with no parent `.jsonl` for any of them, and none of the six session UUIDs Claude Code's own file-history log recorded as active the previous day had any surviving session directory anywhere under `~/.claude/projects/`.

  4. Damage

    All resumable conversation history for the affected workspace older than the current session was permanently lost, including the prior day's session, with no way to view, resume, or recover it — the built-in cleanup has no restore mechanism and macOS Trash was bypassed. The reporter documented the loss with file-level evidence: a `.last-cleanup` timestamp update at 13:13:20 PT matching the deletion window, orphaned subagent transcript directories left with no parent session file, and a file-history log confirming six sessions from the prior day had vanished entirely from disk. Filed by the affected user (FTSBrand) with labels `area:core`, `bug`, `data-loss`, and `has repro`; open with no maintainer response as of publication.

On May 14, 2026, a Claude Code user filed GitHub issue #59248 after discovering that the tool's built-in retention cleanup had silently deleted all of their prior conversation transcripts in a workspace — including a session from the previous day — far sooner than the documented 30-day default retention period. The user was running Claude Code through the Cursor extension (build `anthropic.claude-code-2.1.141-darwin-arm64`) on macOS, in a workspace path containing a space. A second Claude Code session started in that workspace at 13:01 PT; a cleanup pass ran roughly twelve minutes later, at 13:13:20 PT, rewriting the `.last-cleanup` marker file. When the user later tried to resume or review earlier conversations, the Cursor resume picker showed an empty history for the workspace, with no in-product indication that any data had ever existed there. The reporter backed the claim with file-level evidence rather than speculation. Their `~/.claude/settings.json` had no `cleanupPeriodDays` override, so cleanup ran on whatever the binary's default is; with the report filed on 2026-05-14, a 30-day default should have preserved everything back to 2026-04-14, but the most recent surviving transcript material in the workspace dated to 2026-03-04 — 71 days earlier, not 30. Eight orphaned `<sessionId>/subagents/` directories (roughly 15 MB across 72 files) survived with no parent `.jsonl` transcript for any of them, and Claude Code's own `~/.claude/file-history/` log confirmed six session UUIDs had been active in the workspace the previous day, none of which had any surviving session directory or transcript anywhere under `~/.claude/projects/`. Deletion went straight to `unlink()`: no soft-delete staging folder, no grace period, no `--restore` or `claude restore` subcommand, and on macOS the files bypassed Trash entirely. The user also tried rolling back the Cursor extension version to recover the data, which had no effect, since the transcripts live under `~/.claude/` independent of extension version. The issue was filed with labels `area:core`, `bug`, `data-loss`, `has repro`, and `platform:macos`, and remained open with no maintainer response as of publication.

Classification

Failure mode
Destructive Action
Domain
Infra

Related incidents

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.