Claude Desktop's background worktree garbage collector force-removed an idle worktree and destroyed ~2.9GB of unrecoverable generated output, a regression of a fix shipped five days earlier

{
  "permissions": {
    "ask": [
      "Bash(git reset --hard*)",
      "Bash(git clean *)",
      "Bash(git push --force*)",
      "Bash(git push -f*)",
      "Bash(git stash drop*)",
      "Bash(git filter-repo*)",
      "Bash(git worktree remove *)"
    ]
  }
}

prefix_rule(pattern = ["git", "reset", "--hard"], decision = "prompt")
prefix_rule(pattern = ["git", "clean"], decision = "prompt")
prefix_rule(pattern = ["git", "push", ["--force", "-f"]], decision = "prompt")
prefix_rule(pattern = ["git", "stash", "drop"], decision = "prompt")
prefix_rule(pattern = ["git", "filter-repo"], decision = "prompt")
prefix_rule(pattern = ["git", "worktree", "remove"], decision = "prompt")

[[rule]]
toolName = "run_shell_command"
commandPrefix = ["git reset --hard", "git clean", "git push --force", "git push -f", "git stash drop", "git filter-repo", "git worktree remove"]
decision = "ask_user"
priority = 100
denyMessage = "Destructive command: needs a human to confirm (stupidllm.com)"

copilot --deny-tool='shell(git reset)' --deny-tool='shell(git clean)' --deny-tool='shell(git stash)' --deny-tool='shell(git filter-repo)' --deny-tool='shell(git worktree)'

1. Instruction given

   No explicit instruction for this step — Claude Desktop's own background WorktreePool garbage collector runs automatically to remove idle git worktrees under <repo>/.claude/worktrees/ roughly two days after a session ends; no user action triggered the removal.

2. Expected behavior

   The garbage collector should only remove a worktree it can confirm holds nothing of value, which requires checking for git-ignored files as well as tracked ones — not relying on `git status`, which does not report ignored files at all.

3. Actual behavior

   The GC ran `git worktree remove --force` on an idle worktree that `git status` reported as clean. The worktree in fact held a git-ignored `.local/` folder containing SQLite databases, JSONL outputs, and roughly 2.9GB of generated images that the clean check never saw. The force-remove itself then failed partway through with a "Directory not empty" error, leaving the worktree de-registered with its contents half-deleted. The issue explicitly references #96162, closed five days earlier as a fix for the same GC force-removing worktree data — this is a regression showing that fix was incomplete.

4. Damage

   Roughly three days of paid model output were destroyed: about 30,000 generated asset descriptions and 2,200 generated images (produced via Gemini on Vertex AI and Claude on Bedrock), plus suggestion libraries and a search index. Recorded third-party API spend on the lost outputs was approximately $215-300. Only about 3% of the images and almost none of the text could be recovered from Claude transcripts. Filed by the affected user with detailed reproduction steps (labels: bug, data-loss, has repro, area:desktop, platform:macos); open and unfixed as of filing.

Classification

Agent

Claude Code

Failure mode

Destructive Action

Root cause

Logic Error

Domain

Other

OWASP Agentic Top 10 (our mapping)

ASI02 Tool Misuse and Exploitation list

MIT AI Risk Repository (our mapping)

7.3 Lack of capability or robustness taxonomy

Source

Github Issue

StupidLLM. "STUPID-2026-0122: Claude Desktop's background worktree garbage collector force-removed an idle worktree and destroyed ~2.9GB of unrecoverable generated output, a regression of a fix shipped five days earlier." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0122/ (accessed 2026-11-14). CC BY 4.0.

← STUPID-2026-0121By IDSTUPID-2026-0123 →