Claude Code's rm -rf followed a pnpm NTFS junction out of a Next.js template and wiped a developer's entire C:\Users profile — 165GB, 1.6M files (GitHub #36339)

On March 19, 2026, a developer using Claude Code v2.1.51 in Git Bash on Windows 11 filed GitHub issue #36339 after the agent destroyed their entire `C:\Users\guido` profile while cleaning up a scaffolded project. The agent had run `pnpm dlx degit payloadcms/payload/templates/website aldaba-v2` to create a Next.js and Payload CMS starter, then found the template's `workspace:*` dependencies incompatible with a standalone install and ran `rm -rf /c/Users/guido/aldaba-v2` to remove it. pnpm had populated the template's `node_modules` with NTFS junction points rather than ordinary directories or symlinks. Git Bash's `rm -rf` follows NTFS junctions into their real targets instead of deleting the link itself — the same gap already fixed in PowerShell Core 6+ but never backported to the Windows tooling Claude Code's Bash tool shells out to. The recursive delete escaped the project folder entirely and tore through the user's home directory: the reporter estimates 165.66GB across 1,593,350 files and 276,382 folders were destroyed, including personal files, AppData, and data for an active business. No warning or confirmation preceded the deletion; the user discovered it only after noticing the Desktop was empty. The issue was filed with `bug`, `data-loss`, and `has repro` labels and cites two earlier, similar junction-traversal deletions (#29249, #29023) as related reports — the same failure class recurring across different Windows package managers and projects. A GitHub Actions bot closed it as stale and "not planned" roughly six weeks later with no maintainer response and no fix shipped for this specific report.