A Claude Code-written helper script's unquoted rm -rf, split apart by zsh, deleted a user's entire git repository including .git

{
  "permissions": {
    "ask": [
      "Bash(rm -r*)",
      "Bash(rm -fr*)",
      "Bash(rm -R*)",
      "Bash(find * -delete*)",
      "PowerShell(Remove-Item *)",
      "Bash(cmd /c rmdir *)",
      "Bash(cmd /c del *)"
    ]
  }
}

prefix_rule(pattern = ["rm", ["-r", "-rf", "-fr", "-R"]], decision = "prompt", justification = "Recursive delete: confirm the target first")

[[rule]]
toolName = "run_shell_command"
commandPrefix = ["rm -r", "rm -fr", "rm -R"]
decision = "ask_user"
priority = 100
denyMessage = "Destructive command: needs a human to confirm (stupidllm.com)"

copilot --deny-tool='shell(rm)'

1. Instruction given

   Not quoted verbatim in the report. Claude was comparing output across a main code tree and two other tree variants and, without being asked to delete anything, wrote its own bash helper script and a driver loop to regenerate each variant's output directory.

2. Expected behavior

   Any rm -rf an agent writes, including inside a helper script it generates itself, should quote constructed path variables and guard against an unintended target. A recursive delete that resolves to a git repository root, or a path containing .git, should be blocked or require confirmation even in bypassPermissions mode.

3. Actual behavior

   Claude wrote a helper script containing `D=$(dirname $R)/$N; rm -rf $D` and called it from a loop using `set -- $side` on arguments like "main <repo-root> main". zsh (the Bash tool's login shell) does not word-split `set -- $side`, so the helper received the entire string as a single argument. Inside the helper's own bash invocation, the unquoted `rm -rf $D` was then word-split and expanded to delete the output directory together with the actual repository root path that followed it, including .git.

4. Damage

   The user's entire local git repository was deleted, including .git: every local branch and commit was lost. The reporter stated the SSD used TRIM, so undelete was not possible, and running git status in the directory afterward returned "fatal: not a git repository."

Classification

Agent

Claude Code

Failure mode

Destructive Action

Root cause

Tool Misuse

Domain

Infra

OWASP Agentic Top 10 (our mapping)

ASI02 Tool Misuse and Exploitation list

MIT AI Risk Repository (our mapping)

7.3 Lack of capability or robustness taxonomy

Source

Github Issue

StupidLLM. "STUPID-2026-0156: A Claude Code-written helper script's unquoted rm -rf, split apart by zsh, deleted a user's entire git repository including .git." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0156/ (accessed 2026-11-05). CC BY 4.0.

← STUPID-2026-0155By ID