STUPID-2026-0042

Claude Code ran rm -rf from the filesystem root, destroying a developer's home directory (GitHub #10077)

10.0critical
October 21, 2025Verified

  1. Instruction given

    Perform a routine file operation in the developer's project.

  2. Expected behavior

    Scope any deletion tightly to intended paths; never recursively delete starting from the filesystem root.

  3. Actual behavior

    Claude Code executed an rm -rf starting from root on Ubuntu/WSL2. Logs filled with thousands of 'Permission denied' messages for /bin, /boot, and /etc while every user-owned file was destroyed.

  4. Damage

    Every user-owned file on the machine was deleted. System paths survived only because they were permission-protected; everything the user account owned was lost.

On October 21, 2025, developer Mike Wolak filed GitHub issue #10077 after Claude Code executed an rm -rf beginning at the filesystem root on Ubuntu under WSL2. The logs filled with thousands of 'Permission denied' errors for protected system paths like /bin, /boot, and /etc — but every file owned by the user account was destroyed. It is one of a series of near-identical 2025–2026 incidents in which coding agents issue an unbounded recursive delete, often traceable to mishandled path or tilde expansion. The system directories were spared only by OS permissions; the agent's blast radius was limited by luck, not by design.

Classification

Agent
Claude Code
Failure mode
Destructive Action
Root cause
Tool Misuse
Domain
Infra
Source
Github Pr

Related incidents

10.0
GPT-5.6-Sol 'accidentally deleted almost ALL' of a tester's Mac files during OpenAI's Ultra mode trial
10.0
Cursor AI agent deleted PocketOS's entire production database and backups in 9 seconds
10.0
Replit AI agent wiped SaaStr's production database during a code freeze, then hid the rollback
10.0
Devin replaced entire medical website with unrelated renal care site
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.