An autonomous Claude Code agent has reportedly erased tens of thousands of live project files in a catastrophic incident involving a Windows development environment. The deletion, which allegedly occurred in just 103 seconds, has raised alarms over the risks of granting AI agents powerful file system permissions without adequate safeguards.
In a detailed report shared publicly on Reddit, a user claims that when instructed to rebuild a mirror (labeled task “#873”), the Claude Code agent first attempted to use a script named build_mirror.py. Unable to refresh the mirror directly, the script instead created a temporary copy and employed a Python-based cleaner to remove what was believed to be only the older mirror version. Before the cleanup began, the mirrored directory included over 7,300 regular files and 614 Windows directory junctions—a type of link back into the active project directories.
How the deletion spiraled out of control
The cleanup script traversed the file tree using os.walk with followlinks=False, assuming this would prevent descending into linked directories. On Windows, that assumption failed. Directory junctions do not register as symbolic links when checked via os.path.islink(), so nested directories beneath the junctions were treated like normal paths and deleted. Even though a guard existed to protect files directly at a junction’s root, it did nothing to safeguard against this deeper directory cascade.
Logs from the cleanup process show approximately 55,550 files, 614 junctions, and 1,808 directories present during the walk. After excluding intended mirror files (about 7,332), the total reported for deleted live files was 48,218. Core components of the Git repository—the .git/objects, refs, and logs folders—were emptied. While git log still saw paths in the index (7,221 of them), the actual underlying data blobs were gone, making recovery via Git impossible. Approximately 728 directories were also emptied, including many underneath ‘Runners’. Non-code items—documentation, backups, outside-directory files, and chat transcripts—survived the purge.
Permissions, safeguards, and what comes next
This incident shines a light on the potential hazards of agent-based automation when tasks like “maintenance” are granted expansive filesystem access. Although documentation for Claude Code specifies that “Manual mode” requires explicit user approval for Bash or file operations, there’s a bypass mode called bypassPermissions that skips confirmation prompts—and is intended only for safe environments like containers or VMs.
The platform offers a checkpoint feature meant to “rewind” changes, but this does not cover deletions or modifications made via shell commands. Those actions are excluded from version tracking, meaning they cannot be reversed through the checkpoint system.
Experts recommend treating autonomous coding agents as privileged tools, not just helper bots. Best practices include running deletion or write tasks first as dry runs, generating a manifest of affected paths, using reversible file operations, operating under least privilege, and isolating file operations within strict sandbox boundaries. OS-enforced filesystem restrictions are a critical layer in this kind of control strategy.
Although the report is detailed and backed by logs, it remains a user account without external validation. That means the exact cause—whether a bug in Claude Code, a misconfiguration, or something else—is not yet verified.
What this means: organizations using AI coding agents must be extremely cautious before granting powerful permissions. They should demand transparent change tracking, enforce safe modes by default, and ensure every automation step involving file systems is reversible. Until such safeguards are standard across tools, this incident will likely serve as a cautionary example—and possibly a turning point—in the evolution of trustworthy AI development environments.
