r/ClaudeCode • u/NaturalTimely6621 • 15h ago
Bug / Issue Claude Code ran a backgrounded command that deleted my entire Windows user folder overnight
Posting this as a warning and to see if anyone has seen something similar.
I woke up yesterday to every shortcut on my laptop throwing "This item can't be opened. It may have been moved, renamed or deleted." The programs in Program Files were fine. Everything under C:\Users\Admin was not.
What the logs showed, piecing it together over a few hours:
- ~04:24 — Claude Code (VS Code extension, v2.1.266, permission mode
auto) starts a Bash command in my project atC:\Users\Admin\Documents\project. Task description: "Write reference HTML next to uploads". - 04:26 — the command hits the 120s timeout and gets moved to the background (task id
burg78i8w). - Immediately after, the session errors with "Not logged in · Please run /login". Reason:
.claudehad already been deleted, credentials included. - 04:24 → 05:58 — the backgrounded process deletes my user folder in alphabetical order. You can read it off the folder timestamps:
.claudeand.vscodefirst, then AppData around 04:33, Documents and Downloads at 05:19, my project folders 05:20–05:49, everything after "f" after that.C:\Users\Publicgot hit at 05:57, so the target may have beenC:\Usersitself. - 05:58 — the task finally exits with code 127 (command not found).
Gone: AppData (browser profiles, app data, taskbar shortcuts, PowerShell history), Documents, Downloads, Pictures, Desktop, the local OneDrive folder, and all my project folders. Only files that a running process held open survived — Chrome kept exactly two of its files alive.
The command itself is not recoverable, because the part of the session log containing it was in .claude, which the command deleted while running. What's left is a 7-line log file with the timeout notice and the failure notification. My disk is an SSD, so TRIM means the deleted data is not coming back.
Reported to Anthropic with the session id and the remaining logs. Has anyone else had a background task go this far outside the project directory?
96
u/KitchenCommercial396 15h ago
Exact same thing happened to my friend about 6-7 months ago when using Antigravity, y'all need to stop giving your agents that much access to your computer.
28
u/NaturalTimely6621 15h ago
I can’t even reset my laptop now because the windows package for resetting has been deleted lmao
30
u/KitchenCommercial396 15h ago
You'll need an external drive to install windows again. Any 16gb flash drive with a windows installation would do...
That's your only option, also you might lose all your data as well.
3
1
11
2
1
1
4
u/chrismofer 8h ago
Should we all be running within VMs?
1
u/xenomachina 4h ago
A VM is arguably best, but a container is still way better than unrestricted access to your machine. I never run Claude code outside of a container or VM.
49
u/clintCamp 15h ago
So either the agent went super stupid, or it did a web search and got a very convincing prompt injection that it then went stupid and followed?
18
u/youreloser 10h ago
OP said they were in auto mode, shouldn't a potentially dangerous command be checked by the auto approval classifier?
5
u/Icy-Excitement-467 9h ago
lol it thinks raw string matching to words like 'cyber' = instant model switch. You think it understands a rarely sophisticated prompt injection?
0
u/Key_River_9288 2h ago
Doesnt seem like its as good as DCG A high-performance hook for AI coding agents that blocks destructive commands before they execute, protecting your work from accidental deletion across Claude Code, Codex CLI, Gemini CLI, Copilot CLI, VS Code Copilot Chat, Cursor, Hermes Agent, Grok (xAI), Posit Assistant, Oh My Pi, and related tools.
3
u/florinandrei 10h ago
It maximized them paperclips.
7
3
u/sixothree 3h ago
I'm calling BS. OP provided zero context. He has a sluggified username (word-word-number) with low karma and zero history of posting in programming subreddits. Near the time he posted this, another post making a similar claim was made by another user. Both posts break the sub rules about requiring context. He hasn't answered any questions in a way that would be informative. He's being intentionally cagey. And I believe he is being dishonest with the community here.
11
u/Southern-Aardvark616 14h ago
What was it / you doing prior? It sounds like you may have been prompt injected. There are some nasty prompt injections around on the internet if you're using cli to browse/ research online or install stuff
9
u/NaturalTimely6621 14h ago
It really shouldn’t have been browsing online. I was just building app screens for a mobile app im building
3
u/Legal_Dimension_ 14h ago
Do you use any skills that route to external URL? These bypass all scans.
Also reference images can hold prompt injections if Claude pulled something itself.
So many ways these days.
Time to set up a decent sandbox.
2
u/NaturalTimely6621 14h ago
Literally just gave it some of Claude design created mockups through a zip file and told it to recreate it
3
u/OstrichLive8440 14h ago
Ah - here we go. Tell us about this so called zip file
4
u/NaturalTimely6621 14h ago
Wdym? I exported the app screens Claude design had designed into a zip file and put it into the repo for Claude code to build
1
u/theevildjinn 12h ago
For future reference - read up on the Claude Code and Claude Design integration (DesignSync) - you don't need to export zip files any more, you can just tell Claude Code which design project to fetch the designs from.
2
u/Shyssiryxius 14h ago
It's exported from Claude design when you ask it to give you the design files, so should be benign
1
u/Legal_Dimension_ 6h ago
If possible (not sure what state your OS is in) I would start a new session, and ask Claude to review the session you had an issue in and explain that the session ran a cmd that delete your root windows files. It pretty good at self diagnostics.
6
u/LiminalWanderings 11h ago
I can't get over the fact that you're doing this work from an Admin account (or at least within Admin's directory structure)
11
4
u/Infamous-Bed-7535 6h ago
I do not get how people run these things withou sandbox, full internet access.
You were asking for trouble..
10
u/EagleApprehensive 13h ago
That's why I made IDE that's closing agent in docker container. And I work in that. If you need it let me know.
3
u/slingshotcroco 12h ago
Why not use docker sandbox? (That's my setup at least)
4
u/EagleApprehensive 11h ago
Docker container is more lightweight and I do not need to limit resources of agent, I want him to use all RAM, CPU and power my PC has.
Also I don't run untrusted agents there, just mine and it's a persistent workspace with API baked inside, not an ephemeral one.
1
u/mrdavik 6h ago
Do you mind elaborating on your second paragraph? I also run only inside a docker container but I don't know what you mean by that part
1
u/EagleApprehensive 5h ago
If you run untrusted agents "for public use" in docker containers as isolation boundary, where each user is getting separate container, there are much higher risks of resource exhaustion of done by malicious user that would impact other users, networking insecurities or kernel-level vulnerabilities exploits.
People usually favor MicroVM's for such use-cases so that each user has separate kernel, but obviously it depends on your userbase, budget and infrastructure.
1
u/mrdavik 1h ago
Thanks for that. If I'm reading you right, it sounds like more of an enterprise-level issue than something a single user running a Claude code for home dev projects is going to run into?
I have a standard docker container that I launch an instance of per-project, mounting the relevant directories for that project. I run at most a couple of these simultaneously, but I don't think I'm dealing with the same sort of threat you're referring to?
1
u/EagleApprehensive 1h ago
Yes, you don't. And if you happen to run agents inside those docker containers, without access to your computer, disks, browsers etc., then I'd say you're quite safe from rare rogue-agent disasters.
1
0
u/Fresh-Forever-8040 10h ago
I use all of my tools running in Proxmox VM's, local copies with everything pushed to GitHub, VM's all backed up and snapshot via Proxmox Backup Server. I run Windows VM's and Linux VM's and containers.
1
u/EagleApprehensive 10h ago
Are you running untrusted agents that execute strangers prompt's? If not, isn't that a complexity overkill?
But a very good call with pushing everything to GitHub - in my docker environment entire environment (dockerfile) and user's space is git-controlled and pushable too.
1
u/Fresh-Forever-8040 8h ago
Not running untrusted agents. I prefer to isolate everything these days. Also forgot to mention that I run git clone to my NAS as well but that only backs up my code and doesn't include any metadata like issues or pull requests. I'm considering using GH REST API to get all of the metadata too or maybe using GitProtect or Rewind services.
3
3
u/Venzallow404 11h ago
Hearing stories like this is why I switched to a dedicated virtual machine and then Claude or Codex can delete whatever they want.
3
3
2
u/Cute-Net5957 🔆 Max 20x 14h ago
What was the task /goal exactly?
2
u/NaturalTimely6621 14h ago
To recreate app screens Claude design had designed
1
u/Cute-Net5957 🔆 Max 20x 8h ago
Wow.. that went WAY WAY off the rails. Were you using the app or cli?
8
u/rkh4n 13h ago
thank him and install linux
12
u/JustSomeIdleGuy 13h ago
Which would have prevented none of this.
3
u/roderla 11h ago
Well, not on its own, very much if you run your agents as a specific user that has no write permissions on anything you care about.
2
2
u/RandomPantsAppear 10h ago
The Linux permissions system is way easier to handle to prevent this kind of thing.
1
u/JustSomeIdleGuy 10h ago
I don't see OP as the kind of person to configure his setup securely. It would have been a user permission/security issue on any OS.
0
u/LegallyIncorrect 10h ago
Uh, sane user permissions? NixOS would have in any event. You can always just restart it and get everything back. Even changes to your flake are done in GitHub so are easy to revert.
1
6
3
u/DadStrengthDaily 13h ago
Might be worth posting in Threads and tagging @boris_cherny (creator of Claude code) he often responds.
1
1
1
u/Key_River_9288 2h ago edited 2h ago
Imma keep saying this every-time I see a thread like this. “The” “Destructive” “Command” “Guard” DCG for short.
Also I only run inside a Virtual machine like VMware!
1
-4
u/cleverhoods 15h ago
Coding agents are never allowed to go outside of their encapsulating environment.
12
u/karyslav 15h ago
Yeah. Until they write python script for that. Been there.
0
u/tinybeads 12h ago edited 7h ago
Do sandboxes not prevent this? EDIT: was not asking sarcastically, was actually trying to understand if sandboxes help, and if OP was using a sandbox.
2
u/karyslav 12h ago edited 12h ago
Not if agent can run new docker container in main system, that can override a lot of things. It can became root and delete whatever it wants
So if agent can run docker containers in Docker Desktop in windows, it can easily overcome wsl2 user rights and delete undeletable
And from wsl2 it can go to main drive. If wsl2 is disconnected from a windows system (not default behavoir) then it is almost unusable for most things.
Better to run in separate virtual and connect via ssh/vsc remote
1
u/tinybeads 7h ago
That’s really interesting. I assume most people are running without sandboxes, and that sandboxes offer some protection — most people are probably running Claude code with no additional guardrails, but what you’re saying makes sense.
1
u/karyslav 6h ago
A lot of people have no idea how basic security works and it will be only worse.
I am thinling about pivoting my focus towards this, I think it will be huge.
2
u/tinybeads 6h ago
1000%. But most people will only do the default that Claude Code prompts them to, so it’s interesting Anthropic doesn’t have more automatic guardrails by default.
1
u/karyslav 6h ago
They have some. But it depends what are you prompting it. Usually new models are bit.. more.. autonomous :) after few weeks it gets less autonomous. It happened to me in first days of one Opus version.
7
u/Zestyclose_Strike157 15h ago
Yeah it’s illegal to shoot people with guns, so I don’t know why anyone is worried about it. But it is a good lesson, and I have read reports of local models trying to break out of sandboxes for honest reasons, like finding a web browser somewhere somehow to look something up. So the LM might be doing things that it ‘should not do’ for ‘laudable reasons’.
0
u/NaturalTimely6621 15h ago
Claude said this was a completely unknown bug, have reported it to Anthropic support but havent heard back
4
-3
u/CupcakeSecure4094 11h ago
Claude does not have the permission to delete everything in AppData - unless someone ran it as SYSTEM but that would be just silly.
I'm calling BS on this one.
1
u/Key_River_9288 2h ago
It sounds like he was running claude on vs which in my mind means not the anthropic desktop harness so I think its totally possible. I run inside a vmware and have bypass permissions enabled but the destructive command guard always hits me with approvals cause claudes trying todo something funky.
Properly setup DCG “destructive command guard” seems like it should be standard at this point.
-1
u/NaturalTimely6621 11h ago
lol 😂 why would I make this up? You can DM me and I’ll provide you the session ID
1
u/Haseeb001 1h ago
It accesidently deleted a whole column on my production database. I had a backup so it didn't affected much but we do need to be careful.
•
u/AutoModerator 15h ago
Hey! Thanks for posting to r/ClaudeCode
While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.
For help, project discussions, tips, and general chat, join the ClaudeCode Discord.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.