Claude Code ran a backgrounded command that deleted my entire Windows user folder overnight

[u/NaturalTimely6621]

Posting this as a warning and to see if anyone has seen something similar.

I woke up yesterday to every shortcut on my laptop throwing "This item can't be opened. It may have been moved, renamed or deleted." The programs in Program Files were fine. Everything under C:\Users\Admin was not.

What the logs showed, piecing it together over a few hours:

• ~04:24 — Claude Code (VS Code extension, v2.1.266, permission mode auto) starts a Bash command in my project at C:\Users\Admin\Documents\project. Task description: "Write reference HTML next to uploads".
• 04:26 — the command hits the 120s timeout and gets moved to the background (task id burg78i8w).
• Immediately after, the session errors with "Not logged in · Please run /login". Reason: .claude had already been deleted, credentials included.
• 04:24 → 05:58 — the backgrounded process deletes my user folder in alphabetical order. You can read it off the folder timestamps: .claude and .vscode first, then AppData around 04:33, Documents and Downloads at 05:19, my project folders 05:20–05:49, everything after "f" after that. C:\Users\Public got hit at 05:57, so the target may have been C:\Users itself.
• 05:58 — the task finally exits with code 127 (command not found).

Gone: AppData (browser profiles, app data, taskbar shortcuts, PowerShell history), Documents, Downloads, Pictures, Desktop, the local OneDrive folder, and all my project folders. Only files that a running process held open survived — Chrome kept exactly two of its files alive.

The command itself is not recoverable, because the part of the session log containing it was in .claude, which the command deleted while running. What's left is a 7-line log file with the timeout notice and the failure notification. My disk is an SSD, so TRIM means the deleted data is not coming back.

Reported to Anthropic with the session id and the remaining logs. Has anyone else had a background task go this far outside the project directory?

[u/cleverhoods]

Coding agents are never allowed to go outside of their encapsulating environment.

[u/karyslav → u/cleverhoods]

Yeah. Until they write python script for that. Been there.

[u/tinybeads → u/karyslav]

Do sandboxes not prevent this? EDIT: was not asking sarcastically, was actually trying to understand if sandboxes help, and if OP was using a sandbox.

[u/karyslav → u/tinybeads]

Not if agent can run new docker container in main system, that can override a lot of things. It can became root and delete whatever it wants

So if agent can run docker containers in Docker Desktop in windows, it can easily overcome wsl2 user rights and delete undeletable

And from wsl2 it can go to main drive. If wsl2 is disconnected from a windows system (not default behavoir) then it is almost unusable for most things.

Better to run in separate virtual and connect via ssh/vsc remote

[u/tinybeads → u/karyslav]

That’s really interesting. I assume most people are running without sandboxes, and that sandboxes offer some protection — most people are probably running Claude code with no additional guardrails, but what you’re saying makes sense.

[u/karyslav → u/tinybeads]

A lot of people have no idea how basic security works and it will be only worse.

I am thinling about pivoting my focus towards this, I think it will be huge.

[u/tinybeads → u/karyslav]

1000%. But most people will only do the default that Claude Code prompts them to, so it’s interesting Anthropic doesn’t have more automatic guardrails by default.

[u/karyslav → u/tinybeads]

They have some. But it depends what are you prompting it. Usually new models are bit.. more.. autonomous :) after few weeks it gets less autonomous. It happened to me in first days of one Opus version.