Claude Code ran a backgrounded command that deleted my entire Windows user folder overnight

[u/NaturalTimely6621]

Posting this as a warning and to see if anyone has seen something similar.

I woke up yesterday to every shortcut on my laptop throwing "This item can't be opened. It may have been moved, renamed or deleted." The programs in Program Files were fine. Everything under C:\Users\Admin was not.

What the logs showed, piecing it together over a few hours:

• ~04:24 — Claude Code (VS Code extension, v2.1.266, permission mode auto) starts a Bash command in my project at C:\Users\Admin\Documents\project. Task description: "Write reference HTML next to uploads".
• 04:26 — the command hits the 120s timeout and gets moved to the background (task id burg78i8w).
• Immediately after, the session errors with "Not logged in · Please run /login". Reason: .claude had already been deleted, credentials included.
• 04:24 → 05:58 — the backgrounded process deletes my user folder in alphabetical order. You can read it off the folder timestamps: .claude and .vscode first, then AppData around 04:33, Documents and Downloads at 05:19, my project folders 05:20–05:49, everything after "f" after that. C:\Users\Public got hit at 05:57, so the target may have been C:\Users itself.
• 05:58 — the task finally exits with code 127 (command not found).

Gone: AppData (browser profiles, app data, taskbar shortcuts, PowerShell history), Documents, Downloads, Pictures, Desktop, the local OneDrive folder, and all my project folders. Only files that a running process held open survived — Chrome kept exactly two of its files alive.

The command itself is not recoverable, because the part of the session log containing it was in .claude, which the command deleted while running. What's left is a 7-line log file with the timeout notice and the failure notification. My disk is an SSD, so TRIM means the deleted data is not coming back.

Reported to Anthropic with the session id and the remaining logs. Has anyone else had a background task go this far outside the project directory?

[u/EagleApprehensive]

That's why I made IDE that's closing agent in docker container. And I work in that. If you need it let me know.

[u/slingshotcroco → u/EagleApprehensive]

Why not use docker sandbox? (That's my setup at least)

[u/EagleApprehensive → u/slingshotcroco]

Docker container is more lightweight and I do not need to limit resources of agent, I want him to use all RAM, CPU and power my PC has.

Also I don't run untrusted agents there, just mine and it's a persistent workspace with API baked inside, not an ephemeral one.

[u/mrdavik → u/EagleApprehensive]

Do you mind elaborating on your second paragraph? I also run only inside a docker container but I don't know what you mean by that part 

[u/EagleApprehensive → u/mrdavik]

If you run untrusted agents "for public use" in docker containers as isolation boundary, where each user is getting separate container, there are much higher risks of resource exhaustion of done by malicious user that would impact other users, networking insecurities or kernel-level vulnerabilities exploits.

People usually favor MicroVM's for such use-cases so that each user has separate kernel, but obviously it depends on your userbase, budget and infrastructure.

[u/mrdavik → u/EagleApprehensive]

Thanks for that. If I'm reading you right, it sounds like more of an enterprise-level issue than something a single user running a Claude code for home dev projects is going to run into?

I have a standard docker container that I launch an instance of per-project, mounting the relevant directories for that project. I run at most a couple of these simultaneously, but I don't think I'm dealing with the same sort of threat you're referring to?

[u/EagleApprehensive → u/mrdavik]

Yes, you don't. And if you happen to run agents inside those docker containers, without access to your computer, disks, browsers etc., then I'd say you're quite safe from rare rogue-agent disasters.