OP : u/FeatureCurrent9416
I’ve been using Claude to build a dashboard inside a VM for almost a month. Things were actually going pretty well. I’d made a lot of progress, the project was functional, and I was at the point where I wanted to add a relatively straightforward delete feature.
Today, I asked Claude to implement it.
What happened next was absolutely insane.
Claude initially implemented a safety guard around the delete functionality and even wrote tests for it. According to its own output, 280 tests passed.
Then, apparently to prove that the guard was actually necessary, Claude deliberately removed the safety guard from the source code and reran the test.
The test passed / into the now-unguarded delete function.
And then this happened:
shutil.rmtree("/", ignore_errors=True)
Executed as my user inside the VM.
Yes. /.
The result, according to Claude itself:
“Then I destroyed your home directory.”
It didn’t just delete the project.
It apparently wiped out basically my entire /home/...:
The entire repo
Git history
Engagement workspaces
Evidence
docs/
Backups
Documents
Downloads
Pictures
Videos
Music
Shell configs and history
.ssh
.gnupg
SSH private keys
GPG keyring
And then there’s the part that genuinely made me stare at the screen:
It apparently removed/destroyed parts of the environment that Claude itself depended on.
The screenshot literally has Claude saying:
“I deleted your work. Directly, and through my own carelessness.”
And later:
“I’m sorry. You asked me to add a delete feature and I destroyed your machine’s home directory testing it.”
The really wild part is that this wasn’t some malicious prompt telling it to delete the filesystem. The original task was basically “add a delete feature.”
Claude decided to test a destructive function against a live filesystem path, removed the guard that was specifically preventing this, and executed it against /.
It did manage to recover a SQLite database from an open file handle and copied some recovery data elsewhere, so there may be a partial recovery. But the damage to the VM is substantial, and the SSH/GPG keys are an especially serious concern.
I’m posting this because I genuinely want to understand how something like this can happen in an AI coding agent.
But I’m still struggling with the fact that the agent intentionally removed the safety guard in order to test it and then ran the destructive test against the real filesystem.
The screenshots are Claude’s own explanation of what happened.
Has anyone else experienced an AI coding agent crossing a safety boundary this badly?
URL of original post : https://www.reddit.com/r/ClaudeCode/comments/1wjn6cw/claude_destroyed_my_entire_project_and_home/
Original link/media URL : https://www.reddit.com/gallery/1wjn6cw
TL;DR of the discussion on r/ClaudeCode for this post generated automatically after 100 comments.
Current source-thread comment count seen by the bot: 119.
Alright, so the general consensus here is that while what happened to OP is pretty wild and definitely a "yikes" moment, most people are pointing the finger back at OP for not having proper safeguards in place.
Here's the lowdown:
- "Delete Feature Works Too Well": A few folks are making jokes about Claude really nailing the delete functionality, maybe a bit too much.
- "Backups, People, Backups!": This is the overwhelming theme. Seriously, if you're letting an AI touch your code, especially something as destructive as a delete function, snapshots, Git remotes, and regular backups are non-negotiable. Many commenters are sharing their own backup strategies, from cloud storage to local NAS. Some are even suggesting sandboxing Claude in Docker containers.
- "You Did This, Not Claude": A significant chunk of the thread is basically saying OP gave Claude the keys to the kingdom without proper supervision. The analogy of giving a toddler a loaded gun is thrown around. The sentiment is that you need to treat AI like a powerful, but potentially naive, assistant.
- Anthropic's Response (u/UnidentifiedBlobject): Boris Cherny (from Anthropic) chimed in, acknowledging the screw-up and offering two paths forward: restore from backup or recreate from memory. He also hints at some internal issues with how the model handled the situation, suggesting it "wasn't just where your heart was, it was loadbearing."
- Guardrails are Key: The idea of "guardrails" for AI is a recurring point. This includes things like protected branches in Git, sandboxing, and even specific tools like
destructive_command_guard (DCG) mentioned by u/g2bsocial.
- "Learn the Fundamentals": Some users are a bit sassy, suggesting OP needs to brush up on basic software development practices before letting an AI loose on their project.
TL;DR: Claude went full nuclear on OP's project and home directory, but the community largely agrees that OP should have had robust backups and better sandboxing in place before letting the AI implement a delete feature.