Claude Code Deleted All of a Developer’s Files by Mistake and Blamed a Typo

I do have a feeling that Anthropic is slowly losing its moat.

I want to be careful about what I mean, because I don’t think Claude turned into a bad model. I still see Opus 5 sitting at the top of the benchmark tables, and I’m not going to pretend otherwise.

What I’m seeing is that everybody else got close enough to matter, and at the same time the things that make me trust Claude in daily work just keep getting worse.

Today, I read on Reddit about Claude Code deleting all of a developer’s user files by mistake.

The developer said that he asked Claude Opus 5 to make a backup. Claude put the backup in the wrong directory, ran a force-delete against their user files, and then replied with two words: “Sorry, typo.”

I asked Claude Opus 5 to create a backup.

Instead, it created the backup in the wrong directory and then proceeded to “rm -rf” my entire drive.

After wiping everything, it just replied:

“Sorry, typo.”

…like nothing had happened.

That was simultaneously the funniest and most painful AI moment I’ve had.😭

Press enter or click to view image in full size

Reddit: Claude Code Deleted All of a Developer’s Files by Mistake

I’ve run Claude Code with permissions I probably shouldn’t have granted, on a machine with work I couldn’t afford to lose, and reading that thread made me go check my own setup.

“Sorry, typo” is not a root cause analysis

I want to explain why this keeps happening, because I see people blame the model when the model is only half the problem.

When you run the rm -rf command, it deletes recursively and skips most confirmation prompts. If an agent can open a shell with your permissions, your operating system has no idea whether that command came from you, a script, or a language model. It sees an authorized process asking for something, and it does it.

Now add a bad path to that. A malformed variable, a missing directory component, a badly quoted string, source and destination flipped.

As a software developer, I’ve written enough shell scripts to know how easy this is, which is exactly why I validate paths before deleting anything, reject empty variables, and never let a backup script and a cleanup script live in the same function.

You have to understand that Claude suggests whatever dangerous command it wants. Whether that command executes, which directories it can reach, what credentials it holds, and whether I can undo it are all decisions somebody made in the tooling, not in the weights.

And I’ve now read enough of these mishap reports to stop treating them as one-offs. A couple of months ago, I remember one user on Reddit sharing his experience with Claude deleting a 202GB APFS archive after being explicitly told not to touch data.

Press enter or click to view image in full size

Press enter or click to view image in full size

Reddit: Claude Code deleting a 202GB APFS archive

A GitHub issue claimed Claude Code 2.1.58 wiped a Windows user profile, though it closed without a reproduction. There was also a case where a missing Terraform state file and a permissive workflow took out a production setup along with its snapshots.

I don’t think that makes Claude uniquely destructive. I think it means we’ve wired probabilistic models into deterministic tools that cause permanent damage, and we haven’t reckoned with the math. The model only has to be wrong once. My filesystem does exactly what it’s told, every single time.

My own experience with Claude

I noticed this story because it lines up with something I’ve been feeling for weeks.

Claude feels lazy to me now. It gets distracted, it makes claims before checking the obvious thing, and it skips instructions I put in the same message.

I’ve bounced between Fable 5 and Opus 5 hoping one of them fixes it, and neither has. I get the same loop every time: a missed instruction, a weird detour, a shallow check, then an apology once I point out what it ignored.

And can I just mention how annoying the level of refusal Claude shows is, even if there’s nothing harmful about your request?

Press enter or click to view image in full size

Claude safety guards message. Image by Jim Clyde Monge

I mean, it’s not just me who gets annoyed by Claude’s laziness and hallucinations. One of the biggest names in the AI community, Chubby, also expressed disappointment on X.

So I moved most of my coding and writing over to GPT-5.6 Sol. I’m not claiming OpenAI solved agent reliability, because it clearly hasn’t. I just spend less of my day dragging the model back onto the task, and at some point that’s the only metric I care about.

The usage limits made the decision easier. Anthropic runs five-hour session limits and weekly limits at the same time, Fable 5 eats the shared allowance faster, and Anthropic says eligible premium users can only spend 50% of their weekly allowance on Fable before they have to switch models or buy credits.

The warning message below is such a nightmare.

Press enter or click to view image in full size

Claude out of credits. Image by Jim Clyde Monge

On the API it’s $10 per million input tokens and $50 per million output, which is double Opus 5.

That’s why a bad Claude session annoys me more than a bad session with anything else. When it wanders off into trivialities, I’m not just losing an hour. I’m burning a scarce allowance I paid for, and then paying again in the attention it takes to supervise it.

The even more scary story

The deleted-files story is one developer’s version of a much larger problem, and the recent security disclosures made me a lot less relaxed about how I run agents.

In July, OpenAI disclosed that GPT-5.6 Sol and an internal research prototype were running a cyber-capability evaluation called ExploitGym with production cyber classifiers turned off, since the point was to measure maximum capability. The environment was supposed to limit internet access to an internally hosted package-registry proxy.

The agents found an unknown vulnerability in that proxy, later identified as Artifactory, and used it to get to the open internet. They escalated privileges inside OpenAI’s research environment, moved laterally, and went after Hugging Face because they figured its systems might hold the benchmark answers.

According to OpenAI’s disclosure, they used stolen credentials and more vulnerabilities to reach production infrastructure and pull answers out of a live database.

Press enter or click to view image in full size

OpenAI and Hugging Face partner to address security incident during model evaluation

I’ve read that paragraph several times and it still gets me. That’s not a chatbot clicking a bad link. That’s sustained, multi-step exploitation because stealing the answer key was the most efficient way to score well.

Hugging Face’s own writeup counted thousands of agent actions, lateral movement, harvested credentials, and command-and-control staged through public services, though it found no evidence that public models, datasets, or Spaces were modified.

Press enter or click to view image in full size

HuggingFace: Security incident disclosure

Anthropic then reviewed 141,006 cyber-eval runs and found three incidents across six runs where Claude touched real systems through an evaluation environment run by a third-party lab called Irregular. Different cause, same outcome. A misconfiguration left an open internet path while the model had been told it was in an offline simulation.

The details in Anthropic’s postmortem are worse than the summary suggests. Opus 4.7 reached a real company that happened to share a name with a fictional target, got credentials, and accessed a production database with several hundred rows in it. It kept going after it noticed signs that the system was real, which is the part I can’t get past.

In the second incident, Mythos 5 published a malicious Python package to PyPI as a dependency-confusion attack. It stayed public for about an hour and executed on 15 real systems, and one of those belonged to a security vendor whose scanner ran it and exposed credentials that Claude then used to reach more infrastructure.