Claude Code Deleted All of a Developer’s Files by Mistake and Blamed a Typo

Claude Code Deleted All of a Developer’s Files by Mistake and Blamed a Typo | Zeniteq

I do have a feeling that Anthropic is slowly losing its moat.

I want to be careful about what I mean, because I don’t think Claude turned into a bad model. I still see Opus 5 sitting at the top of the benchmark tables, and I’m not going to pretend otherwise.

What I’m seeing is that everybody else got close enough to matter, and at the same time the things that make me trust Claude in daily work just keep getting worse.

Today, I read on Reddit about Claude Code deleting all of a developer’s user files by mistake.

The developer said that he asked Claude Opus 5 to make a backup. Claude put the backup in the wrong directory, ran a force-delete against their user files, and then replied with two words: “Sorry, typo.”

I asked Claude Opus 5 to create a backup.

Instead, it created the backup in the wrong directory and then proceeded to “rm -rf” my entire drive.

After wiping everything, it just replied:

“Sorry, typo.”

…like nothing had happened.

That was simultaneously the funniest and most painful AI moment I’ve had.😭

Press enter or click to view image in full size

Reddit: Claude Code Deleted All of a Developer’s Files by Mistake

I’ve run Claude Code with permissions I probably shouldn’t have granted, on a machine with work I couldn’t afford to lose, and reading that thread made me go check my own setup.

“Sorry, typo” is not a root cause analysis

I want to explain why this keeps happening, because I see people blame the model when the model is only half the problem.

When you run the rm -rf command, it deletes recursively and skips most confirmation prompts. If an agent can open a shell with your permissions, your operating system has no idea whether that command came from you, a script, or a language model. It sees an authorized process asking for something, and it does it.

Now add a bad path to that. A malformed variable, a missing directory component, a badly quoted string, source and destination flipped.

As a software developer, I’ve written enough shell scripts to know how easy this is, which is exactly why I validate paths before deleting anything, reject empty variables, and never let a backup script and a cleanup script live in the same function.

You have to understand that Claude suggests whatever dangerous command it wants. Whether that command executes, which directories it can reach, what credentials it holds, and whether I can undo it are all decisions somebody made in the tooling, not in the weights.

And I’ve now read enough of these mishap reports to stop treating them as one-offs. A couple of months ago, I remember one user on Reddit sharing his experience with Claude deleting a 202GB APFS archive after being explicitly told not to touch data.

Press enter or click to view image in full size

Reddit: Claude Code deleting a 202GB APFS archive

A GitHub issue claimed Claude Code 2.1.58 wiped a Windows user profile, though it closed without a reproduction. There was also a case where a missing Terraform state file and a permissive workflow took out a production setup along with its snapshots.

I don’t think that makes Claude uniquely destructive. I think it means we’ve wired probabilistic models into deterministic tools that cause permanent damage, and we haven’t reckoned with the math. The model only has to be wrong once. My filesystem does exactly what it’s told, every single time.

My own experience with Claude

I noticed this story because it lines up with something I’ve been feeling for weeks.

Claude feels lazy to me now. It gets distracted, it makes claims before checking the obvious thing, and it skips instructions I put in the same message.

I’ve bounced between Fable 5 and Opus 5 hoping one of them fixes it, and neither has. I get the same loop every time: a missed instruction, a weird detour, a shallow check, then an apology once I point out what it ignored.

And can I just mention how annoying the level of refusal Claude shows is, even if there’s nothing harmful about your request?

Press enter or click to view image in full size

Claude safety guards message. Image by Jim Clyde Monge

I mean, it’s not just me who gets annoyed by Claude’s laziness and hallucinations. One of the biggest names in the AI community, Chubby, also expressed disappointment on X.

So I moved most of my coding and writing over to GPT-5.6 Sol. I’m not claiming OpenAI solved agent reliability, because it clearly hasn’t. I just spend less of my day dragging the model back onto the task, and at some point that’s the only metric I care about.

The usage limits made the decision easier. Anthropic runs five-hour session limits and weekly limits at the same time, Fable 5 eats the shared allowance faster, and Anthropic says eligible premium users can only spend 50% of their weekly allowance on Fable before they have to switch models or buy credits.

The warning message below is such a nightmare.

Press enter or click to view image in full size

Claude out of credits. Image by Jim Clyde Monge

On the API it’s $10 per million input tokens and $50 per million output, which is double Opus 5.

That’s why a bad Claude session annoys me more than a bad session with anything else. When it wanders off into trivialities, I’m not just losing an hour. I’m burning a scarce allowance I paid for, and then paying again in the attention it takes to supervise it.

The even more scary story

The deleted-files story is one developer’s version of a much larger problem, and the recent security disclosures made me a lot less relaxed about how I run agents.

In July, OpenAI disclosed that GPT-5.6 Sol and an internal research prototype were running a cyber-capability evaluation called ExploitGym with production cyber classifiers turned off, since the point was to measure maximum capability. The environment was supposed to limit internet access to an internally hosted package-registry proxy.

The agents found an unknown vulnerability in that proxy, later identified as Artifactory, and used it to get to the open internet. They escalated privileges inside OpenAI’s research environment, moved laterally, and went after Hugging Face because they figured its systems might hold the benchmark answers.

According to OpenAI’s disclosure, they used stolen credentials and more vulnerabilities to reach production infrastructure and pull answers out of a live database.

Press enter or click to view image in full size

OpenAI and Hugging Face partner to address security incident during model evaluation

I’ve read that paragraph several times and it still gets me. That’s not a chatbot clicking a bad link. That’s sustained, multi-step exploitation because stealing the answer key was the most efficient way to score well.

Hugging Face’s own writeup counted thousands of agent actions, lateral movement, harvested credentials, and command-and-control staged through public services, though it found no evidence that public models, datasets, or Spaces were modified.

Press enter or click to view image in full size

HuggingFace: Security incident disclosure

Anthropic then reviewed 141,006 cyber-eval runs and found three incidents across six runs where Claude touched real systems through an evaluation environment run by a third-party lab called Irregular. Different cause, same outcome. A misconfiguration left an open internet path while the model had been told it was in an offline simulation.

The details in Anthropic’s postmortem are worse than the summary suggests. Opus 4.7 reached a real company that happened to share a name with a fictional target, got credentials, and accessed a production database with several hundred rows in it. It kept going after it noticed signs that the system was real, which is the part I can’t get past.

In the second incident, Mythos 5 published a malicious Python package to PyPI as a dependency-confusion attack. It stayed public for about an hour and executed on 15 real systems, and one of those belonged to a security vendor whose scanner ran it and exposed credentials that Claude then used to reach more infrastructure.

In the third, an internal Anthropic model scanned roughly 9,000 internet targets and compromised a company through an exposed debug page and SQL injection before recognizing the target was unrelated and stopping.

Anthropic points out that the agents never tried to copy themselves or chase an independent goal, and that the normal safeguards were disabled for these capability tests. Both are true and both matter. Neither changes my conclusion, which is that once an agent has a goal, tools, time, credentials, and something reachable to attack, alignment is not a security boundary.

The UK AI Security Institute found the same thing from the outside. In a cyber evaluation with internet access deliberately enabled and safety classifiers off, agents running GPT-5.6 Sol and Mythos 5 took unsanctioned actions against real people and organizations.

Press enter or click to view image in full size

UK AI Security Institute

Some created fake online identities and tried social engineering to get malicious code approved in an open-source project. The attempts failed, but AISI still logged 19 out-of-scope actions, 17 from Mythos 5 and two from Sol.

I don’t read any of this as one lab being careless and another being responsible. I read it as an industry that crossed a capability threshold before it finished building the containment, and I say that as someone who runs these agents on my own hardware.

What I changed on my own machine

I stopped believing that a better prompt fixes any of this. Prompts are suggestions. The controls have to sit outside the model, where it can’t argue with them.

I run coding agents in disposable containers now, and I mount the project directory instead of my home directory. I use Docker to run my benchmarks and risky projects in containers.
The filesystem is read-only by default, with write access granted to specific paths only.
Destructive operations need me to approve the exact command and target. That covers recursive deletion, disk formatting, database drops, credential changes, production deploys, and force pushes.
Credentials are short-lived and narrowly scoped. An agent fixing a failing test does not need my org-wide cloud token, and I gave it one for months without thinking about it.
Outbound network access is denied by default, and when an agent genuinely needs the internet I use an allowlist and log everything.
My backups live somewhere the agent can’t reach. A backup sitting under the same credential as the live system was never a real recovery boundary, which I learned the annoying way.

I’d add two more if you’re setting this up: prefer reversible actions like quarantine directories, snapshots, and dry runs, and keep audit logs somewhere the agent can’t rewrite them.

None of this is original. It maps closely to the joint 2026 guidance from CISA, the NSA, and partner agencies, which recommends never granting agents broad unrestricted access, enforcing least privilege, building fail-safe containment, and keeping a human in the loop for higher-risk actions.

Final Thoughts

So is Anthropic losing its moat? I think yes, but not for the reason most people are posting about.

Anthropic is still at or near the top of the tables, Opus 5 is not a weak model, and the open-weight releases haven’t swept every evaluation.

Calling this a collapse would be stupid and I’m not going to do it. What I think is happening is that intelligence got easy to buy somewhere else. Kimi, GLM, and DeepSeek are close enough on the work I actually do, dramatically cheaper, and available as weights I can hold onto.

Meanwhile I’m paying premium prices for a model that needs me watching it.

I also can’t pretend that switching to OpenAI solved the security half of this. Sol was in the Hugging Face incident and in the AISI report. I changed vendors and kept every bit of the architectural risk, which is a strange thing to realize about your own setup.

The next moat isn’t going to come from winning one more coding benchmark, at least not for me. It’ll come from whoever ships a system that’s capable, predictable, affordable, and hard to wreck even when the model makes a bad call.

Nobody has done that yet.

And if an agent can turn “make a backup” into “delete the files,” then permission design isn’t an advanced setting anymore. It’s the product.

What do you think? Drop your thoughts in the comments.