Claude Code recursive delete runs with the permission system on; home directory unrecoverable
Anthropic (Claude Code) · Oct 21, 2025 · Coding agent
What happened
Developer Mike Wolak filed GitHub issue #10077 after Claude Code executed a recursive delete starting from root on his Ubuntu/WSL2 system, destroying every user-owned file. He was not running --dangerously-skip-permissions; the permission system was active and did not detect that the command would expand destructively before he approved it. Anthropic tagged the report as a security bug; nothing was recovered.
Causal vector
Permission prompt approved a command whose shell expansion deleted far more than presented; no deny rule matched the expansion
Source
Reported by GitHub issue, anthropics/claude-code #10077. Verified against the primary report.
The permission prompt showed a command, not its blast radius. sipi.bot classifies recursive-delete-class operations as high-risk categories that are FLAGGED for human review with rate-limited execution, so an approved 'cleanup' cannot expand into an unrecoverable wipe at machine speed.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Claude Opus 4.6 agent deletes PocketOS production DB and backups in 9 seconds
PocketOS · Apr 1, 2026
Amazon's Kiro AI agent deletes and recreates part of its AWS environment, causing a 13-hour outage
Amazon Web Services · Dec 15, 2025
Claude Code command ending in ~/ expands and wipes a Mac home directory, including the Keychain
Anthropic (Claude Code) · Dec 8, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 95 documented failures, one control.