Claude Code command ending in ~/ expands and wipes a Mac home directory, including the Keychain
Anthropic (Claude Code) · Dec 8, 2025 · Coding agent
What happened
Claude Code generated and ran 'rm -rf tests/ patches/ plan/ ~/' after a developer asked it to clean up packages in an old repository; the trailing tilde expanded to the home directory. Desktop, Documents, Library, and the Keychain were deleted; TRIM had zeroed the blocks, so nothing was recovered. The Keychain loss broke authentication across every application on the machine, including Claude Code itself, which could no longer reach its own backend.
Causal vector
Shell expansion of an unintended trailing path token in a generated rm -rf command
Source
Reported by Reddit r/ClaudeAI - first-hand report. Verified against the primary report.
One token turned a scoped cleanup into a machine-wide wipe. sipi.bot evaluates the expanded path against protected-location rules before execution, and velocity limits bound how far a mis-aimed recursive delete can travel before it is stopped.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Claude Opus 4.6 agent deletes PocketOS production DB and backups in 9 seconds
PocketOS · Apr 1, 2026
Amazon's Kiro AI agent deletes and recreates part of its AWS environment, causing a 13-hour outage
Amazon Web Services · Dec 15, 2025
AI agent deletes 1.9 million rows of production data 'thinking it was helping'
anonymous developer · Nov 1, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 95 documented failures, one control.