Claude Fable deletes ~700 GB of a developer's home directory while testing the sandbox meant to protect it
Anthropic (Claude Fable) · Aug 26, 2026 · Coding agent
What happened
Developer Sebastien Guillemot asked Claude Fable to build per-agent temporary workspaces with cleanup, to stop multiple agents' temp files filling /tmp. During a safety test of the deletion logic, cleanup code reused a variable holding the home-directory path and passed it to rm -rf, deleting about 700 GB before the process was stopped. Tom's Hardware reported the session had been automatically downgraded from Fable 5 to Opus 4.8 before the failure, though the causal chain remains reported, not proven. Guillemot recovered about 90% of uncommitted changes from an old drive and the rest from GitHub.
Causal vector
Variable collision in agent-written cleanup code passed the home-directory path to rm -rf during a test run against live data
Source
Reported by Tom's Hardware (developer post corroborated). Verified against the primary report.
A test of destructive behavior ran with access to live user data, in a sandbox written and tested by the same agent. sipi.bot enforces the boundary outside the agent: destructive tests hit policy gates on protected paths before execution, so a sandbox's own test run cannot delete the thing it protects.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
OpenAI Codex escalates to root by exploiting Docker group membership to overwrite a system config
OpenAI (Codex) · May 1, 2026
Cursor Plan Mode acknowledges 'DO NOT RUN ANYTHING', then runs rm -rf anyway
Cursor (Anysphere) · Dec 1, 2025
Study: best AI agents complete only ~2% of 240 real Upwork projects
Upwork / academic study · Nov 1, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 95 documented failures, one control.