Alignment Incident Database
AID-2026-0125Oct 2026 · first reported Oct 27, 2026ReportedDraft

A Claude Code subagent wrote a test that ran rm -rf ~ on a user's real home directory despite worktree isolation, the user reports

A Claude Code subagent running Opus 5.5 in worktree isolation wrote a test whose payload, "20; rm -rf ~", ran against the user's real home directory. It deleted the project checkout with its Git history, other projects, and config files, losing all unpushed work, the user reports.

Draft: no maintainer has yet checked every claim against its sources. Report a problem.

A user asked Claude Code, running Opus 5.5 in auto permission mode with bash sandboxing disabled, to build a feature. The main agent delegated the work to a subagent started with isolation: "worktree"1.

The subagent wrote a Rust test to check that a shell-script driver rejects non-numeric input. Its fixture stood in for ssh by running its arguments through sh -c, and the test passed the argument "20; rm -rf ~". The shell split it into two commands, and rm -rf ~ ran against the real home directory. The delete never appeared as a Bash tool call: it ran inside the test runner, and the test passed. The subagent noticed only when its next commands failed because the working directory was gone. It stopped and reported the incident1.

The deletion was stopped about six minutes in, so it was partial. It removed the main project checkout, including .git and all worktrees inside it, several other project folders, ~/.zshrc, and the contents of ~/.config. All unpushed commits and uncommitted work were lost, with no Time Machine backup or local snapshots1. A second Claude Code session noticed the running delete and tried to kill it, but the auto-mode classifier denied the kill as "Interfere With Workloads"1. The user, raihanlh, reported it on GitHub on October 27, 2026. The issue was labeled data-loss and high-priority, and had no reply from Anthropic staff when this record was written1.

All 10 claims with their quotes
  1. The user asked the main agent to build a feature, and it delegated the implementation to a subagent with worktree isolation.1
    “I asked the main agent to build a feature. It delegated the implementation to one subagent with isolation: "worktree".”
  2. The session used Claude Code 2.1.311 with Opus 5.5 for both the main session and the subagent, in auto permission mode with bash sandboxing disabled, on macOS.1
    “Model: Opus 5.5 (main session and subagent)”
  3. The subagent wrote a Rust test whose fixture stood in for ssh by running its arguments through sh -c.1
    “The subagent wrote a Rust test to check that a shell-script driver rejects non-numeric input. The fixture stood in for ssh by running cd && exec sh -c "$*".”
  4. The test passed the argument "20; rm -rf ~", and rm -rf ~ ran against the real home directory.1
    “The test called the driver with the argument "20; rm -rf ~". sh -c split it into two commands, and rm -rf ~ ran with the real $HOME.”
  5. The test suite took about 7 minutes and the test passed. The subagent noticed the deletion only when its next commands failed, then stopped and reported it.1
    “cargo test took about 7 minutes and the test passed. The subagent only noticed the deletion when its next commands failed because the working directory was gone.”
  6. The destructive command never appeared as a Bash tool call; it was inside a test file.1
    “Here the rm -rf ~ never appeared in a Bash call; it was hidden inside a test file.”
  7. The deletion removed the main project checkout, including .git and all git worktrees inside it, as well as several other project folders.1
    “The main project checkout, including .git and its local issue-tracker database, plus all git worktrees inside it.”
  8. The deletion was partial because it was stopped about 6 minutes in.1
    “The deletion was partial because rm -rf ~ was stopped about 6 minutes in, before it reached every folder.”
  9. All unpushed commits and uncommitted work in the affected projects were lost, and there was no backup.1
    “All unpushed commits and uncommitted work in those projects were lost. There was no Time Machine and no local snapshots.”
  10. A concurrent Claude Code session in auto mode tried to kill the running deletion, but the auto-mode classifier denied the kill.1
    “The auto-mode classifier denied the kill as "Interfere With Workloads" while the deletion was still running, so the kill had to wait for me.”

Sources

  1. [1][BUG] Subagent-written test ran rm -rf ~ on the real home directory, deleting all of my unpushed works; worktree isolation didn't contain it · GitHub · Oct 27, 2026 · Primary

Related incidents

Editor notes

Sourced from a single first-hand GitHub issue (#105342) by user raihanlh. The issue does not give the exact day of the deletion; it was filed on 2026-10-27, so the date is held at month precision. The reporter offers to share the session ID and transcripts with Anthropic privately; no transcript is public. The issue corrected an earlier claim that ~/.ssh was deleted. The reporter said the denied kill would be filed as a separate issue. As of 2026-10-27 no Anthropic staff had responded.