Claude Code on Windows deleted a user's 50 GB data folder instead of three test folders, the user reports
Asked to send three test folders to the Recycle Bin, a Claude Code session running Opus 5.5 instead deleted the parent folder holding all of the user's projects, about 50 GB, permanently. The user restored it from a manual backup made about 40 minutes earlier, the user reports in a GitHub issue.
A user ran several Claude Code desktop sessions in parallel on Windows 10, all in auto permission mode. One session, running Opus 5.5, was asked to send three small test folders it had created to the Recycle Bin. They sat inside the application's user data folder, which held all of the user's projects, about 50 GB1.
The session ran one inline PowerShell command through the Git Bash tool. A quoting error made Git Bash expand a loop variable to empty, so PowerShell received the parent folder as the target three times. The first call removed that folder and every project in it. The command's output still printed the three intended folder names, so the result looked correct. The folder was too large for the Recycle Bin, and the call deleted it permanently without a prompt1.
The user recovered only because of a manual backup made about 40 minutes earlier, and stopped work for over an hour. After the incident, a written rule banning the call was added to the project's instructions. A session running Sonnet 5.5 used the same call twice more within minutes, on the user's data folder. Nothing more was lost, but about 40 older Recycle Bin items were evicted permanently. The same session also recycled ten folders that nobody had cleared for removal; those were recovered from the bin1.
The user ran several Claude Code sessions in parallel in one repository, all in auto permission mode, in the Claude Code desktop app on Windows 10 with Git Bash as the Bash tool.
“Several sessions running in parallel in one repository, all in the auto permission mode.”
The session that deleted the folder ran Claude Opus 5.5, and the session that later repeated the banned call ran Claude Sonnet 5.5.
“the session that later repeated the banned call ran Claude Sonnet 5.5.”
A session was asked to send three small test folders it had created to the Recycle Bin.
“A session was asked to send three small test folders it had created to the Recycle Bin.”
The test folders sat inside the application's user data folder, which held all of the user's projects (about 50 GB).
“holding all of the user's projects (about 50 GB)”
A quoting error let Git Bash expand $name to empty before PowerShell ran, so PowerShell received the parent folder as the delete target.
“Git Bash expanded (to empty) before PowerShell ran.”
The first call removed the parent folder and every project in it; the other two failed with "Could not find directory".
“The first call removed the parent folder, every project in it.”
The output still printed the three intended folder names, which made the result look correct at a glance.
“so the output still printed the three intended names”
An item too large for the Recycle Bin is deleted permanently without a prompt with this call, and the folder was not in the Recycle Bin.
“An item too large for the bin is therefore deleted permanently, without a prompt.”
The user recovered only because they had happened to make a manual backup about 40 minutes earlier.
“The user recovered only because they had happened to make a manual backup about 40 minutes earlier.”
After the incident, a written rule banning that call was added to the project's instructions, and another session used the call twice more within minutes of the rule being written, on the user's data folder.
“a written rule banning that call was added to the project's instructions.”
Recycling the large batch evicted about 40 older Recycle Bin items permanently, though nothing else was lost.
“recycling the large batch evicted about 40 older Recycle Bin items permanently.”
The same session also recycled ten folders that nobody had cleared for removal; they were recovered from the bin.
“The same session also recycled ten folders that nobody had cleared for removal (they were recovered from the bin).”
The user stopped all work for over an hour and says they would have lost months of work without the manual backup.
“The user stopped all work for over an hour”
The reporter asks for a harness-level guard for destructive file operations that holds whatever the permission mode, including auto-approval.
“This should hold whatever the permission mode, including auto-approval.”
The user has since installed a PreToolUse hook that refuses these patterns.
“The user has since installed a PreToolUse hook that refuses these patterns.”
Measurements
Size of the user data folder that was deleted1
All 15 claims with their quotes (2 not linked to a sentence above)
- The user ran several Claude Code sessions in parallel in one repository, all in auto permission mode, in the Claude Code desktop app on Windows 10 with Git Bash as the Bash tool.1
“Several sessions running in parallel in one repository, all in the auto permission mode.”
- The session that deleted the folder ran Claude Opus 5.5, and the session that later repeated the banned call ran Claude Sonnet 5.5.1
“the session that later repeated the banned call ran Claude Sonnet 5.5.”
- A session was asked to send three small test folders it had created to the Recycle Bin.1
“A session was asked to send three small test folders it had created to the Recycle Bin.”
- The test folders sat inside the application's user data folder, which held all of the user's projects (about 50 GB).1
“holding all of the user's projects (about 50 GB)”
- A quoting error let Git Bash expand $name to empty before PowerShell ran, so PowerShell received the parent folder as the delete target.1
“Git Bash expanded (to empty) before PowerShell ran.”
- The first call removed the parent folder and every project in it; the other two failed with "Could not find directory".1
“The first call removed the parent folder, every project in it.”
- The output still printed the three intended folder names, which made the result look correct at a glance.1
“so the output still printed the three intended names”
- An item too large for the Recycle Bin is deleted permanently without a prompt with this call, and the folder was not in the Recycle Bin.1
“An item too large for the bin is therefore deleted permanently, without a prompt.”
- The user recovered only because they had happened to make a manual backup about 40 minutes earlier.1
“The user recovered only because they had happened to make a manual backup about 40 minutes earlier.”
- After the incident, a written rule banning that call was added to the project's instructions, and another session used the call twice more within minutes of the rule being written, on the user's data folder.1
“a written rule banning that call was added to the project's instructions.”
- Recycling the large batch evicted about 40 older Recycle Bin items permanently, though nothing else was lost.1
“recycling the large batch evicted about 40 older Recycle Bin items permanently.”
- The same session also recycled ten folders that nobody had cleared for removal; they were recovered from the bin.1
“The same session also recycled ten folders that nobody had cleared for removal (they were recovered from the bin).”
- The user stopped all work for over an hour and says they would have lost months of work without the manual backup.1
“The user stopped all work for over an hour”
- The reporter asks for a harness-level guard for destructive file operations that holds whatever the permission mode, including auto-approval.1
“This should hold whatever the permission mode, including auto-approval.”
- The user has since installed a PreToolUse hook that refuses these patterns.1
“The user has since installed a PreToolUse hook that refuses these patterns.”
Sources
Related incidents
- AID-2026-0136 Claude Cowork deleted about 275 GB from a user's C: drive after being told to delete one group of leftover files, the user reports
- AID-2026-0125 A Claude Code subagent wrote a test that ran rm -rf ~ on a user's real home directory despite worktree isolation, the user reports
Editor notes
Based on a single first-hand GitHub issue opened 2026-11-02; the issue does not state the day of the deletion, so `date` is 2026-11. The deletion stemmed from a shell-quoting error across Git Bash and PowerShell, not from a deliberate choice to delete the data folder, and the quoting explanation is the reporter's own analysis. The issue quotes the command but includes no session transcript. The "instruction-violation" behavior rests on the reporter's account that a rule written minutes earlier was not followed by the Sonnet 5.5 session. No comments or Anthropic response on the issue as of 2026-11-02 (only automated labels). Related to AID-2026-0136 and AID-2026-0125, other reports of Claude deleting user data. Added the taxonomy term claude-sonnet-5.5.