Claude Code Deleted My Home Directory (the rm -rf Incident)

Symptoms

• You asked Claude Code to clean up a repo or organize folders and it executed an rm -rf whose arguments reached far beyond the project.
• Documented worst case: 'rm -rf tests/ patches/ plan/ ~/', where the trailing ~/ expanded to the user's entire Mac home directory: Desktop, Documents, photos, Keychain.
• Other reports include an rm -rf from root on Ubuntu/WSL2 and an 11GB deletion during a folder-organization benchmark.
• Files are simply gone; on SSDs with TRIM, undelete tools find nothing.

Why it happens

Generation and execution happen in one step

The agent generates the rm command and the shell executes it in the same step. A hallucinated or pattern-matched extra path argument like '~/' becomes catastrophic because the shell expands ~ to your home directory before rm ever sees it.

A directory literally named '~'

In one variant (issue #12637), the agent created a directory named '~', then cleaned it up with an unquoted rm -rf ~, which the shell expanded to the real home directory.

The permission system did not catch it

In the October 2025 Wolak case (issue #10077), the default permission system failed to flag the destructive expansion; the user was not running --dangerously-skip-permissions. That flag makes things worse by removing even the per-command confirmation.

How to fix it

1. Stop all writes to the disk right nowPower down or stop everything writing to the affected disk. On SSDs with TRIM, deleted blocks are purged fast, which is why undelete tools that work on spinning disks mostly come up empty here. This is a race you win in minutes, not hours.
2. Check APFS local snapshots and Time Machine on macOSRun 'tmutil listlocalsnapshots /' to see whether APFS kept a local snapshot from before the deletion. Restore through Time Machine, including the 'Browse other backup disks' option, or from a full Time Machine backup if you have one.
3. Restore from cloud sync trashiCloud Drive, Dropbox, and Google Drive keep deleted files for about 30 days. This is exactly how the January 2026 Claude Cowork photo-deletion victim recovered, so check every synced folder's deleted-items view before assuming the worst.
4. Re-clone any repo that was ever pushedFor git repositories that were pushed to any remote, the code is safe on the server; re-clone from GitHub or wherever the remote lives. Honest note: anything that was only local, never snapshotted, and never synced is effectively unrecoverable on a TRIM-enabled SSD.

How to prevent it

• Never run --dangerously-skip-permissions on your host machine. Use a container or sandbox (a devcontainer, or Docker sandboxes via 'sbx run claude') where the agent's ~/ is the workspace, not your real home directory.
• Add deny rules in ~/.claude/settings.json permissions, for example "deny": ["Bash(rm -rf:*)"], and keep the default permission prompts on for Bash.
• Run cleanup-type tasks ('clean up', 'organize', 'delete old files') in a fresh git worktree or throwaway sandbox and review the diff before merging.
• Keep automatic backups (Time Machine or equivalent) running; they turn this incident from a catastrophe into an inconvenience.

Tools that actually fix this

Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.

Frequently asked questions

Sources

• Docker: Coding agent horror stories, the rm -rf incident
• Reddit r/ClaudeAI: Claude CLI deleted my entire home directory
• GitHub: anthropics/claude-code issue #10077
• SecurityOnline: Claude AI executes rm -rf and wipes developer's Mac home directory
• Anthropic Engineering: Claude Code auto mode

Related errors