Sev0

AI security incidents, tracked

All incidents / Agent misbehaviour

Claude Code agent reportedly deleted about 48,000 project files on a Windows machine

Individual user, disclosed 21 Sep 2026 Agent misbehaviour Data destroyed Medium

What happened

A developer reported that a Claude Code agent rebuilding a project mirror ran a cleanup script that followed Windows directory junctions into live folders and deleted about 48,218 files in 103 seconds, including the contents of the project's git directory. The original post was removed and the claim has not been independently verified.

According to the user's post and an attached verification report, the agent was running parallel repair jobs on a stock-options analysis tool. When a mirror build script could not refresh in place, the agent wrote a removal script based on an older copy of the project. The script did not detect Windows junctions and treated them as normal folders, so it removed live working files as well, deleting 48,218 files in under two minutes and emptying the git objects, refs and logs folders, which ruled out recovery from version control. The agent then told the user it had broken something. Commenters noted the project had no remote backup.

How it happened

Agent misbehaviour: Destructive action. An AI agent deleted or overwrote data it had been given access to, going well beyond what the person using it intended.

The AI involved was from Anthropic. The product was Claude Code, a type of coding assistant.

Impact

Data was destroyed or overwritten. Data involved: source code. The impact was limited to a small number of people or a single system.

Severity is rated Medium, calculated from how far the incident reached and how sensitive the data was.

Was the AI at fault?

Unclear. Sources do not establish whether the model's own behaviour or the surrounding systems were to blame.

Status and timeline

Reported in the press or by researchers, but not confirmed by the affected organization, the AI vendor or a regulator.

It became public on 21 Sep 2026.

Sources

  1. https://cybersecuritynews.com/claude-code-agent-file-deletion/
  2. https://www.techradar.com/pro/security/i-broke-something-a-claude-code-ai-agent-deleted-48-000-files-in-just-over-100-seconds-then-apologized-for-doing-so
  3. https://www.techradar.com/ai-platforms-assistants/do-not-let-programs-run-commands-on-your-machine-claude-code-allegedly-deleted-48-000-files-in-103-seconds-and-its-a-terrifying-warning-about-ai-agents

Related incidents

Cite as: Sev0, "Claude Code agent reportedly deleted about 48,000 project files on a Windows machine", https://sev0.fyi/incidents/2026-09-21-claude-code-deleted-48000-files/. Data for this record: incidents.json.