A developer who asked Claude to write a cleanup script for AI agents watched the bot delete his entire home directory, roughly 700 GB, while running a self-test meant to prevent that exact outcome. The Anthropic safety harness had downgraded the model to Opus 4.8 before the fatal variable collision, and the script then reused the same variable name for the test and the cleanup that followed.
What happened
The developer uses AI agents frequently and grew tired of leftover files accumulating in the /tmp directory. He asked Claude to write a script that would sandbox each agent inside its own folder under /tmp and clean it up when the agent finished running. The hard part, of course, was making sure the cleanup did not touch files that were still in use. Claude’s first draft added logic to detect running agents and delay deleting their slice of /tmp, but the developer told the bot that approach was overcomplicated.
Because the script performed hard deletion of data, Claude ran an adversarial review: a fresh copy of the agent safety-checked its own work. Anthropic’s harness judged the resulting script risky and downgraded the model first to Opus 5 and then to Opus 4.8 before the review ran.
How the cleanup turned into a wipe
Opus 4.8 ran the safety test by matching the targets of the deletion command against /tmp and the user’s home directory to confirm neither would be touched. Both were correctly flagged as dangerous. The test then exited, and the cleanup step immediately ran, reusing the same variable name that the test had just used. The cleanup interpreted the home directory as a target and deleted it. The developer stopped the process, but not in time.
The damage covered roughly 700 GB, including one week’s worth of work and the data folder itself. In a final twist, the bot did leave /tmp behind, so the very files the script was meant to remove were the only ones that survived.
Why the downgrade may have mattered
The harness downgraded the model twice on safety grounds before the test executed. Opus 4.8 is weaker than the newer model on coding tasks, and a stronger model might have caught the variable-name collision between the safety test and the cleanup step that came after it. The downgrade meant the review of the riskier code was handled by the less capable model, at the moment the stakes were highest.
Recovery and the backup gap
The developer reconstructed most of his data from git repositories, nix stores, session logs, and similar sources. What he did not have was a daily backup of his own machine, a gap that turned a bad outcome into a much worse one. Several readers pointed to recovery tools and workarounds, but the situation itself underscored why those tools have to exist.
What this means for anyone running AI agents
Three lessons stand out. First, a model downgrade triggered by a safety policy can put the less capable model on the most consequential task in the pipeline, and that task is exactly where capability matters most. Second, code that performs destructive operations needs a backup and a dry run before it touches anything real, regardless of how confident the agent sounds about its own review. Third, sandboxed scripts that reuse variable names across test and execution paths are a known failure mode, and they deserve an explicit guard rather than a comment.
FAQ
What did Claude delete?
Claude deleted the developer’s entire home directory, roughly 700 GB of data, including one week’s worth of work, while running a self-test for a cleanup script.
Why did the model downgrade happen?
Anthropic’s safety harness judged the deletion script risky enough to downgrade the model from Opus 5 to Opus 4.8 before the adversarial review ran, and the less capable model executed the test.
Was the data recovered?
Most of the data was reconstructed from git, nix, session logs, and similar sources, but the developer did not have a daily backup of the machine itself.
This article summarizes reporting from tomshardware.com. See our editorial disclaimer for how our articles are produced.
Run a free scan to see your AI Visibility Score, SEO rating, and local citation accuracy.