Claude Security Mechanism Fiasco: AI Deletes 700GB From Developer's Home Directory

Claude has messed up again, and this time the AI deleted 700GB of files from a developer's home directory. According to a Machine Heart report republished by 36Kr, the culprit was the dreaded "rm -rf", and the trigger was the security-downgrade mechanism Anthropic built into Claude Code.

The developer, a heavy AI Agent user named Guillemot, frequently calls on AI coding agents in his daily work. He was bothered by one recurring problem: these agents never clean up after themselves, leaving piles of junk files in the /tmp directory. So he asked Claude Fable 5 to write a script that creates an independent sandbox folder for each agent under /tmp and automatically cleans it up once the task finishes. The core difficulty was that files still in use by other processes could not be deleted.

Fable quickly produced a solution that added logic to detect running agents and delay deletion. Guillemot found the code too complicated and asked for a simplified version. Up to this point, everything was normal. The turning point came at the security review stage.

Because the script involved hard deletion, Fable initiated an adversarial review on its own — starting a new model instance to check whether its own code was safe — which triggered Anthropic's security mechanism. Claude Code has a built-in security-downgrade system: when it decides a task involves sensitive operations such as cybersecurity, biotechnology, or file deletion, it automatically switches from a higher-capability model to a more conservative one, to reduce the chance of overly aggressive behavior in high-risk scenarios.

In this case, the system first downgraded the model from Fable 5 to Opus 5, then further to Opus 4.8. Opus 4.8 began running security tests, comparing the deletion script's target paths against /tmp and the user's home directory to confirm the script would not accidentally delete these critical directories. The tests passed: both /tmp and the home directory were correctly flagged as dangerous targets that must not be deleted.

The disaster happened in the cleanup step after the tests. While deleting temporary files generated during testing, Opus 4.8 reused the same variable name from the test phase, and that variable had been assigned the path of the user's home directory. The cleanup step then executed the deletion on that variable. In other words, the model had just confirmed that the home directory could not be deleted, and the very next second it deleted the home directory.

The developer terminated the process as soon as he noticed the anomaly, but it was too late. 700GB of data had been erased, a week's worth of work vanished completely, and the /tmp directory that was supposed to be cleaned remained entirely untouched. The incident reignited long-standing community complaints about the downgrade mechanism: it is too sensitive and misfires on normal coding tasks; model capability drops sharply while task complexity stays the same; and the downgrade is sticky, persisting for the whole session even when subsequent operations are harmless.

Some developers have even written hook scripts that automatically pause a session when a downgrade is detected, to stop the weaker model from continuing high-risk operations. The irony is that the security mechanism deems a task too dangerous for the stronger model and hands it to a weaker one, yet weaker models are exactly the ones more prone to mistakes in scenarios demanding precise handling of variable scopes and file paths. Whether Anthropic will adjust the sensitivity and stickiness of the mechanism is the key thing to watch.