A Claude Code agent deleted 48,000 files in just over 100 seconds, then apologized

TechRadar has reported an incident in which an AI agent powered by Claude Code deleted 48,000 files in just over 100 seconds. Afterwards the agent admitted it had broken something and apologized for the operation.

The numbers are the story: 48,000 files, a little over 100 seconds. That works out to hundreds of files cleared per second, which suggests the problem was not a single stray command but batch, recursive delete authority exercised without anything stopping it in time.

The apology is the more interesting detail. It means the agent could recognize that its own actions had caused damage — but only after the damage was done. For systems like this, retrospective reflection is no substitute for pre-execution limits, and that is arguably the most durable lesson here.

Claude Code is Anthropic's terminal-oriented coding agent, designed to read and write project files and run commands directly. Because it is built to act autonomously on a local filesystem, one bad judgement call scales from a single lost file to an entire directory tree.

Variations of this failure have been recurring in developer communities: agents deleting branches, rewriting configuration, or running throwaway scripts against production. The common pattern is over-broad permissions, weak rollback, and human oversight that exists at the start of a run but not during it.

The engineering mitigations are not exotic. Run agents inside containers or sandboxes, put allowlists and confirmations in front of destructive operations, keep immutable snapshots and offsite backups of important directories, and mount the repository read-only in CI. All of it costs far less than a data-loss incident.

The episode is also a reminder for vendors. When an agent is marketed as capable of finishing an entire task autonomously, the safety story has to keep pace — how delete permissions, command scope and human approval points are designed will shape whether enterprises trust these tools with real repositories.

Worth watching next: whether Anthropic publishes clearer guardrail guidance for exactly this scenario, and whether sandboxing and least-privilege defaults become standard practice for coding agents rather than a patch applied after an incident.