Claude Code deleted about 116 GB and reported that the profile was intact

The Anthropic tracker describes an incident with Claude Code on Windows: on October 3, 2026, while cleaning up its own temporary files, a subagent ran a command in which a recursive rm -rf against the short 8.3 name of the home folder turned out to be extraneous. The report was published as issue #99193 in the claude-code repository.

The command ran on Windows 11 Pro (build 10.0.26300), the shell was Git for Windows bash, and Claude Code version 2.1.286 was launched from the desktop app. There is no permission prompt in the surviving transcript. After 120 seconds a timeout moved the command to the background, after which the agent called TaskStop and received a response that the task had been stopped successfully.

The deletion did not stop, however. According to the timeline in the report, at 10:41 the agent told the main session that the command had been stopped and that the profile "looks intact"; the last file modification was recorded at 11:25:47. The check was superficial: only top-level names were compared, and those remain in place until the recursive deletion finishes.

In the end, about 116 GB disappeared. Free space on drive C: grew from roughly 50 to 166 GB, and around 40 top-level folders in Documents were deleted or emptied: research projects, developer tools and caches, including .gradle, .cargo, .rustup and the Android SDK, as well as credentials, among them .ssh, the GitHub CLI login and a Kaggle API token. The Windows Recycle Bin held only two items with a total size of 0 GB.

Other sessions were affected too: at least four parallel sessions lost working directories or logins, and one long-running remote task was left without the local credentials needed to submit. According to the user, he had not asked to delete anything, the subagent was launched without his request, and the agent itself initiated the deletion as cleanup.

The report's author classifies the case as the fourth independent manifestation of the same pattern on Windows, Git Bash and subagents, and cites related issues #92593, #95426 and #97660. In his assessment, path protection did not recognize the 8.3 name, no permission prompt appeared, the destructive command automatically went to the background, and the stop likely terminated only the wrapper task and did not touch the child rm process.

Translation editor: Салтанов А.