Claude wiped 700 GB of a developer's data during its own safety test

The script existed to prove Claude could delete files safely. It deleted 700 GB, including the developer’s entire home directory, while the folder it was told to clean survived untouched.

How the deletion happened

Developer Sebastien Guillemot asked Claude to build isolated folders in /tmp for his AI agents to work in, then clean them up when they finished. Anthropic’s safety harness flagged the deletion script as risky and quietly downgraded the model, first to Opus 5, then to Opus 4.8. The downgraded model still got the critical judgment right: it decided the home directory must never be touched. Then the cleanup step reused the same variable name for the test folder and the final cleanup, and the collision pointed the delete at the home directory instead. A week of work went in one run.

Guillemot recovered most of the data by reassembling it from git, nix and session logs, and noted that he runs dozens of AI agents daily without keeping daily backups.

The uncomfortable mechanism

Analysts covering the incident point at the downgrade itself: the stronger model that was swapped out might have caught the variable collision. A system designed to make the agent safer made this particular failure more likely. That inversion is the story. As safety harnesses gain the power to swap models mid-task, the behavior of the substituted model becomes part of the safety surface, and a substitution that weakens code review can cost more than the risk it was guarding against.

For anyone giving an AI agent shell access, the failure mode to plan for is not malice. It is a variable name, and the difference between a test directory and a home directory.