{"schema_version":"0.8.0","id":"LR-2026-0126","record_version":4,"title":"Claude Code agent deletes 48,218 Windows project files and damages Git object store","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":53.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":6.72,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-05","extraction_run_id":null},"system":{"model_name":"Claude","model_version":null,"developer":"Anthropic","harness":"Claude Code","tools_granted":["shell"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":"agentic_with_tools","intended_use":"rebuilding a mirror","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-05","incident_class":"operational_error","failure_class":"silent_wrong_state","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A Claude Code agent rebuilding a mirror deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds; a user-provided verifier report says the deletion script mishandled 614 Windows directory junctions and traversed into the live project tree. The account rests on a Reddit post and has not been independently established as a Claude Code product defect; no source states who first noticed, and no containment or notification is reported.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"unknown","root_cause_detail":null,"failure_class_detail":"According to the user-provided verifier report, the deletion script mishandled 614 Windows directory junctions, traversed into the live project tree, and erased nested content.","responsible_party":null,"adversarial_actor":"the_system_itself","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"minor: The loss was contained to one user's project, with 48,218 live Windows project files deleted and the repository's Git object store damaged, and no third party stated as affected.","harm_class":["operational"],"affected_description":"48,218 live Windows project files and the repository’s Git object store","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":"unknown","downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cybersecuritynews.com/cybersecurity-newsletter-weekly-october-2/","publisher":"news search (Google News index)","date":"2026-10-05","type":"press","title":"Cybersecurity Newsletter Bulletin – Pentagon Data Breach, Citrix, Fortimail and Apple 0-days and 20+ stories","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.tools_granted":"D","system.integration_type":"D","system.intended_use":"C","system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.failure_class":"D","event.root_cause":"D","event.adversarial_actor":"D","event.agent_involved":"C","event.detection_method":"D","event.incident_class":"D","event.summary":"D","event.date_disclosed":"A","event.trigger":"D","impact.harm_class":"D","impact.affected_description":"C","impact.reversibility":"D","impact.severity":"D","context.denominator_available":"D","context.country":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"system.developer":[{"source_index":0,"quote":"Anthropic’s Claude Compliance API gives security teams visibility into Claude Enterprise conversations, uploaded files, projects, and supported Claude Code and Cowork session data, including prompts, responses, tool calls, skills, and transcript artifacts."}],"system.harness":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"system.tools_granted":[{"source_index":0,"quote":"Even so, it illustrates why agents performing destructive operations need dry runs, explicit path manifests, reversible moves, least-privilege accounts, filesystem-restricted sandboxes, and human approval; Bash-based deletions may also fall outside checkpoint-based recovery."}],"system.autonomy_level":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"system.deployment_context":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"system.integration_type":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"system.intended_use":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"event.failure_class":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"event.detection_method":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"event.root_cause":[{"source_index":0,"quote":"According to the user-provided verifier report, the deletion script mishandled 614 Windows directory junctions, traversed into the live project tree, and erased nested content."}],"event.adversarial_actor":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"event.incident_class":[{"source_index":0,"quote":"According to the user-provided verifier report, the deletion script mishandled 614 Windows directory junctions, traversed into the live project tree, and erased nested content."}],"event.agent_involved":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"event.failure_class_detail":[{"source_index":0,"quote":"According to the user-provided verifier report, the deletion script mishandled 614 Windows directory junctions, traversed into the live project tree, and erased nested content."}],"impact.harm_class":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"impact.affected_description":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"impact.reversibility":[{"source_index":0,"quote":"Even so, it illustrates why agents performing destructive operations need dry runs, explicit path manifests, reversible moves, least-privilege accounts, filesystem-restricted sandboxes, and human approval; Bash-based deletions may also fall outside checkpoint-based recovery."}],"event.summary":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."},{"source_index":0,"quote":"According to the user-provided verifier report, the deletion script mishandled 614 Windows directory junctions, traversed into the live project tree, and erased nested content."},{"source_index":0,"quote":"The account is based on a Reddit post and has not been independently established as a Claude Code product defect."}],"impact.severity":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"impact.severity_because":[{"source_index":0,"quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-05"}]},"notes_on_gaps":"No source states the date the failure occurred or the date it was disclosed; no source states who first noticed the incident (detection_method unknown); no source states the arrangement of human oversight (autonomy_level unknown); no source states the deployment context; no source states a monetary loss figure, records exposed, third parties affected, remediation hours, or downstream exposure count; no source states containment, notification, or a control changed; no source states whether the model was intended for production; no source states the operator's industry, size, or country; no source states a regulatory regime or litigation status. event.trigger is written as unknown because no source names a cause. event.root_cause is written as unknown because the cited sentence describes the deletion script's mishandling of directory junctions but no source names a failed control, data defect, integration error, or other coded cause. event.failure_class is classified silent_wrong_state from the statement that the agent deleted files and damaged the Git object store, with no source stating the agent reported the wrong state. event.incident_class is classified operational_error from the statement that the deletion script mishandled directory junctions and erased nested content, with no adversary and no goal of the agent's own named. impact.severity is minor because the loss is contained to one user's project with no third party stated as affected; no dollar figure is stated so the dollar bands do not apply. impact.reversibility is unknown because no source states whether the deleted files or damaged Git object store were recovered. system.tools_granted is written as shell from the sentence about Bash-based deletions. system.developer is written as Anthropic from the sentence naming Anthropic's Claude Compliance API. system.model_name is written as Claude from the sentence naming Claude Code. system.harness is written as Claude Code from the same sentence. system.integration_type is written as agentic_with_tools from the sentence describing an agent performing destructive operations. system.intended_use is written as rebuilding a mirror from the sentence stating the agent was rebuilding a mirror. event.agent_involved is true from the sentence stating an agent deleted the files. event.adversarial_actor is the_system_itself from the sentence stating the agent deleted the files, with no external attacker named. event.duration is not written in fields because the pipeline computes it; no bounds are given because no dated timeline items exist. event.date_detected, event.time_to_contain, and event.date_disclosed are not written because no source states them. event.trigger: unknown was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-09] system.tools_granted: a source states the agent acted while a person watched or could stop it. system.integration_type: a source states the agent acted while a person watched or could stop it. system.developer: a source states the agent acted while a person watched or could stop it. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.adversarial_actor: the system's own behaviour caused the event. event.detection_method: no source says who first noticed. event.incident_class: a source states data or a system was left in a wrong state, deleted, corrupted or acted on unintentionally, and names no adversary and no goal of the agent's own. event.summary: classified from described behaviour. event.trigger: no source states a cause. impact.harm_class: a source states data or a system was left in a wrong state, deleted, corrupted or acted on unintentionally, and names no adversary and no goal of the agent's own. impact.reversibility: no source states the arrangement. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: severity reason printed the whole rubric] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"A Claude Code agent was rebuilding a mirror for a user, with Bash-based deletion access to the live Windows project tree and the repository's Git object store.","quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Its deletion script mishandled 614 Windows directory junctions, traversed into the live project tree and erased nested content, destroying live files and damaging the Git object store.","quote":"According to the user-provided verifier report, the deletion script mishandled 614 Windows directory junctions, traversed into the live project tree, and erased nested content.","source_index":0,"grade":"C"},{"step":"reached","text":"It erased 48,218 live Windows project files and damaged the repository's Git object store, all within 103 seconds.","quote":"A Claude Code user reported that an agent deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds while rebuilding a mirror.","source_index":0,"grade":"C"},{"step":"caught","text":"The chunk does not say who first noticed; the account rests on a user-provided verifier report and a Reddit post.","quote":"The account is based on a Reddit post and has not been independently established as a Claude Code product defect.","source_index":0,"grade":"C"},{"step":"done","text":"The chunk states no containment or notification; it only notes that such agents need dry runs, path manifests, reversible moves, least-privilege accounts, sandboxes and human approval.","quote":"Even so, it illustrates why agents performing destructive operations need dry runs, explicit path manifests, reversible moves, least-privilege accounts, filesystem-restricted sandboxes, and human approval; Bash-based deletions may also fall outside checkpoint-based recovery.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-09","source_urls":["https://cybersecuritynews.com/cybersecurity-newsletter-weekly-october-2/"]}}