{"schema_version":"0.10.0","id":"LR-2026-0711","record_version":1,"title":"Claude allegedly deletes 700GB of data during junk file cleanup","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: 36Kr · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: 36Kr · subject to change"}]},"sources_hash":"04908daca1c94781cf7ae11e3bb6f223bad05cff5a5898cf216eb3030b70fd22"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"writing an automatic script to clean up junk files left in /tmp by AI agents","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-02","incident_class":"operational_error","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A developer asked Claude Fable 5 to write a script that cleans up temporary junk files left by AI agents in /tmp. During a security review of the script, the system was downgraded to an older model, Opus 4.8, which ran a test checking whether the final deletion target was /tmp or the home directory. The test correctly identified both as dangerous. However, the test code and the cleanup code reused the same variable name, so the cleanup function deleted the home directory with rm -rf. About 700GB of data was deleted, including a week of work, while the /tmp files were left in place. The developer noticed the deletion and tried to stop the process, but it was too late. He recovered most of the data through Git, Nix and session logs. He had no daily backup.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Minor test: contained to one deployer (one developer's home directory); the sources state no third party was touched","harm_class":[],"affected_description":"one developer's home directory, about 700GB of data including a full week of work results","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://eu.36kr.com/en/p/3965936673054211","publisher":"36Kr","date":"2026-09-02","type":"press","title":"Claude AI Accidentally Deleted 700GB Data in One Click: CTO Left Stunned as Team’s Entire Week of Work Outputs Wiped Out When Attempting Junk File Cleanup - 36Kr","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.intended_use":"C","event.agent_involved":"C","impact.affected_description":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":0,"quote":"He originally just wanted Claude to write a script that automatically cleans up junk files left in the /tmp directory by AI Agents."}],"event.agent_involved":[{"source_index":0,"quote":"However, after a \"security review\", the AI wiped out his entire Home Directory — 700GB of data, a week's worth of work, gone in an instant."}],"impact.affected_description":[{"source_index":0,"quote":"Guillemot soon realized the problem and tried to terminate the process, but it was too late: about 700GB of data was deleted, including a full week of his work results; what made him even more speechless is that the junk files in /tmp that once gave him a headache and he hoped the AI could help clean up, were left behind instead."}],"event.incident_class":[{"source_index":0,"quote":"However, after a \"security review\", the AI wiped out his entire Home Directory — 700GB of data, a week's worth of work, gone in an instant."}],"impact.severity":[{"source_index":0,"quote":"Guillemot soon realized the problem and tried to terminate the process, but it was too late: about 700GB of data was deleted, including a full week of his work results; what made him even more speechless is that the junk files in /tmp that once gave him a headache and he hoped the AI could help clean up, were left behind instead."}],"impact.severity_because":[{"source_index":0,"quote":"Guillemot soon realized the problem and tried to terminate the process, but it was too late: about 700GB of data was deleted, including a full week of his work results; what made him even more speechless is that the junk files in /tmp that once gave him a headache and he hoped the AI could help clean up, were left behind instead."}],"event.summary":[{"source_index":0,"quote":"So he asked Claude Fable 5 to help write an automatic cleanup script: assign each Agent an independent /tmp directory, and delete all its corresponding temporary files after the task is completed."},{"source_index":0,"quote":"As a result, the model was first downgraded from Fable 5 to Opus 5, and then further downgraded to Opus 4.8."},{"source_index":0,"quote":"What was the result? The test succeeded, and both /tmp and the home directory were correctly identified as \"dangerous targets that cannot be deleted\"."},{"source_index":0,"quote":"The critical bug appeared: the test code and the cleanup code reused the same variable name."},{"source_index":0,"quote":"Then, a very familiar command appeared: rm -rf — which means right after the model confirmed \"this directory cannot be deleted\", it used the exact same variable to delete it in the next step."},{"source_index":0,"quote":"Guillemot soon realized the problem and tried to terminate the process, but it was too late: about 700GB of data was deleted, including a full week of his work results; what made him even more speechless is that the junk files in /tmp that once gave him a headache and he hoped the AI could help clean up, were left behind instead."},{"source_index":0,"quote":"The good news is that Guillemot finally recovered most of the data and work results through multiple sources such as Git, Nix, and Session Logs."},{"source_index":0,"quote":"yes, he ran so many AI Agents, but he didn't even have a daily backup."}]},"notes_on_gaps":"The incident date is not stated; only the approximate deletion time 05:23-05:24 is given, so date_occurred is omitted. No disclosure date is stated (the article is dated 2026-09-02 but that is not a disclosure date), so date_disclosed is omitted. The sources are press reports of a developer's public records; the title's 'allegedly' reflects this, and no Anthropic statement is in the source. failure_class is omitted because no closed-list class clearly fits the cleanup-logic error. event.trigger is omitted because no cause from the closed list is stated. root_cause is set to unknown because the bug is a code variable reuse, which is not a closed-list category; root_cause_detail records the stated fact. The developer's view that Fable 5 might have caught the bug is unverified speculation and is not recorded as a fact. No remediation or change by the provider or developer is reported, so remediations is empty. No direct loss amount, record count, or third-party count is stated. The severity judgment is minor under the test for one deployer with no third party touched. Harm class operational is my classification of data loss. The F1 'held' link is my judgment that session logs served as activity logs. Country is not stated and is omitted. Model version beyond names is not stated; the test ran on Opus 4.8 per the source. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: 36Kr · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Developer asked Claude Fable 5 for a script to delete temporary files left by agents in /tmp.","quote":"So he asked Claude Fable 5 to help write an automatic cleanup script: assign each Agent an independent /tmp directory, and delete all its corresponding temporary files after the task is completed.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A variable was reused between a security test and its cleanup step, so the cleanup deleted the home directory.","quote":"The critical bug appeared: the test code and the cleanup code reused the same variable name.","source_index":0,"grade":"C"},{"step":"caught","text":"The developer noticed the deletion and tried to stop the process, but it was too late.","quote":"Guillemot soon realized the problem and tried to terminate the process, but it was too late: about 700GB of data was deleted, including a full week of his work results; what made him even more speechless is that the junk files in /tmp that once gave him a headache and he hoped the AI could help clean up, were left behind instead.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://eu.36kr.com/en/p/3965936673054211"]},"analysis":{"sections":{"timeline":[{"text":"Model downgraded from Fable 5 to Opus 5, then to Opus 4.8, during the security review.","quote":"As a result, the model was first downgraded from Fable 5 to Opus 5, and then further downgraded to Opus 4.8.","source_index":0,"when":null},{"text":"Opus 4.8 began the security test on the deletion target.","quote":"Next, Opus 4.8 started to perform the security test.","source_index":0,"when":null},{"text":"The security test succeeded; /tmp and the home directory were identified as dangerous targets.","quote":"What was the result? The test succeeded, and both /tmp and the home directory were correctly identified as \"dangerous targets that cannot be deleted\".","source_index":0,"when":null},{"text":"Two files were written, the exit cleanup was triggered, and the final deletion occurred.","quote":"According to the records publicly displayed by Guillemot, the two relevant files had been written before, then the exit cleanup process was triggered, and the final deletion operation occurred at approximately 05:23-05:24.","source_index":0,"when":"05:23-05:24"},{"text":"The developer realized the problem and tried to stop the process, but about 700GB was already deleted.","quote":"Guillemot soon realized the problem and tried to terminate the process, but it was too late: about 700GB of data was deleted, including a full week of his work results; what made him even more speechless is that the junk files in /tmp that once gave him a headache and he hoped the AI could help clean up, were left behind instead.","source_index":0,"when":null},{"text":"Most data and work results were later recovered from Git, Nix and session logs.","quote":"The good news is that Guillemot finally recovered most of the data and work results through multiple sources such as Git, Nix, and Session Logs.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://eu.36kr.com/en/p/3965936673054211"]}}