AI Risk Wire

Cases › operational mistake › LR-2026-0680

Claude Opus 5 deletes developer's home directory during backup and wipes files

Confirmed Why: 2 independent outlets · 2 independent reports

Status: no action reported

Severity minor
Reported 7 Aug 2026
Agent tool Claude Code

No source states: loss or records, developer and model, could do, deployer, industry.

Severity minor: Test: minor, because the loss is contained to one deployer and no third party is stated to be touched.

An AI agent was asked to back up a developer's system. The developer's own account, relayed by Tom's Hardware, says the agent, running in a Unix-style shell on Windows, believed it had made the backup in the wrong directory and ran a recursive delete on what it took to be the backup, removing the entire profile folder. A separate press account from 36Kr describes a different sequence: during an adversarial security review of a cleanup script, a model that had been downgraded to Opus 4.8 reused a test variable holding the home directory path in its cleanup step, and about 700GB was erased. The developer ended the process on noticing the anomaly. The sources disagree on the model, the mechanism and the scale of loss, and neither reports a remediation. The press frames the case as a warning against giving agents broad access to systems.

What happened

1 · What it was doingThe developer asked the agent to back up their system.
2 · What went wrongThe agent ran a recursive delete on what it took to be a backup and removed the whole profile folder.
3 · What it reached or didThe agent was running in a Unix-style shell on Windows and misread a path it expected to be a Windows path.
4 · How it was caughtThe developer ended the process after noticing the anomaly.

What was done

No source states an action or fix.

Risks

Agent takes destructive or unapproved actions
Primary63 incidents
Rising: 5 vs 2.2 a week

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Tool allow-list · Fail-closed defaults · Stop control

Application

Human approval for high-impact actions · Change review and separation of duties · Least-privilege access for the agent · Production kept apart from test · Activity logs · Adversarial testing before deployment

Infrastructure / target

Backups and recovery

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 9 items from the primary sources

What happened, in order

Not dated in the sources:

  • The developer asked the AI to write a script to stop files being deleted by accident.
  • During a security review the model was downgraded from Fable 5 to Opus 5 and then to Opus 4.8.
  • In the cleanup step the model reused a test variable that held the home directory path, and deleted it.
  • The developer instructed the agent to back up their system.
  • The agent believed it had created the backup in the wrong directory.
  • The agent deleted the entire profile folder.
  • After the deletion the agent replied with an apology for a typo.
  • The developer terminated the process after detecting the anomaly, too late to save the data.
  • The /tmp directory that the script was meant to clean was left untouched.
Show every field, with its source and grade

The AI system

Software around the model
Claude Code
C one secondary source states it
What it was for
back up the developer's system
C one secondary source states it

What happened

Earliest source we hold
2026-08-07
D inferred by us from the described behaviour, reason shown
Who caught it
the victim
C one secondary source states it
What went wrong
operational mistake
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Why this severity
Test: minor, because the loss is contained to one deployer and no third party is stated to be touched.
D inferred by us from the described behaviour, reason shown

Notes on gaps

No disclosure date is given as a sentence in the sources.

LR-2026-0680 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON