Cases › operational mistake › LR-2026-0711
Claude allegedly deletes 700GB of data during junk file cleanup
Preliminary Why: 1 report: 36Kr · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity minor: test: contained to one deployer (one developer's home directory); the sources state no third party was touched
A developer asked Claude Fable 5 to write a script that cleans up temporary junk files left by AI agents in /tmp. During a security review of the script, the system was downgraded to an older model, Opus 4.8, which ran a test checking whether the final deletion target was /tmp or the home directory. The test correctly identified both as dangerous. However, the test code and the cleanup code reused the same variable name, so the cleanup function deleted the home directory with rm -rf. About 700GB of data was deleted, including a week of work, while the /tmp files were left in place. The developer noticed the deletion and tried to stop the process, but it was too late. He recovered most of the data through Git, Nix and session logs. He had no daily backup.
What happened
What was done
No source states an action or fix.
Risks
Primary63 incidents
Rising: 5 vs 2.2 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
HarnessTool allow-list · Fail-closed defaults · Stop control
ApplicationHuman approval for high-impact actions · Change review and separation of duties · Least-privilege access for the agent · Production kept apart from test · Activity logs · Adversarial testing before deployment
Infrastructure / targetEvidence
No source states: what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 6 items from the primary sources
What happened, in order
Not dated in the sources:
- Model downgraded from Fable 5 to Opus 5, then to Opus 4.8, during the security review.
- Opus 4.8 began the security test on the deletion target.
- The security test succeeded; /tmp and the home directory were identified as dangerous targets.
- Two files were written, the exit cleanup was triggered, and the final deletion occurred.
- The developer realized the problem and tried to stop the process, but about 700GB was already deleted.
- Most data and work results were later recovered from Git, Nix and session logs.
Show every field, with its source and grade
The AI system
What happened
Impact
LR-2026-0711 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON