No temp folder. The cleanup ran anyway.

What happened

On October 17, 2026, at 02:31 UTC, GitHub user VTFLAB filed issue #102901 on Anthropic’s public claude-code repository: “Bash `find $T -type f -delete` with unset T deletes entire git checkout.” The report lists Claude Code 2.1.300 with the claude-opus-5-5 model on Arch Linux, with the Bash sandbox on and bypass-permissions mode, and gives the tool call time as 02:08:18 UTC that day. It says the user agrees to share the session transcript.

According to the report, the previous tool call had changed into the repository root to make a git commit, and Claude Code’s Bash tool keeps the working directory between calls. In the next turn the model wrote paths as if it were still in a mod subfolder and ended one long command with “luac5.4 -p Scripts/world.lua && T=$(mktemp -d $TMPDIR/pmh.XXXX); … find $T -type f -delete; …”. That script did not exist at the root, so the syntax check failed. The “&&” skipped only the temp-folder assignment; the commands after the “;” ran anyway, with T unset.

Unquoted and empty, “find $T -type f -delete” became “find -type f -delete”, which searches from the current directory. The report says it deleted every file in the repository: about 5,200 working files plus the .git objects and refs. Only paths the sandbox mounts read-only (.git/hooks, .git/config and .claude/settings.local.json) survived. Nothing in the user’s request involved deleting anything, the report says, but the user’s CLAUDE.md had told the model to clean temp folders with “find -type f -delete”.

The reporter says deny rules such as “Bash(rm -rf*)” did not apply because the deletion used find, and that the sandbox allowed it because the working directory is writable by design. The data came back only because a Syncthing mirror on a NAS had not yet received the deletion and the last commit had been pushed. The reporter asks for the model to guard deletion targets (for example with “${T:?}”), for a built-in check, whatever the permission mode, that blocks deletions aimed at an unguarded variable, an implicit current folder, / or a git checkout root, and for Claude Code to show the model its current directory when it has changed. Locally, they added a PreToolUse hook that denies these patterns.

Anthropic’s permissions documentation says bypassPermissions mode skips permission prompts and should be used only in isolated environments such as containers or VMs where Claude Code can’t cause damage. It also says a Bash deny rule matches the command text Claude writes and “isn’t a security boundary around the program”, and that instructions in CLAUDE.md shape what Claude tries but don’t change what Claude Code allows. The issue’s labels, including “high-priority” and “data-loss”, were added by a GitHub Actions bot within two minutes of filing. As of the morning of October 20, no Anthropic maintainer had commented; the only reply came from another user pitching a tool. The StupidLLM incident tracker listed the report on October 19. This is one person’s account, not independently verified, and it says nothing about how often this happens.