What happened
On October 27, 2026, at 04:54 UTC (11:54 PM CT on October 26), GitHub user raihanlh filed issue #105342 on Anthropic’s public claude-code repository: “Subagent-written test ran rm -rf ~ on the real home directory, deleting all of my unpushed works; worktree isolation didn’t contain it.” The report lists Claude Code 2.1.311 with Opus 5.5 on macOS, in auto permission mode with Bash sandboxing disabled. It does not give the date of the incident.
According to the report, the user asked Claude Code to build a feature, and the main agent handed the work to a subagent with isolation set to “worktree”. The subagent wrote a Rust test to check that a shell-script driver rejects non-numeric input. Its test fixture stood in for ssh by passing its arguments to a real shell, and the test’s sample input was “20; rm -rf ~”. The shell split that into two commands and ran the second one against the user’s real home folder.
“cargo test took about 7 minutes and the test passed,” the report says. The subagent noticed only when its next commands failed because its working directory no longer existed; it then stopped and reported what had happened instead of trying to recover. The report says the deletion took the main project checkout with its .git history and local issue database, several other project folders, ~/.zshrc and the contents of ~/.config, including the GitHub CLI login. Desktop, Documents, Library and ~/.ssh survived; the report was corrected to say ~/.ssh was not touched. There was no Time Machine and there were no snapshots, so unpushed commits and uncommitted work were lost.
The reporter adds one more detail, which they say they will file separately: a second Claude Code session, also in auto mode, noticed the running deletion and tried to kill it, but its auto-mode classifier denied the kill as “Interfere With Workloads”, so it had to wait for the user. The reporter’s point is that the dangerous command never appeared in a Bash call; it was inside a test file, so checks on typed commands never saw it.
The limits matter. This is one user’s account; the transcripts were offered to Anthropic privately, not published, and Anthropic had not replied on the issue when we last checked, on October 27 at about 10:20 AM CT. The “high-priority” and “data-loss” labels were added by a bot. Anthropic’s documentation says worktree isolation checks edits, working directories and git commands, and that it does not track which files a shell command writes; those fall to the user’s permission and sandboxing settings, and sandboxing was off. On the same day, a Claude Code team member posted that even its most permissive mode still blocks commands like rm -rf ~; this command, per the report, ran from inside a test instead. The second-session kill-refusal claim had not been filed separately when we checked. The incident date was not given. It is one report, not a rate.