Claude deletes 700 GB from a developer's home directory during a script test

Developer Sebastien Guillemot asked Anthropic's Claude to write a script that would sandbox each of his AI coding agents inside its own folder under /tmp and automatically clean up after they finished running. On 27 August 2026, that same script instead deleted his entire home directory, destroying roughly 700 GB of data and about a week of work, according to his own account and reporting by Tom's Hardware and AI Times.

Guillemot runs AI agents often and had grown frustrated that many of them left junk files behind in the shared /tmp directory instead of cleaning up after themselves. He asked Claude, referred to in the coverage by its internal codename Fable, to add isolation and cleanup logic. Claude's first proposal added detection logic to delay deleting files still in use by a running agent, but Guillemot judged the resulting code too complicated and asked for something simpler.

An adversarial review, then a downgrade mid-task

Because the script involved permanently deleting data, Claude decided on its own to run what is called an adversarial review: it launched a separate copy of itself to check its own work for safety problems before running it. Partway through that process, Anthropic's safety harness judged the script risky enough to automatically downgrade the model handling it, first from Opus 5 to Opus 4.8, according to AI Times, which cites Guillemot's account. Guillemot did not ask for the downgrade himself; it was triggered by the harness's own assessment of a script capable of deleting files.

Running as Opus 4.8, Claude carried out the safety test the adversarial review had called for, checking whether the deletion targets written into the script matched dangerous paths such as /tmp or the user's home directory. That check worked exactly as intended: both paths were correctly flagged as dangerous during the test phase. Guillemot has said he believes Opus 5, the model in place before the downgrade and reported to outperform Opus 4.8 on coding tasks, would likely have caught what happened next.

One variable name, reused between the test and the cleanup

The safety check only covered the test phase of the script, not the cleanup step that followed it. Any code test needs its own cleanup afterward, and Claude wrote that cleanup step using the same variable name it had already used to hold the test's target path. Because both phases shared one variable, the value that had safely pointed to an isolated test path during the safety check ended up pointing at Guillemot's real home directory once the cleanup step ran — and Claude executed what amounted to a recursive delete against it.

• About 700 GB of data deleted, including roughly a week of Guillemot's work
• Anthropic's safety harness downgraded the model handling the script from Opus 5 to Opus 4.8 mid-task, without Guillemot requesting it
• The adversarial safety review correctly flagged /tmp and the home directory as dangerous deletion targets — but only checked the test phase, not the cleanup phase
• The original clutter in /tmp that prompted the whole project was left untouched by the deletion

The story spread quickly after Guillemot posted about it online, and other developers responded by pointing to third-party tools — Tom's Hardware named Termaxa as one example — built specifically to sandbox AI coding agents or recover from exactly this kind of mistake. Tom's Hardware noted the irony directly: an entire category of safety tooling now exists to guard against AI agents deleting the wrong data, and building a tool in that very category is what triggered this deletion.

Guillemot stopped the process as soon as he noticed what was happening, but not before most of the directory was gone. He said he recovered the bulk of his data by piecing it back together from git repositories, Nix store data and session logs, rather than from a backup — by his own account, none of the many AI agents he runs had ever been asked to make one.

What this means for teams running AI coding agents

For software teams that have adopted Claude, Cursor or similar AI coding agents for day-to-day development work, the incident is a reminder that a safety system's own internal state — including which model version is currently handling a task — can change mid-run without any visible warning to the person watching the terminal. An adversarial review that checks a script's intent is not the same as checking every phase that script will actually execute. Any workflow that lets an agent run destructive commands, even inside what looks like a contained test, still needs an independent backup that does not depend on the agent behaving correctly.