AI coding agents are becoming increasingly capable of writing code, running commands and managing complex development tasks with surprisingly little human intervention. But one recent incident involving Anthropic's Claude Code shows just how quickly that autonomy can turn into a disaster when an AI agent is given access to a real computer filesystem.
Image Courtesy : Photo Illustration by Algi Febri Sugita / SOPA Images via Getty Images
A developer says Claude Code deleted approximately 48,218 live files in just 103 seconds, destroying critical project data and also wiping out important portions of the project's Git repository. The incident, which surfaced on Reddit and subsequently spread across the technology community, has become a particularly memorable example of the risks associated with allowing AI agents to execute commands with broad permissions.
The most striking part may be what happened immediately afterward. Rather than continuing as though nothing had happened, the AI apparently recognized that something had gone catastrophically wrong and told its user: "Craig — stop and read this. I broke something."
That brutally honest admission has since become one of the defining details of the incident, but the underlying technical failure is much more serious than the amusing apology suggests.
According to the account reported by TechRadar, the developer was using Claude Code to repair software associated with historical stock-options data. The developer had instructed the AI to make copies of relevant files, perform repairs on those copies, test the results and leave the original working files untouched. Several repair jobs were reportedly running successfully before the final task went badly wrong.
The final job involved rebuilding a testing environment known as a "mirror." The purpose of the mirror was to provide a copy of the working environment where repairs could be performed safely without modifying the original files.
The problem involved Windows directory junctions.
Junctions can look like ordinary folders in Windows, but they actually function as filesystem pointers to another location. In this particular environment, the testing directory reportedly contained 614 junctions that pointed back toward the developer's live working files.
When Claude Code attempted to clean up those junctions, it apparently treated them as ordinary directories rather than safely handling them as links. Instead of simply removing the pointers from the testing environment, the cleanup process followed them into the locations containing the real working files.
The result was catastrophic.
The cleanup operation reportedly removed approximately 55,550 files in total. About 7,300 of those files were apparently intended to be deleted as part of the testing operation. The remaining 48,218 files belonged to the developer's live working environment. The entire process reportedly took just 103 seconds.
That works out to hundreds of files being removed every second.
And because the operation was being performed by an automated coding agent rather than a human sitting in front of Windows Explorer, there was little opportunity to notice what was happening and intervene before the damage was done.
The damage also extended into Git.
Git is one of the most widely used version-control systems in software development because it allows developers to maintain a history of changes and restore earlier versions of their projects. But in this case, the Git repository itself was reportedly damaged during the deletion.
The repository's index survived, meaning Git could still identify thousands of filenames, but important data stored inside the repository's .git/objects, references and logs was reportedly deleted. That meant the existence of the files could still be visible to Git, while the underlying content needed to reconstruct them was no longer available locally.
This is where the story became particularly painful for developers reading it online.
If a developer has a properly configured remote repository, deleting a local working directory is usually an inconvenience rather than an existential disaster. The project can often be cloned again from GitHub, GitLab or another remote repository.
But according to the Reddit discussion surrounding this incident, the developer apparently did not have the project backed up remotely in a way that could simply restore the lost files.
That omission quickly became one of the biggest subjects of discussion.
The original Reddit post, which has since been deleted, attracted thousands of votes and more than a thousand comments as developers debated what went wrong and how the situation could have been prevented. Redditors were quick to point out that version control and remote backups should be considered essential before allowing an AI agent to perform potentially destructive operations on a live project.
The reaction was not exactly sympathetic.
The phrase "classic FAFO" circulated heavily around the discussion, with commenters arguing that the incident demonstrated what can happen when developers give powerful automation tools extensive permissions without maintaining an independent backup.
Some commenters essentially viewed the event as a painful lesson in basic development hygiene rather than evidence that AI coding agents are uniquely dangerous.
That distinction is important.
Software developers have been accidentally deleting files for decades. A badly constructed rm -rf command can erase enormous amounts of data almost instantly. A developer can point a script at the wrong directory, overwrite a production database or accidentally destroy a server.
The difference with AI agents is that the person operating the computer may not necessarily know exactly which commands the agent will execute.
That changes the risk calculation.
A traditional command-line tool does precisely what the user tells it to do. An AI coding agent is given a goal and can determine the steps it believes are necessary to achieve that goal. It can inspect files, write scripts, execute commands, interpret errors and modify its strategy based on what happens.
That flexibility is what makes these systems useful.
It is also what makes them potentially dangerous when their interpretation of the environment is wrong.
In this case, the reported Windows junction issue illustrates the problem particularly well. From a high-level perspective, the AI was apparently trying to clean a testing directory. But the filesystem contained a structure in which some apparent directories were actually pointers to live data.
A human developer familiar with Windows junctions might recognize the danger immediately. An AI agent operating through filesystem commands may not.
Once the deletion process began, the speed of automation made the problem dramatically worse.
The developer didn't have to manually delete 48,000 files. The agent effectively did it on the developer's behalf.
That is an important characteristic of autonomous systems. They can compress actions that might take a human minutes or hours into seconds.
When the action is beneficial, that is the entire appeal.
When the action is destructive, the same speed becomes the problem.
The Reddit discussion also revealed another important point: Git itself is not automatically a backup.
Many developers assume that because a project uses Git, their work is protected. But Git repositories exist locally unless their contents are pushed somewhere else. If an AI agent has sufficient permissions to delete the .git directory or its underlying objects, local version history can disappear along with the working files.
A remote repository provides a separate copy that the local agent cannot destroy unless it also has credentials and permission to modify the remote repository.
That is why several Redditors emphasized pushing code to a remote repository regularly and protecting the main branch from direct automated changes.
The incident therefore offers a lesson that goes beyond simply "don't use AI."
In fact, the more useful takeaway may be that AI agents should be treated as powerful automation tools rather than as harmless chatbots.
A chatbot can suggest a command.
An agent can actually execute it.
That distinction should determine how much access the system receives.
If an AI agent only has read access, its ability to cause permanent damage is substantially reduced. If it can edit files inside a disposable development environment, the risk is manageable. If it can execute arbitrary commands against a developer's primary machine, access production infrastructure or delete files without additional approval, the potential consequences become considerably larger.
The same principle applies to credentials.
An AI agent with access to a GitHub account, cloud environment, database, production server or corporate filesystem could potentially perform actions far beyond editing source code.
The more permissions the agent receives, the more important it becomes to establish boundaries around what it can and cannot do.
That is particularly relevant as coding agents become more autonomous.
Claude Code is designed to work directly with development environments, allowing developers to ask it to inspect repositories, write and modify code, execute commands and perform multi-step programming tasks. The entire value proposition is that the agent can do more than simply generate a code snippet and wait for a human to copy it into a terminal.
But that means users are effectively giving an AI system operational control over parts of their computing environment.
The 48,000-file incident demonstrates what happens when the system's understanding of that environment doesn't match reality.
There is also an important caveat surrounding the story.
The original Reddit post was deleted, and the detailed account comes primarily from reporting based on the post and subsequent discussion. An independent forensic investigation has not publicly established every detail of the incident, and Anthropic has not publicly confirmed the specific event. One publication explicitly notes that the underlying Reddit claim is not independently verified.
That means the exact file count and technical sequence should be treated as the developer's reported account rather than as independently established facts.
Even with that qualification, the underlying failure mode is technically plausible and has attracted substantial discussion among developers. Windows directory junctions can create filesystem relationships that are easy to misunderstand, particularly for automated tools that recursively traverse directories.
And the broader risk does not depend on whether the exact number was 48,218.
The important question is whether an AI coding agent can be given enough filesystem access to accidentally cause large-scale damage.
The answer is clearly yes.
The incident also arrives at a time when AI agents are increasingly being trusted with tasks that were previously performed manually by software engineers.
Developers are asking agents to refactor entire applications, migrate databases, install dependencies, modify configuration files, run tests, deploy applications and troubleshoot production problems.
Each additional capability creates another potential failure mode.
The challenge for the industry is therefore shifting from simply making AI agents capable of completing tasks to making them capable of recognizing when they should stop.
An ideal coding agent should not only know how to execute a command. It should understand when a command could have unusually destructive consequences.
For example, an agent preparing to delete tens of thousands of files could potentially pause and request confirmation. It could inspect whether the target contains symbolic links or junctions. It could verify that the directory being modified is actually the intended test environment. It could create a snapshot or backup before performing an irreversible operation.
Those safeguards could dramatically reduce the consequences of a mistaken interpretation.
Developers can also impose their own protections.
Running agents inside containers or virtual machines can isolate them from important files. Restricting filesystem permissions can prevent accidental access to unrelated directories. Using separate development branches can protect production code. Remote repositories provide recovery points. Automated backups and snapshots can provide another layer of protection.
And perhaps most importantly, developers can avoid giving autonomous agents unrestricted access simply because doing so is convenient.
The irony of the incident is that the developer was apparently trying to make the workflow safer by creating a separate testing mirror.
The test environment was supposed to protect the live files.
Instead, the relationship between the mirror and the live environment became the mechanism through which the live files were destroyed.
That is exactly the sort of edge case that makes autonomous software particularly difficult to secure.
The AI wasn't necessarily attempting to destroy the project.
It was attempting to accomplish the task it interpreted from its instructions.
The problem was that its understanding of the filesystem and the consequences of its cleanup operation apparently didn't line up with the developer's expectations.
And once it made the wrong decision, it made that decision extremely quickly.
The apology afterward is almost comical because of how human it sounds.
"Craig — stop and read this. I broke something."
That sentence has been widely repeated because it captures the strange reality of AI agents: a system can cause enormous damage autonomously and then immediately explain to its user that it has made a mistake.
But recognizing the mistake after 48,000 files have disappeared is obviously very different from preventing it.
That distinction is likely to become increasingly important as AI agents become more deeply integrated into everyday computing.
Today's coding agent might delete a development project.
Tomorrow's agent could potentially have access to cloud infrastructure, financial systems, company databases, customer records or production environments.
The stakes increase with every additional permission.
For now, the Reddit incident has become a cautionary tale for developers experimenting with autonomous coding tools. The online reaction may have been filled with jokes about FAFO and "skill issues," but underneath the humor is a serious lesson: AI agents should be given only the access they actually need, and anything important should exist somewhere the agent cannot destroy.
Git, remote repositories, backups, permissions, isolated environments and human approval for destructive operations may not sound particularly futuristic.
But as AI agents become more powerful, those old-fashioned safeguards could become more important than ever.
Because when an autonomous system has the ability to execute commands, the difference between "please clean up this test folder" and "delete half my project" can sometimes be just one misunderstood filesystem link.
And apparently, it can take only 103 seconds to find out which interpretation the machine chose.