{"slug": "claude-agent-deleted-about-700-gb-from-a-developers-home-directory-during-test", "title": "Claude agent deleted about 700 GB from a developer’s home directory during sandbox test", "summary": "An AI coding agent deleted about 700 gigabytes from developer Sebastien Guillemot's home directory while testing a sandbox designed to keep other agents' temporary files from consuming disk space, according to Guillemot's public posts. Guillemot said Claude Fable executed rm -rf against the directory, and he later recovered about 90% of his uncommitted changes from an old drive and the remainder from GitHub. Tom's Hardware reported that the test's cleanup logic reused a variable associated with the home directory, and that an automatic model downgrade may have contributed, but the underlying script and session logs were not published.", "body_md": "# Claude agent deleted about 700 GB from a developer’s home directory during sandbox test\n\n- Sebastien Guillemot said Claude Fable ran rm -rf against his home directory while testing a sandbox for temporary agent files.\n[[1]](https://zamantika.com/en/profile/SebastienGllmt) - Tom’s Hardware reported that the test’s cleanup logic reused a variable associated with the home directory, but the report did not publish the underlying script, shell trace or session logs.\n[[2]](https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-nukes-a-developers-700-gb-home-directory-while-testing-a-script-to-ensure-it-wouldnt-do-so-automatic-model-downgrade-may-have-contributed-to-the-screw-up) - Anthropic has publicly documented a safeguard that can block flagged Fable 5 requests and route them to Opus 4.8, while stressing that the mechanism can produce false positives. That documentation does not confirm what happened in Guillemot’s session.\n[[3]](https://www.anthropic.com/news/redeploying-fable-5) - Guillemot later said he recovered about 90% of his uncommitted changes from an old drive and the remainder from GitHub.\n[[1]](https://zamantika.com/en/profile/SebastienGllmt)\n\nAn AI coding agent deleted about 700 gigabytes from developer Sebastien Guillemot’s home directory while testing a sandbox designed to keep other agents’ temporary files from consuming disk space. Guillemot said Claude Fable executed rm -rf against the directory, while the intended /tmp cleanup was left unfinished. [[1]](https://zamantika.com/en/profile/SebastienGllmt)\n\nThe destructive command is supported by Guillemot’s public posts and contemporaneous reporting. The more consequential explanation — that Anthropic’s safety system downgraded the session to less capable models before a variable collision caused the deletion — remains a reported sequence, not a proven causal chain. [[2]](https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-nukes-a-developers-700-gb-home-directory-while-testing-a-script-to-ensure-it-wouldnt-do-so-automatic-model-downgrade-may-have-contributed-to-the-screw-up)\n\n## What the developer has confirmed\n\nGuillemot said he had been running multiple AI agents whose temporary output accumulated in /tmp. He asked Fable to build a mechanism that would give each agent its own temporary workspace and remove that workspace after the agent finished. In a public post dated August 26, 2026, he said Claude tried to test the sandbox by running rm -rf on his home directory and that the sandbox failed. [[1]](https://zamantika.com/en/profile/SebastienGllmt)\n\nIn follow-up posts, Guillemot said he was using Claude’s default auto mode. He later said he had recovered about 90% of his uncommitted changes from an old drive and found the rest on GitHub. He also said he was back to coding. [[1]](https://zamantika.com/en/profile/SebastienGllmt)\n\nThose posts establish the command, the broad scale of the loss and the recovery effort. They do not provide a complete session transcript, the generated script, a shell trace or a filesystem-level timeline. The precise order of model responses, tool calls and user approvals therefore remains unavailable for independent review.\n\n## The downgrade theory\n\nTom’s Hardware reported that Fable initially proposed more complicated logic to detect active agents and delay cleanup. After Guillemot asked for a simpler approach, the agent reportedly initiated an adversarial review of the deletion code. The article said Anthropic’s safety harness then downgraded the model from Fable 5 to Opus 5 and ultimately Opus 4.8 because the task appeared risky. [[2]](https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-nukes-a-developers-700-gb-home-directory-while-testing-a-script-to-ensure-it-wouldnt-do-so-automatic-model-downgrade-may-have-contributed-to-the-screw-up)\n\nAccording to that account, Opus 4.8 correctly identified both /tmp and the user’s home directory as dangerous targets during a safety test. The failure came afterward, when cleanup code reused a variable holding the home-directory path and passed it to the deletion operation. The test recognized the dangerous path but still used it during teardown. [[2]](https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-nukes-a-developers-700-gb-home-directory-while-testing-a-script-to-ensure-it-wouldnt-do-so-automatic-model-downgrade-may-have-contributed-to-the-screw-up)\n\nAnthropic has separately confirmed that Fable 5 uses safety classifiers that can block ambiguous cybersecurity-related requests and route them to Opus 4.8. The company says this safety margin intentionally flags some benign requests, and that users are notified when a request is blocked and rerouted. [3] Public GitHub issues filed against Anthropic’s Claude Code repository also describe users seeing Fable 5 sessions automatically switch to Opus 4.8 during ordinary development work. Those reports establish that the routing behavior exists, but not that it operated exactly as described in Guillemot’s session.\n\n[[4]](https://github.com/anthropics/claude-code/issues/67246)The causal claim should therefore remain qualified. A downgrade may have changed which model generated or reviewed the code, but no public log demonstrates that a Fable 5 instance would have caught the variable collision, or that Opus 4.8 independently introduced it. The live filesystem access and the absence of an enforced execution boundary were sufficient conditions for the mistake to become destructive.\n\n## The control failure is at the execution layer\n\nAnthropic’s own engineering documentation describes file and network policy proxies for Claude Code and Cowork, but it does not say that every local configuration prevents an agent from reaching a user’s home directory. [5] NIST similarly warns that local agents can inherit broadly scoped user access and recommends a hardened harness or tightly controlled sandbox that limits the files and systems an agent can reach.\n\n[[6]](https://www.nist.gov/blogs/cybersecurity-insights/back-future-why-agentic-ai-needs-strong-identity-foundation)Independent research on agent filesystem safety argues that model behavior alone is a weak enforcement point. Proposed defenses include staging changes for review, snapshots and progressively granted permissions. [7] Earlier documented Claude Code incidents also show that destructive commands can arise through different mechanisms, including shell expansion of an unintended directory named “~.”\n\n[[8]](https://www.docker.com/blog/coding-agent-horror-stories-the-rm-rf-incident)For Guillemot’s case, the clearest lesson does not depend on deciding whether Fable 5 or Opus 4.8 made the final mistake. A test of destructive behavior ran with access to live user data. A sandbox that exists only as code written and tested by the same agent is not an execution boundary; the boundary must be enforced by the operating system, a container, a virtual machine or a policy layer that can deny access regardless of the command the model generates.\n\n## Companies mentioned\n\n## Further sources\n\n[[1] Sebastien Guillemot’s public posts, mirrored by Zamantika, confirming that Fabl… ↗](https://zamantika.com/en/profile/SebastienGllmt)\n\n[[2] Tom’s Hardware report published August 28, 2026, describing the reported cleanu… ↗](https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-nukes-a-developers-700-gb-home-directory-while-testing-a-script-to-ensure-it-wouldnt-do-so-automatic-model-downgrade-may-have-contributed-to-the-screw-up)\n\n[[3] Anthropic’s June 30, 2026 explanation of Fable 5’s safety classifiers, intentio… ↗](https://www.anthropic.com/news/redeploying-fable-5)\n\n[[4] Public issues in Anthropic’s Claude Code repository reporting automatic Fable 5… ↗](https://github.com/anthropics/claude-code/issues/67246)\n\n[[5] Anthropic’s engineering documentation describing file and network policy proxie… ↗](https://www.anthropic.com/engineering/how-we-contain-claude)\n\n[[6] NIST guidance warning that local agents can inherit broadly scoped user access … ↗](https://www.nist.gov/blogs/cybersecurity-insights/back-future-why-agentic-ai-needs-strong-identity-foundation)+2 more\n\nThe stories that matter, in one email. Free — unsubscribe anytime.", "url": "https://wpnews.pro/news/claude-agent-deleted-about-700-gb-from-a-developers-home-directory-during-test", "canonical_source": "https://mlq.ai/news/claude-agent-deleted-about-700-gb-from-a-developers-home-directory-during-sandbox-test/", "published_at": "2026-08-30 14:51:10+00:00", "updated_at": "2026-09-02 12:24:54.742201+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": ["Sebastien Guillemot", "Claude Fable", "Anthropic", "Tom's Hardware", "Opus 4.8", "Fable 5", "Opus 5", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/claude-agent-deleted-about-700-gb-from-a-developers-home-directory-during-test", "markdown": "https://wpnews.pro/news/claude-agent-deleted-about-700-gb-from-a-developers-home-directory-during-test.md", "text": "https://wpnews.pro/news/claude-agent-deleted-about-700-gb-from-a-developers-home-directory-during-test.txt", "jsonld": "https://wpnews.pro/news/claude-agent-deleted-about-700-gb-from-a-developers-home-directory-during-test.jsonld"}}