A test run while adding a delete guard apparently wiped the Mac home directory in Claude Code (unverified report)

What happened

According to the author (a product manager at an IT company who builds iOS apps with Claude Code as a solo developer), late on October 7, 2026, files in the Mac's home directory were deleted en masse while Claude Code was handling development. The work was running overnight in auto mode, in which a classifier (a separate model) takes over the per-action permission prompts from the human.

At the time, neither a sandbox nor Time Machine was installed, and every instruction to subagents included "do not push". This is the author's own after-the-fact report, and the cause is an estimate.

The chaos on the ground

The author gives the following timeline (JST):

• 01:58 A review subagent proposed adding a guard to sign_macos27.sh, a shell script used to sign and verify files, so that it stops when its argument is the home directory. The main session passed the task to a working subagent.
• 02:01 The subagent's last log entry read "Add guard/select tests and run RED".
• 02:04 The main session reported that files were being deleted en masse and said it did not think it was their work.
• 08:02 The author read the report.
• 08:04 The main session retracted the 02:04 statement as an unfounded assertion.

The author says the report made them cry out when they read it in the morning. About nine days of commits that had not been pushed to GitHub were gone along with the local .git. The subagent's logs were inside the deleted directory and a macOS update also ran that night, so what did the deletion cannot be stated definitively.

Root cause

In the author's estimate, sign_macos27.sh contained a step that runs rm -rf on the directory it receives as an argument. The subagent ran the tests during the RED stage of TDD (running tests before implementation to confirm they fail) without having written the guard yet. The tests appear to have checked that passing the home directory would make the script stop. Because the guard did not exist, the script deleted the real home directory it was handed. The command from that night was not preserved; from the subagent's last log, the author believes it was a single line that ran the tests.

Per the author, Claude Code's pre-execution checks read the one line of command Claude types and decide whether to allow or block it. The author gives these reasons the three checks did not stop it:

• Deny rules: the line that runs the tests matches none of the patterns.
• Critical-path protection: it targets rm and rmdir typed by Claude, and the author says the official documentation does not state that an rm inside a script file called from a test is covered. Had Claude typed rm -rf ~ directly, it would have been refused, the author says.
• The auto-mode classifier: it receives the user's messages, tool calls and CLAUDE.md, but not tool results (such as the contents of a script that was read).

The author says a custom hook added afterwards would also receive only the same single line. Without a sandbox, an allowed command can write anywhere the user account can write. There was also no backup.

The fix

The author's main measures are an OS-level sandbox that restricts write locations and a backup outside the Mac. Deny rules and hooks are described as supplementary, catching common dangerous patterns early.

• In ~/.claude/settings.json, set sandbox.enabled to true and allowUnsandboxedCommands to false, so Claude cannot re-run a rejected command outside the sandbox.
• Take a backup outside the Mac, such as Time Machine, and push approved commits immediately, because the sandbox still allows deletion inside the working directory.
• Run deletion tests only inside a per-test temporary directory.
• Write hooks that judge deletion and write targets, checked by 68 tests that pass a fake home directory to the judging functions. If a hook ends by timeout or startup failure, "onFailure": "block" stops the command (per the author, this takes effect in the CLI from 2.1.295).
• Things run outside the sandbox were narrowed to Xcode tests and builds, xcrun simctl, gh and git push, among others, each with a replacement safeguard.

The author's environment as of October 19, 2026 was macOS with Claude Code CLI 2.1.292 and VS Code extension 2.1.301. The version that night was 2.1.286.

The lesson is not to hand real paths to tests of scripts that delete, and not to rely on pre-execution checks alone but to keep an OS-level restriction and a backup.