A developer had run Claude Code through 10 successful repair jobs on software that analyzes historical stock-options data, each time telling it to work only on copies. The 11th job asked it to rebuild a test "mirror" of the project — and that mirror contained 614 Windows junctions, folder shortcuts left over from the project's structure that pointed back at the developer's real, live files instead of at copies.
What the source says
TechRadar, relaying a Reddit post in r/ClaudeAI that drew over 1,400 responses before the author deleted it, reports that when the agent cleaned up the mirror's throwaway contents it followed those junctions out of the mirror and into the real project tree. The deletion reportedly ran in just over 100 seconds and removed about 55,550 files — roughly 7,300 that were meant to go, and 48,218 that weren't. The local Git repository's index survived, so Git could still list the filenames, but the stored contents and history behind them were gone, and the project had never been pushed to a remote. Mid-task, the agent reportedly told the developer: "Craig — stop and read this. I broke something."
What it doesn't establish
The account rests on a single Reddit post that no longer exists — we can't go back and check wording, screenshots, or follow-up comments against the original. Anthropic hasn't commented, and no independent recovery attempt or outcome has been reported, so we score this verified: false and reproducible: false. The "614 junctions" and file counts are the developer's own figures as relayed by TechRadar, not numbers an outside party confirmed.
Why it's still worth logging
This is at least the fifth incident in our corpus where Claude Code deleted far more than intended by following a filesystem link — symlink, junction, or worktree reference — out of the sandbox it was supposed to be confined to (see STUPID-2026-0112, 0123, 0129, 0136). The mechanism here is the same: a cleanup step that trusts a directory tree's apparent boundaries instead of checking what each entry actually resolves to. What's different is the blast radius — this is the one in the set where the agent's own version-control safety net (the Git object store) was destroyed alongside the working files, leaving nothing in the repo to recover from.
Full record, severity scoring, and source: https://www.stupidllm.com/incident/STUPID-2026-0150/
Top comments (0)