DEV Community

Ramdai Bista
Ramdai Bista

Posted on Originally published at stupidllm.com

Claude Code Wiped Its Own Config Directory Four Times in Three Weeks — Including 19 Live API Keys

The fourth wipe happened mid-session, while the user was actively working. The chat window went blank and the folder was gone.

What the source says

GitHub issue #93791, filed September 12, 2026, documents four separate incidents over roughly three weeks in which a Claude Code user's entire ~/.claude configuration directory — on Windows 11, v2.1.269, auto-update channel — was silently deleted and recreated from scratch.

The timeline: a first wipe around August 25-26 destroyed roughly 3,572 transcripts along with skills, plugins, and hooks. A second hit on September 8. A third, on September 12 at 07:29:35, destroyed 7,462 transcripts and the full config. A fourth, about two hours later that same day, repeated the wipe and additionally cleared a secrets/ subfolder holding 19 live API token files — credentials the user then had to regenerate.

Each wipe left the same signature: the folder's creation timestamp changed, .claude.json came back blank, settings.json reverted to a stub missing most hooks, and prompt history was zeroed out. The reporter ruled out the usual suspects — antivirus, OneDrive/Google Drive sync, Windows scheduled tasks, auto-update (nothing ran at any of the four timestamps), and malware — and instead found a ~/.claude/backups/ folder containing timestamped .claude.json.backup files, suggesting an internal config-repair mechanism that clears the directory outright instead of merging a fix into it.

The issue ties this to two older, still-open reports describing the same behavior on narrower parts of the directory: #41415, where Claude Code's own node process silently deleted ~/.claude/agents/ (closed "not planned"), and #34330, where ~/.claude/skills/ was cleared within roughly 300ms of file creation. Filed with labels area:core, bug, data-loss, has-repro, and platform:windows, issue #93791 remained open with no maintainer response as of publication.

What it doesn't establish

This is one user's report, documented across four dated occurrences rather than a single event — but still one install, one platform. Nobody, including Anthropic, has confirmed the root cause; the config-repair-that-clears-instead-of-merges theory is the reporter's inference from the evidence available (a backups/ folder full of timestamped snapshots), not a maintainer's diagnosis. It's Windows-specific in this report — there's no data here on whether macOS or Linux installs show the same pattern. Severity is scored medium (6.8): the direct damage in this report is transcripts and config, and only the fourth wipe touched live credentials.

Why it's worth tracking anyway

The pattern is the story more than any single wipe. Three separate GitHub issues, filed months apart, describe Claude Code's own internal mechanisms deleting parts of its own config directory without being asked — first agents, then skills, now the whole tree including a folder built to hold secrets. One of the earlier two was closed "not planned." If an internal repair routine is clearing directories instead of merging into them, that is exactly the kind of bug that looks harmless in an agents/ folder and turns into a credential-rotation incident the day it reaches secrets/.

Top comments (0)