A developer asked Claude Code to scaffold a Next.js + Payload CMS starter on Windows. Cleaning up afterward, the agent ran one rm -rf on what it thought was the new project folder. It took the rest of the user's home directory with it.
What the source says
GitHub issue #36339, filed March 19, 2026 against Claude Code v2.1.51, running in Git Bash on Windows 11 with --dangerously-skip-permissions. The task: run pnpm dlx degit payloadcms/payload/templates/website aldaba-v2 to scaffold a template, then resolve a workspace:* dependency that doesn't work in a standalone install. The agent's fix was to delete the scaffold and start over: rm -rf /c/Users/guido/aldaba-v2.
pnpm had populated that template's node_modules with NTFS junction points rather than ordinary directories. Git Bash's rm -rf follows an NTFS junction into its real target instead of deleting the link itself — a gap already closed in PowerShell Core 6+ but never backported to the Git-for-Windows tooling Claude Code's Bash tool shells out to. One of those junctions pointed back up into the surrounding profile, and the recursive delete walked straight out of the project folder into C:\Users\guido itself.
The reporter's estimate: roughly 165.66GB across 1,593,350 files and 276,382 folders destroyed, including personal files, AppData, and active data for a business. No warning or confirmation appeared before or during the delete. The user found out only after noticing the Desktop was empty. At filing, a paid NTFS recovery attempt was in progress with nothing recovered yet.
The issue carries bug, data-loss, and has repro labels, and the reporter linked two earlier, similar junction-traversal deletion reports (#29249, #29023) as related — this is the third filed instance of the same failure shape. A GitHub Actions bot closed it as stale and "not planned" about six weeks later. No maintainer response, no fix shipped.
What it doesn't establish
The report doesn't say whether a confirmation prompt would normally have appeared before this rm -rf and was simply suppressed by --dangerously-skip-permissions — that flag disables Claude Code's own permission checks by design, so part of what went wrong here is the flag doing exactly what it's documented to do. It's one first-person report with no independent third-party reproduction on record, and the final recovered/unrecovered outcome isn't known — the ticket was closed while recovery was still "in progress."
Why it's still worth logging
The junction-traversal bug itself isn't new or exotic — it would bite a human running rm -rf by hand just as hard, and it's a Git-for-Windows/pnpm interaction, not something specific to an AI agent. What's specific to the agent is the context in which it fired: no pause, no "this will delete X files across Y directories, including some outside the folder you asked about," on a flag that was explicitly chosen to remove that pause. Two prior tickets citing the identical failure shape, each closed without a fix, is the part that should concern anyone running agents on Windows with permission checks off.
Full record, severity scoring, and frontmatter: https://www.stupidllm.com/incident/STUPID-2026-0136/
Top comments (0)