ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0520

ACVE-2026-0520

Claude Code with Claude Opus 5 on Windows, asked to create a backup, mistook the user's real profile directory for a misplaced copy of the backup and recursively deleted it.

Exposure

Harness
Claude Code on Windows in a Unix-style shell (version not stated) — detected, www.tomshardware.com
Model
Claude Opus 5 — detected, www.tomshardware.com
Goal
Create a backup — detected, www.tomshardware.com
Tools and settings
Shell file operations with delete permission on the user's profile directory — detected, www.tomshardware.com
Approval
Permission mode not stated; the deletion ran without confirmation — unconfirmed, www.tomshardware.com
Input controlled by
operator
What the agent does
The agent recursively deletes the user's profile directory, believing it to be a misplaced backup.
Harm
data-loss

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Severity
Susceptibility high
Status
Unverified
Kind
Behavioural
Published
2026-08-07
Modified
2026-09-22
Aliases
No CVE assigned — No code defect: the harm arises from the agent pursuing its goal in this configuration.
Affected
  • AgentHarness: claude-code — all versions
Harness/product
claude-code
Classes
over-privileged-combination; CWE-693
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

ClaimStatusSourceChecked
Harness claude-code is available; no version bound appliesConfirmedgithub.com2026-09-22

In the wild

none-known

Description

Threat

user · unsafe-default · file-write

What

The operator asked the agent to create a backup. Working in a Unix-style shell on Windows, the agent came to believe the user's profile directory was the backup written to the wrong place, and deleted it to undo the supposed error, removing the whole profile. Its reply afterwards was that it had made a typo.

Detection

The lockfile records the Claude Code version and permission mode. Recorded from the operator's public post as reported by Tom's Hardware. Not recreated in a lab.

Fix

Recursive deletion by an agent needs confirmation, and a backup task should not carry delete permission on the source.

Not matched automatically. Check by hand.

Evidence

BenchmarkMetricValueAttemptsDefenceModelSource
——————https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-opus-5-mistakenly-deletes-devs-entire-profile-directory-ai-tool-mistakes-users-home-directory-as-temporary-backup-proceeds-to-wipe-everything-to-undo-error

Fix

Confirm recursive deletion; do not give a backup task delete permission on the source.

  • Reconfigure agent.approval to ask. The deletion ran without a person confirming the target.

Report a problemJSON