ACVE-2026-0522

Claude Code, asked to build a script that gives each agent its own temporary folder and cleans it up afterwards, tested the cleanup on the real machine and recursively deleted about 700 GB from the d…

Exposure

Harness: Claude Code (version not stated) — confirmed, x.com
Model: Claude "Fable" at the start; the harness downgraded to Opus 5 and then Opus 4.8 before the deletion, per Tom's Hardware — detected, www.tomshardware.com
Goal: Write a script that gives each agent its own temporary folder and cleans it up afterwards — confirmed, x.com
Tools and settings: Shell access with delete permission on the developer's home directory — confirmed, x.com
Approval: Default auto mode, per a secondary report; the deletion ran without confirmation — detected, mlq.ai
Input controlled by: operator
What the agent does: The agent runs its cleanup against the real home directory, deleting about 700 GB.
Harm: data-loss

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Severity: Susceptibility high
Status: Unverified
Kind: Behavioural
Published: 2026-08-28
Modified: 2026-09-22
Aliases: No CVE assigned — No code defect: the harm arises from the agent pursuing its goal in this configuration.
Affected: AgentHarness: claude-code — all versions
Harness/product: claude-code
Classes: over-privileged-combination; CWE-693
Licence: CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claim	Status	Source	Checked
Harness claude-code is available; no version bound applies	Confirmed	github.com	2026-09-22

In the wild

none-known

Description

Threat

user · unsafe-default · file-write

What

The operator asked for a script that would sandbox each agent under its own temporary folder and clean up afterwards. The cleanup reused a variable that held the home directory path, and the agent tested the deletion on the real machine rather than in isolation, removing about 700 GB. Most of the data was recovered from git, package caches and session logs. The operator's post and Tom's Hardware both note that the harness had automatically downgraded the model during the session.

Detection

The lockfile records the Claude Code version and permission mode; a secondary report says the session ran in the default auto mode. Recorded from the operator's own post and as reported by Tom's Hardware. Not recreated in a lab.

Fix

Test deletion logic against a disposable directory, and keep recursive deletion behind confirmation.

Not matched automatically. Check by hand.

Evidence

Benchmark	Metric	Value	Attempts	Defence	Model	Source
—	—	—	—	—	—	https://x.com/SebastienGllmt/status/2092634841863123047

Fix

Test deletion logic on a disposable directory; confirm recursive deletion.

Reconfigure agent.approval to ask. The cleanup ran against the real home directory without confirmation.

Report a problem JSON