{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0522",
  "aliases": [],
  "published": "2026-08-28T00:00:00Z",
  "modified": "2026-09-22T00:00:00Z",
  "summary": "Claude Code, asked to build a script that gives each agent its own temporary folder and cleans it up afterwards, tested the cleanup on the real machine and recursively deleted about 700 GB from the developer's home directory.",
  "details": "## What\n\nThe operator asked for a script that would sandbox each agent under its own temporary folder and clean up afterwards. The cleanup reused a variable that held the home directory path, and the agent tested the deletion on the real machine rather than in isolation, removing about 700 GB. Most of the data was recovered from git, package caches and session logs. The operator's post and Tom's Hardware both note that the harness had automatically downgraded the model during the session.\n\n## Detection\n\nThe lockfile records the Claude Code version and permission mode; a secondary report says the session ran in the default auto mode. Recorded from the operator's own post and as reported by Tom's Hardware. Not recreated in a lab.\n\n## Fix\n\nTest deletion logic against a disposable directory, and keep recursive deletion behind confirmation.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "claude-code"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://x.com/SebastienGllmt/status/2092634841863123047"
    },
    {
      "type": "ARTICLE",
      "url": "https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-nukes-a-developers-700-gb-home-directory-while-testing-a-script-to-ensure-it-wouldnt-do-so-automatic-model-downgrade-may-have-contributed-to-the-screw-up"
    },
    {
      "type": "ARTICLE",
      "url": "https://mlq.ai/news/claude-agent-deleted-about-700-gb-from-a-developers-home-directory-during-sandbox-test/"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "over-privileged-combination"
      ],
      "cwe": [
        "CWE-693"
      ],
      "noCveReason": "No code defect: the harm arises from the agent pursuing its goal in this configuration.",
      "cveBoundary": "behavioural",
      "threat": {
        "attacker": "user",
        "vector": "unsafe-default",
        "outcome": "file-write"
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://x.com/SebastienGllmt/status/2092634841863123047"
        }
      ],
      "fix": {
        "summary": "Test deletion logic on a disposable directory; confirm recursive deletion.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "The cleanup ran against the real home directory without confirmation."
          }
        ]
      },
      "exposure": {
        "harness": {
          "value": "Claude Code (version not stated)",
          "any": false,
          "status": "confirmed",
          "source": "https://x.com/SebastienGllmt/status/2092634841863123047"
        },
        "model": {
          "value": "Claude \"Fable\" at the start; the harness downgraded to Opus 5 and then Opus 4.8 before the deletion, per Tom's Hardware",
          "any": false,
          "status": "detected",
          "source": "https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-nukes-a-developers-700-gb-home-directory-while-testing-a-script-to-ensure-it-wouldnt-do-so-automatic-model-downgrade-may-have-contributed-to-the-screw-up"
        },
        "goal": {
          "value": "Write a script that gives each agent its own temporary folder and cleans it up afterwards",
          "stated": true,
          "status": "confirmed",
          "source": "https://x.com/SebastienGllmt/status/2092634841863123047"
        },
        "tools": {
          "value": "Shell access with delete permission on the developer's home directory",
          "status": "confirmed",
          "source": "https://x.com/SebastienGllmt/status/2092634841863123047"
        },
        "approval": {
          "value": "Default auto mode, per a secondary report; the deletion ran without confirmation",
          "mode": "auto-approve",
          "status": "detected",
          "source": "https://mlq.ai/news/claude-agent-deleted-about-700-gb-from-a-developers-home-directory-during-sandbox-test/"
        },
        "inputControl": "operator",
        "agentAction": "The agent runs its cleanup against the real home directory, deleting about 700 GB.",
        "harm": "data-loss",
        "divergence": "scope-exceeded"
      },
      "exploitation": {
        "status": "none-known",
        "checkedAt": "2026-09-22T00:00:00Z",
        "sources": [
          {
            "url": "https://x.com/SebastienGllmt/status/2092634841863123047",
            "type": "research",
            "note": "first-person account; no attacker"
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "claims": [
        {
          "kind": "installable",
          "statement": "Harness claude-code is available; no version bound applies",
          "value": "claude-code",
          "status": "confirmed",
          "source": "https://github.com/pickbitsai/acve",
          "result": "match",
          "observed": "acve lock can discover this harness",
          "method": "machine",
          "checkedAt": "2026-09-22T15:44:59Z"
        }
      ],
      "reproducibility": {
        "status": "partial",
        "axesComplete": true,
        "componentsObtainable": null,
        "triggerPublished": false,
        "observableStated": true,
        "demonstrated": "reported-only",
        "missing": [
          "model availability not checked (no registry reference)",
          "trigger not published"
        ]
      }
    }
  }
}