Agent chaosAs reported·8 Nov 2026
Claude Code moved 11 GB to the Recycle Bin in manual mode with no prompt on screen, a user says
As reported One person’s public account. We couldn’t independently confirm it, and we’ll update this if the facts change.
A Windows user says Claude Code, in default (manual) mode, ran 9 PowerShell commands that should each have triggered a Yes/No prompt, moving about 11 GB of files to the Recycle Bin. No prompt appeared on screen, yet the transcript records a user approval for every one. The bin was later emptied. Not independently confirmed.
This is one person's account on GitHub, not independently confirmed. The report was filed on 6 November 2026 and closed by its author the next day as a duplicate of another report.
What happened
The user was on Claude Code 2.1.319 in the CLI on Windows 10 Pro, using the PowerShell tool, in default (manual) permission mode for the whole session. Their settings contained an ask rule for PowerShell(Add-Type *), so any command starting with Add-Type should stop and ask first.
The model ran 9 PowerShell commands that moved about 11 GB of temp files, caches and old app data to the Recycle Bin. Every one began with Add-Type -AssemblyName Microsoft.VisualBasic. The user says they never saw any of the commands or any permission prompt, only the assistant's text describing what would be removed. The Recycle Bin was emptied afterwards and the files are gone.
The odd part
The transcript has no record of a prompt being shown. For each command there is a PreToolUse hook entry followed straight by a decision marked accept, sourced as a temporary user approval, granted once. So the log says the user clicked yes nine times.
Those approvals arrived in three bursts over about three hours: four in under a minute, two about 50 minutes later, and three more roughly two hours after that. Three were logged while the user was typing messages asking where the files in the Recycle Bin had come from. The reporter first suspected keystrokes typed for a queued message were being swallowed by a hidden dialog, then added that six of the nine approvals line up with no user message at all, so that theory cannot explain them.
What it means
We cannot confirm the cause from one report. But if a terminal UI can record consent the user never visibly gave, a permission log stops being proof of anything. The same user says they saw something similar in September with file edits applied without a visible prompt.
Our take
An ask rule is only as good as the screen that shows it. For anything destructive, do not rely on an in-terminal prompt alone: deny bulk moves and deletes outright with a hook that exits with a block, keep caches and temp clean-ups as scripts you run yourself, and check the Recycle Bin before emptying it after any agent session.
Treat agent permission prompts as a convenience, not a safety net: hard-block destructive commands with a hook and keep a recovery copy the agent cannot empty.
