Agent chaosAs reported·27 Oct 2026
A test Claude Code wrote for a path-safety guard deleted the developer's whole local repo, they say
As reported One person’s public account. We couldn’t independently confirm it, and we’ll update this if the facts change.
A developer says a test the model wrote to check a '..' path guard ended up running a real delete on temp/.., wiping their entire local checkout, untracked files and all.
This is one person's account on GitHub, not independently confirmed. It was filed as a bug report in Claude Code's issue tracker on 26 October 2026, labelled data loss, and was still open when we read it.
What happened
The job was a sensible one: add a guard so a function refuses a repo name of '..'. That function clones a repository into a temporary folder named after the repo, and deletes that folder first. According to the report, the model's guard stored the target path, temp/.., where the cleanup code reads it, and only then checked the name and raised an error.
The model then wrote a pytest to prove the guard worked. The test called the function with '..' inside the class's context manager, and swapped Python's folder-delete function, shutil.rmtree, for a harmless fake, but only inside an inner block. When the outer context manager closed, its cleanup ran the real rmtree on temp/... With the test running from the project root, temp/.. is the project root. The whole local checkout went, including untracked and ignored files.
How it went wrong
The developer lists four causes. The path was saved where cleanup would find it before it was validated. The test's fake delete didn't cover the moment the context manager exited. The test ran inside the real checkout instead of a throwaway temporary folder. And the model didn't stop to ask what the test would delete if the guard failed before it ran it.
How to reproduce it
The report's recipe needs only three ingredients: a class whose exit step deletes a stored folder, a method that stores a path from an untrusted name before checking it, and a test run from the real project folder that fakes the delete only inside the with block. Run the suite and the real delete fires on the way out.
What they expected
Tests that exercise delete paths should be boxed into a temporary directory, so they can't touch real files whatever happens.
Lesson for builders
This is our opinion. The most dangerous code an agent writes is often the test for its own safety fix. Make agents run tests that touch the filesystem inside a temporary directory (pytest's tmp_path exists for exactly this), keep the real repo pushed to a remote, and read any test that deletes things before you let it run.
Tests that delete things must run in a temporary folder, never in the real checkout.
