Agent chaosAs reported·6 Nov 2026
Measuring a change, Claude Code wrote an unquoted rm -rf helper and wiped the repo's .git history, a user says
As reported One person’s public account. We couldn’t independently confirm it, and we’ll update this if the facts change.
A Claude Code user on macOS says that while measuring a change, the agent wrote a bash helper with an unquoted rm -rf, called it from a zsh loop, and deleted the whole repository root including .git. The local history was the only copy. No prompt: the session was in bypass mode.
This is one person's account on GitHub, not independently confirmed. Two issues filed the same day by the same user describe the loss; a second issue says 12+ months of git history were gone.
What happened
On 4 November 2026 a user filed a detailed bug against Claude Code 2.1.318 on macOS. They say Claude, measuring a change in bypassPermissions mode, wrote a bash helper inside the project that rebuilt an output directory with an unquoted `rm -rf $D`, then called it from a loop in the Bash tool.
On macOS the Bash tool runs the login shell, zsh. zsh does not word-split `set -- $side`, so the helper received a combined argument. Inside the bash helper, the unquoted `rm -rf $D` did split — and deleted the repository root, including `.git`, every local branch and every commit.
The user says they never asked for any deletion. There was no confirmation prompt because the session was in bypass mode. Permission rules that only see the outer command never saw the `rm` sitting inside the agent-written script.
The damage
The local `.git` was, they say, the only copy of the commit history. Their SSD has TRIM, so undelete is impossible. A terse companion feedback issue the same day reports "12+ months of git history" lost to an incorrect harness `rm -rf`. Whether that is the same event is not stated.
The reporter gives a session id, a timestamp of 2026-11-04T16:27:39Z, model `claude-opus-5-5`, and says the model diagnosed the cause itself in the same session. They published a community hook meant to block this class of recursive delete, including from agent-written scripts.
What should have stopped it
The reporter asks for two fixes: the model should never run `rm -rf` on a constructed, unquoted path without a guard, and the harness should block or confirm — even in bypass mode — a recursive delete whose target is a git repository root, contains `.git`, is `$HOME`, or is an ancestor of the working directory, including deletes launched from scripts the agent just wrote.
They also filed a minimal safe reproduction under `/tmp` that deletes a fake repo the same way.
Our take
Bypass mode is a choice. An unquoted recursive delete that can resolve to the repo root is not. If the tool can't see inside scripts the agent writes, the last line of defence has to sit below the shell — a worktree, a container, or an off-machine backup of `.git` the agent cannot reach.
Never give an agent bypass rights on a machine whose only copy of history lives next to the working tree — and treat agent-written scripts as untrusted code, not as covered by your command allowlist.
