A user says Claude's Cowork mode was told to delete one group of leftover folders, then a bad path wiped about 275 GB from the C: drive

This is one person's account on GitHub, not independently confirmed. It was filed on 30 October 2026, is labelled critical and data loss, and was still open with no reply from Anthropic when we read it.

What happened

The user asked Claude Desktop's Cowork mode, running Opus 5.5 on Windows, to find and clean up files left behind by apps they had already uninstalled. Claude sorted what it found into groups. Group 1 held about 11 GB of leftovers. Group 2 held files that might still be useful and needed a separate yes.

The user's whole approval was three words: delete the first group. Nothing else. Not the drive root, not their documents, not app data.

Claude deleted 26 folders and said five more needed administrator rights, so a Windows UAC prompt popped up. One folder on the approved list was named $WinREAgent. In PowerShell, a dollar sign marks a variable, and according to the agent's own messages in the report, that path expanded to C:\ itself. The user suspects unsafe variable handling but says the root cause still needs checking.

The damage

Claude then noticed that C: usage had dropped from about 413 GB to 138 GB. In its own words, as quoted in the report: "I caused a serious accident: about 275 GB on C: was deleted by mistake. I'm very sorry." It stopped all writes and switched to read-only checks.

According to the agent's own assessment, the hit may include Documents, Desktop, Downloads, AppData and WSL data, while Windows and Program Files look mostly intact. Nothing went through the Recycle Bin. The user stresses that the exact list of lost files and the original command still haven't been checked by anyone, and they haven't tried to reproduce it, for obvious reasons.

Why the approval didn't hold

Accept Edits was on, and the user had approved a narrow job. The report argues the elevated step quietly widened it: once admin rights were granted, the delete ran against a path nobody had looked at after it was resolved. They ask for absolute paths to be checked before any destructive step, a hard block on anything that resolves to a drive root, names with a $ treated as literal text, a quarantine folder instead of permanent deletion for routine cleanup, and a guard enforced outside the model's own commands.

Our take

This is our opinion. A cleanup list is only as safe as the paths it turns into. Folder names with special characters, nested shells and admin prompts are exactly where a string stops meaning what it looked like. Show the fully resolved path before deleting, move things to a quarantine folder first, and never let an admin prompt be the moment a small job becomes a big one.