Claude Code’s safety controls failed in a destructive way after a developer asked the model to help prevent accidental file deletion. Instead, the process ended with the developer’s entire project home directory being deleted, wiping roughly 700GB of data.
According to MarsBit, citing the WeChat account Machine Heart, the developer, Guillemot, is a heavy user of AI coding agents. One recurring issue in his workflow was that those agents often left large amounts of temporary files behind in the /tmp directory after finishing their tasks.
To address that, he asked Claude Fable 5 to write a script that would create a separate sandbox folder under /tmp for each agent and clean it up automatically after the task was done. One requirement mattered most: the script could not delete files still being used by other processes.
How a cleanup task turned into a safety review
Fable 5 produced a solution with logic to detect active agents and delay deletion when needed. Guillemot reviewed the output and decided the code was too complex, so he asked for a simpler version.
The turning point came during the safety review. Because the script involved hard deletion, Fable initiated an adversarial review, meaning it launched a new model instance to check whether its own code was safe. That step triggered Anthropic’s built-in safety mechanism in Claude Code.
Under that system, when a task is judged to involve sensitive operations, the model is automatically moved from a higher-capability version to a more conservative one. The report said examples include cybersecurity, biotechnology, and, in this case, file deletion. The stated purpose of the mechanism is to reduce the chance of overly aggressive behavior in high-risk scenarios.
Downgraded from Fable 5 to Opus 4.8
In this incident, the system first downgraded the model from Fable 5 to Opus 5, then downgraded it again to Opus 4.8. Opus 4.8 was the version that carried out the safety test.
The test logic compared the deletion target path against /tmp and the user’s home directory to make sure the script would not hit either of those protected locations. The test itself passed. Both /tmp and the home directory were correctly identified as dangerous targets that must not be deleted.
The breakdown came afterward, during cleanup of temporary files created in the test. Opus 4.8 reused the same variable name from the testing phase. That variable had been assigned the path to the user’s home directory. In the cleanup step, the model executed a delete operation directly on that variable.
In other words, the system had just confirmed that the home directory should never be removed, then immediately deleted it.
700GB erased while /tmp remained untouched
The developer noticed the problem and stopped the process right away, but the damage had already been done. The report said about 700GB of data was erased, taking a week of work with it.
The /tmp directory that the script had originally been meant to clean up was left intact.
Developers had already raised complaints about the downgrade system
Machine Heart said the safety downgrade mechanism in Claude Code had already drawn broad criticism in the developer community. The main complaints listed in the report were that the downgrade is triggered too easily and can be activated by normal coding tasks, that model capability drops sharply while task complexity does not, and that once a downgrade is triggered it tends to persist for the rest of the session even if later operations are harmless.
- Some developers say ordinary coding work can trigger the downgrade by mistake.
- After the downgrade, the model becomes weaker while the task stays just as complicated.
- The downgrade is sticky and may continue through the full session.
The report added that some developers have written hook scripts that automatically pause a session once a downgrade is detected, in order to stop a lower-capability model from continuing with higher-risk actions.
As presented in the article, the core contradiction is straightforward: the system judged the task too dangerous and handed it to a weaker model, but that weaker model was more prone to making mistakes in areas that required precision, such as variable scope and file paths.
The original article was published by the WeChat account Machine Heart (ID: almosthuman2014) and written by Leng Mao.