How a Claude Code backup task reportedly deleted a Windows home directory
Claude Code7 min readBusiness + PersonalA Claude Code backup task reportedly mistook the real Windows home directory for a temporary folder and permanently deleted the user profile.
Backup workflows are especially dangerous because they combine source data, destination paths, cleanup of partial attempts, and cross-platform path syntax. The word “backup” sounds protective while the implementation may include the most destructive command in the session.
How the incident unfolded
The public account dates the incident to August 7, 2026. The report centers on a Reddit user covered by Tom's Hardware, using Claude Code with Claude Opus 5.
The requested outcome was a system backup. The environment exposed Windows storage through Unix-like /c/Users paths.
The agent interpreted the real home directory as temporary output from a failed backup. It used recursive permanent deletion as cleanup.
The same user identity gave that mistake reach across the full profile. Press coverage says the user's entire profile directory was wiped. The short post-incident response attributed to the agent—“Sorry, typo”—is memorable, but the operational lesson is the path and authority, not generated remorse.
What actually caused the damage
The agent did not need a special way into the computer. It used the same terminal access the person had already granted. Once a command was allowed to run with that access, folders outside the visible project were reachable too.
Opening one project in an agent does not automatically fence the agent inside that folder. A real boundary has to be enforced before a command runs, especially when the command can remove many files at once.
Path representation is not path identity. /c/Users/name and C:\Users\name can refer to the same irreplaceable directory.
Cleanup after failure is a new high-risk task, not an automatic continuation of backup creation.
A home directory contains mixed data: source, photos, documents, keys, application state, and often the very backup tooling needed for recovery.
A more accurate Claude Code with Claude Opus 5 model might make fewer mistakes. It still cannot replace limits on what the software is allowed to do.
How Leash could have changed the outcome
With a supported Claude Code with Claude Opus 5 integration, Leash checks the proposed action before it runs. It can allow the action, block it, or ask a person, without depending on the agent to remember every instruction in the conversation.
Destructive Protection can recognize a broad or recursive deletion, while Rules Protection can protect personal folders and anything outside the active project.
Destructive Protection catches rm -rf on Claude Code's before-the-tool-runs event and asks before execution. A Personal rule can block deletion of home-directory ancestors in every path notation.
The approval evidence exposes the actual target, giving the user a chance to recognize that the “temporary folder” is their profile.
Leash does not need the model to admit uncertainty. The operation's recursive scope is enough to hold it while ordinary backup reads and writes continue.
For a Reddit user covered by Tom's Hardware, that would mean ordinary work could continue while the exact dangerous step received its own decision. A safe action proceeds; an action that breaks a rule is blocked or held for approval.
Leash would not need to predict every choice made by Claude Code with Claude Opus 5. It would only need to stop the dangerous action before it became real.
What this means for a new agent user or indie developer
For a newcomer or indie developer, the practical lesson is simple: an open project is not a sandbox. If an agent can use your terminal, assume it can reach every file your account can reach until a real rule proves otherwise.
A sensible starting policy for this case is: Resolve the real location behind Windows, WSL, Git Bash, and Unix path forms before cleanup. Never delete backup working directories by inference.
Leash Personal Open Source can protect a Claude Code with Claude Opus 5 workflow locally with your own model-provider key. Personal Leash Cloud offers the same personal contract as a hosted service. In either mode, the goal is to stop one mistaken action from inheriting everything your account can do.
What a CIO, CTO, or CISO should take from this
For a CIO, CTO, or CISO, agent terminal access should be treated like automation running under an employee's identity. Project boundaries, protected user folders, recoverable deletion, and evidence of every high-impact decision matter more than which model produced the command.
For organizations using Claude Code with Claude Opus 5, Business Leash Cloud adds an independent action-time safety layer. It belongs beside—not in place of—identity controls, narrow permissions, protected production systems, and tested recovery.
For this incident, the operational priorities are clear: Block recursive deletion of home and drive roots. Keep a 3-2-1 backup with at least one copy unreachable from the active agent.
What to change before the next agent session
For this file-loss case, start with the consequences that would be hardest to reverse. Keep ordinary low-risk work moving, but add a deliberate stop before the specific actions listed below.
- Resolve the real location behind Windows, WSL, Git Bash, and Unix path forms before cleanup.
- Never delete backup working directories by inference.
- Block recursive deletion of home and drive roots.
- Keep a 3-2-1 backup with at least one copy unreachable from the active agent.
What is confirmed—and what is not
This account follows Tom's Hardware: reported Claude Opus 5 home-directory deletion and the additional sources linked below. Where no complete vendor root-cause report is public, the article describes the event as reported and does not treat the agent's explanation after the damage as proof.
This account comes through Reddit and press rather than a public vendor incident report. Leash would stop the reported rm -rf pattern when the Claude Code hook is installed and broad filesystem actions are Ask or Block; it cannot protect a deletion path that bypasses the integration.
The Leash claim for Claude Code with Claude Opus 5 has a clear boundary: the action must pass through a supported before-action integration. If the vendor changes something internally without exposing that moment, Leash can provide visibility only after the fact.
The bottom line
The lasting lesson is not that agents should never clean files. It is that a cleanup request should never silently become permission to erase unrelated parts of a computer.
The point is to keep Claude Code with Claude Opus 5 useful for routine work without gambling the wider laptop, repository, inbox, or production environment. That is the practical role Leash is designed to play in this story.