How a Claude Code cleanup reportedly deleted 92 artwork images

How the incident unfolded

The case was reported May 25, 2026. The report centers on an unidentified user described in a practitioner incident catalog, using Claude Code.

The user requested project cleanup. The permission system presented a broad Bash operation rather than the meaning of every target.

The user approved the cleanup category. Claude Code ran rm -rf across a project containing generated code, configuration, and artwork.

The creative assets were permanently deleted with the disposable files. The catalog says all 92 images were lost and describes them as irreplaceable. It does not publish a full transcript, affected-user identity, timestamps, or independent vendor confirmation.

What actually caused the damage

The agent continued from an assumption that was no longer true. Software tools follow the real state of the computer, not the state described in the agent's answer.

A failed folder creation, an unexpected destination, or uncertainty about who owns a file should stop the workflow. Continuing confidently after a failed step can turn an ordinary move or cleanup into permanent loss.

Generated does not mean disposable. The cost of reproducing an image may include prompts, selection, editing, licensing decisions, and client approval.

A single command can mix low-value cache data with high-value creative work.

Approval fatigue grows when the interface says “cleanup” instead of showing protected paths and irreversible consequences.

A more accurate Claude Code model might make fewer mistakes. It still cannot replace limits on what the software is allowed to do.

How Leash could have changed the outcome

With a supported Claude Code integration, Leash checks the proposed action before it runs. It can allow the action, block it, or ask a person, without depending on the agent to remember every instruction in the conversation.

Rules Protection can require the agent to verify the destination and can block a bulk move or overwrite when the earlier setup step failed.

Leash holds rm -rf at Claude Code's before-the-tool-runs event. A user can set broad filesystem action to Block and add an explicit rule protecting artwork and asset directories.

The action evidence makes the exact directory visible before execution. Denial lets the agent enumerate disposable build output separately.

For an indie creator, this is the difference between reviewing one high-signal request and discovering after the fact that “generated” meant “safe to erase.”

For an unidentified user described in a practitioner incident catalog, that would mean ordinary work could continue while the exact dangerous step received its own decision. A safe action proceeds; an action that breaks a rule is blocked or held for approval.

Leash would not need to predict every choice made by Claude Code. It would only need to stop the dangerous action before it became real.

What this means for a new agent user or indie developer

For a new agent user, the warning sign is a failed prerequisite followed by confident progress. Stop the run, inspect what actually exists, and use move or copy commands that refuse to overwrite by default.

A sensible starting policy for this case is: Classify creative assets as source material, not build output. Protect asset paths and require quarantine for cleanup.

Leash Personal Open Source can protect a Claude Code workflow locally with your own model-provider key. Personal Leash Cloud offers the same personal contract as a hosted service. In either mode, the goal is to stop one mistaken action from inheriting everything your account can do.

What a CIO, CTO, or CISO should take from this

For leaders adopting agents at scale, reliable automation must check the result of each important step. Standard workflows should fail closed when a folder, destination, owner, or environment does not match what the agent expected.

For organizations using Claude Code, Business Leash Cloud adds an independent action-time safety layer. It belongs beside—not in place of—identity controls, narrow permissions, protected production systems, and tested recovery.

For this incident, the operational priorities are clear: Make approvals list mixed target types and counts. Back up selected outputs and their generation metadata.

What to change before the next agent session

For this workflow case, start with the consequences that would be hardest to reverse. Keep ordinary low-risk work moving, but add a deliberate stop before the specific actions listed below.

• Classify creative assets as source material, not build output.
• Protect asset paths and require quarantine for cleanup.
• Make approvals list mixed target types and counts.
• Back up selected outputs and their generation metadata.

What is confirmed—and what is not

This account follows DEV Community: practitioner catalog and 92-image case and the additional sources linked below. Where no complete vendor root-cause report is public, the article describes the event as reported and does not treat the agent's explanation after the damage as proof.

Because the underlying catalog entry is not independently published, this article describes it as reported rather than verified. Leash's prevention claim applies to the documented rm -rf pattern, not to every possible file-edit or API route.

The Leash claim for Claude Code has a clear boundary: the action must pass through a supported before-action integration. If the vendor changes something internally without exposing that moment, Leash can provide visibility only after the fact.

The bottom line

The lasting lesson is that confidence is not confirmation. Agents should verify real-world state before performing a step that can overwrite or remove valuable work.

The point is to keep Claude Code useful for routine work without gambling the wider laptop, repository, inbox, or production environment. That is the practical role Leash is designed to play in this story.