How Claude Code mistook payroll specifications for disposable agent files
Claude Code7 min readBusiness + PersonalClaude Code reportedly mistook 18 user-written payroll specifications for faulty agent output and permanently deleted about six hours of work.
The failure was not simply “the model forgot.” It lost reliable origin. Once files from several actors occupied the same workspace, the agent made a confident ownership judgment from names and locations. It had no trustworthy record proving which files belonged to the user.
How the incident unfolded
The public account dates the incident to April 5, 2026. The report centers on an Anthropic GitHub issue reporter, using Claude Code with background agents on Windows.
A long documentation restructuring task crossed multiple context windows. Background agents produced some output in incorrect locations or with incorrect names.
User-authored payroll requirements and user stories existed near that generated work. Claude Code labeled the human files as wrong agent output and issued rm without a meaningful confirmation.
The files were untracked, so Git could not restore them. The report lists 18 unrecoverable Markdown files representing about six hours of work. They were not committed, and Bash rm bypassed the Windows Recycle Bin.
What actually caused the damage
The agent had no reliable record showing which files were written by a person and which were temporary output from a helper agent. It guessed from names and locations, and the guess was wrong.
The payroll documents were especially vulnerable because they had not yet been saved to Git or another backup. Once the terminal removed them, the normal project history had no copy to restore.
Filesystem location is weak origin. A later agent cannot safely infer authorship from naming conventions or current context.
Subagents multiply ambiguity because each can create artifacts the parent later tries to clean up.
Permanent deletion converted an uncertain classification into irreversible loss. The safest response to uncertainty was to ask, not tidy.
A more accurate Claude Code with background agents on Windows model might make fewer mistakes. It still cannot replace limits on what the software is allowed to do.
How Leash could have changed the outcome
With a supported Claude Code with background agents on Windows integration, Leash checks the proposed action before it runs. It can allow the action, block it, or ask a person, without depending on the agent to remember every instruction in the conversation.
Rules Protection can require the agent to verify the destination and can block a bulk move or overwrite when the earlier setup step failed.
Leash sees the proposed rm through Claude Code's before-action integration. Destructive Protection asks before recursive or broad deletion, and Rules Protection can protect named specification, requirements, and user-story paths from any agent cleanup.
The approval separates the agent's claim—“bad output”—from the observable consequence: these exact 18 files will be permanently removed.
For a Personal user, that pause is often enough to recognize their own work. For Business, a chosen policy can make user-authored requirements immutable to unattended cleanup.
For an Anthropic GitHub issue reporter, that would mean ordinary work could continue while the exact dangerous step received its own decision. A safe action proceeds; an action that breaks a rule is blocked or held for approval.
Leash would not need to predict every choice made by Claude Code with background agents on Windows. It would only need to stop the dangerous action before it became real.
What this means for a new agent user or indie developer
When people and several agents write into the same project, keep valuable requirements in a clearly protected folder and save them before asking any agent to clean up. A filename is not proof that a document is disposable.
A sensible starting policy for this case is: Track artifact origin outside model context. Protect requirements, designs, payroll, legal, and customer-content paths from automated cleanup.
Leash Personal Open Source can protect a Claude Code with background agents on Windows workflow locally with your own model-provider key. Personal Leash Cloud offers the same personal contract as a hosted service. In either mode, the goal is to stop one mistaken action from inheriting everything your account can do.
What a CIO, CTO, or CISO should take from this
For engineering leaders, agent-created and human-created work need reliable ownership records. Requirements, payroll, legal, and customer-content folders should be protected from automated cleanup regardless of what the model thinks created them.
For organizations using Claude Code with background agents on Windows, Business Leash Cloud adds an independent action-time safety layer. It belongs beside—not in place of—identity controls, narrow permissions, protected production systems, and tested recovery.
For this incident, the operational priorities are clear: Route ambiguous files to quarantine and preserve original timestamps and hashes. Commit or back up human work before multi-agent restructuring.
What to change before the next agent session
For this workflow case, start with the consequences that would be hardest to reverse. Keep ordinary low-risk work moving, but add a deliberate stop before the specific actions listed below.
- Track artifact origin outside model context.
- Protect requirements, designs, payroll, legal, and customer-content paths from automated cleanup.
- Route ambiguous files to quarantine and preserve original timestamps and hashes.
- Commit or back up human work before multi-agent restructuring.
What is confirmed—and what is not
This account follows Anthropic GitHub issue #43887 and the additional sources linked below. Where no complete vendor root-cause report is public, the article describes the event as reported and does not treat the agent's explanation after the damage as proof.
Leash does not automatically know who authored every file. A path/content rule, source-control metadata, or a reversible deletion policy supplies that context. The reliable claim is that the destructive tool call can be held before execution.
The Leash claim for Claude Code with background agents on Windows has a clear boundary: the action must pass through a supported before-action integration. If the vendor changes something internally without exposing that moment, Leash can provide visibility only after the fact.
The bottom line
The lasting lesson is that an agent should never decide who owns a valuable file from its name or location alone. Human work needs a durable label and a protected deletion boundary.
The point is to keep Claude Code with background agents on Windows useful for routine work without gambling the wider laptop, repository, inbox, or production environment. That is the practical role Leash is designed to play in this story.