How Claude Code deleted a 50GB image archive it had just created
Claude Code7 min readBusiness + PersonalClaude Code moved 1,500 images into an archive, then deleted the archive by removing its parent folder. About 50GB of image data was lost.
The mistake was easy to draw: the new archive was placed inside the folder scheduled for deletion. Removing the parent therefore removed the archive too. The GitHub reporter said the same prompt reproduced the behavior while automatic edit acceptance was enabled.
How the incident unfolded
The public account dates the incident to April 16, 2026. The report centers on an Anthropic GitHub issue reporter, using Claude Code 2.1.110 on Windows.
The task was to reorganize project directories and archive images. Claude Code created or used sd_auto_generate/log inside the parent directory.
It moved the valuable images into that nested destination. It then executed rm -rf on sd_auto_generate without a warning or fresh confirmation.
The nested log directory disappeared with the parent. The reporter estimated roughly 1,500 PNG files and 50GB of irreplaceable generated image data were permanently removed. The professional recovery estimate was several hundred thousand Japanese yen; manual reconstruction was expected to take more than a month.
What actually caused the damage
The agent did not need a special way into the computer. It used the same terminal access the person had already granted. Once a command was allowed to run with that access, folders outside the visible project were reachable too.
Opening one project in an agent does not automatically fence the agent inside that folder. A real boundary has to be enforced before a command runs, especially when the command can remove many files at once.
The model preserved the intended idea of “archive” but failed the basic folder rule that an archive cannot survive deletion of its ancestor.
Auto-accepting edits is not the same as authorizing permanent shell deletion. The consequence changed from organization to destruction.
A pre-delete target manifest would have revealed that the destination and all archived files were inside the selected tree.
A more accurate Claude Code 2.1.110 on Windows model might make fewer mistakes. It still cannot replace limits on what the software is allowed to do.
How Leash could have changed the outcome
With a supported Claude Code 2.1.110 on Windows integration, Leash checks the proposed action before it runs. It can allow the action, block it, or ask a person, without depending on the agent to remember every instruction in the conversation.
Destructive Protection can recognize a broad or recursive deletion, while Rules Protection can protect personal folders and anything outside the active project.
Claude Code can send rm -rf to Leash before Bash. Destructive Protection classifies recursive deletion as critical and asks by default, even when the agent already completed earlier file moves.
The user sees the parent target and can reject it. A project rule can also forbid permanent deletion of image or artifact directories and require quarantine instead.
That one interruption would have preserved the 1,500 files. The agent could then move the archive outside the parent, run a dry listing, or stop.
For an Anthropic GitHub issue reporter, that would mean ordinary work could continue while the exact dangerous step received its own decision. A safe action proceeds; an action that breaks a rule is blocked or held for approval.
Leash would not need to predict every choice made by Claude Code 2.1.110 on Windows. It would only need to stop the dangerous action before it became real.
What this means for a new agent user or indie developer
For a newcomer or indie developer, the practical lesson is simple: an open project is not a sandbox. If an agent can use your terminal, assume it can reach every file your account can reach until a real rule proves otherwise.
A sensible starting policy for this case is: Never place a retained destination under an ancestor scheduled for deletion. Show recursive-delete targets and descendants before execution.
Leash Personal Open Source can protect a Claude Code 2.1.110 on Windows workflow locally with your own model-provider key. Personal Leash Cloud offers the same personal contract as a hosted service. In either mode, the goal is to stop one mistaken action from inheriting everything your account can do.
What a CIO, CTO, or CISO should take from this
For a CIO, CTO, or CISO, agent terminal access should be treated like automation running under an employee's identity. Project boundaries, protected user folders, recoverable deletion, and evidence of every high-impact decision matter more than which model produced the command.
For organizations using Claude Code 2.1.110 on Windows, Business Leash Cloud adds an independent action-time safety layer. It belongs beside—not in place of—identity controls, narrow permissions, protected production systems, and tested recovery.
For this incident, the operational priorities are clear: Use quarantine or Trash for user-created assets. Keep unversioned media backed up outside the project tree.
What to change before the next agent session
For this file-loss case, start with the consequences that would be hardest to reverse. Keep ordinary low-risk work moving, but add a deliberate stop before the specific actions listed below.
- Never place a retained destination under an ancestor scheduled for deletion.
- Show recursive-delete targets and descendants before execution.
- Use quarantine or Trash for user-created assets.
- Keep unversioned media backed up outside the project tree.
What is confirmed—and what is not
This account follows Anthropic GitHub issue #49129 and the additional sources linked below. Where no complete vendor root-cause report is public, the article describes the event as reported and does not treat the agent's explanation after the damage as proof.
Leash does not prove that an archive is logically correct; it supplies the independent pause at the dangerous action. A careless approval can still allow the loss, so critical recursive deletion is best set to Block for irreplaceable asset roots.
The Leash claim for Claude Code 2.1.110 on Windows has a clear boundary: the action must pass through a supported before-action integration. If the vendor changes something internally without exposing that moment, Leash can provide visibility only after the fact.
The bottom line
The lasting lesson is not that agents should never clean files. It is that a cleanup request should never silently become permission to erase unrelated parts of a computer.
The point is to keep Claude Code 2.1.110 on Windows useful for routine work without gambling the wider laptop, repository, inbox, or production environment. That is the practical role Leash is designed to play in this story.