Claude Fable 5 Deleted 700GB of Developer's Data While Testing Its Own Safety Script

Developer Sebastien Guillemot reported on X that Claude's coding agent wiped out practically his entire development machine. The model was supposed to build a secure sandboxing mechanism for other agents, but instead ran rm -rf on the user's home directory, deleting roughly 700 gigabytes of data and a week's worth of work.

Guillemot had asked Claude Fable 5 to build a sandboxing mechanism that would isolate every agent it launched inside its own subdirectory within /tmp, then automatically clean up after it once the work was done. The goal was to stop agents from filling up the disk with temporary files generated during their runs.

A cascade of model downgrades

While the script was being written, Anthropic's safety system flagged the task as potentially risky twice. Each time, the safety harness automatically downgraded the model in use, first from Claude Fable 5 to Opus 5, then from Opus 5 to Opus 4.8, even though the user had no way to block the switch or clear information about why it happened.

The alert was triggered because a symbolic link inside /tmp could, in practice, point to data outside the sandbox, meaning deleting it could wipe files beyond the test area. Opus 4.8, taking over the task after the downgrade, decided to write an additional, supposedly safe deletion script meant to operate strictly within /tmp.

A variable collision

To prove the new script really was confined to the sandbox, the model decided to test it against its own home directory. But in the test step and the cleanup step that followed, the script used the same variable name to hold the target path, which overwrote the safe value and caused the deletion command to run against the HOME directory instead of /tmp.

Guillemot realized what was happening and tried to kill the running process, but couldn't stop it in time. The script had already worked through most of the home directory's contents before the command was halted.

Bad news: Fable destroyed my entire dev machine. Claude decided to test the sandbox it was building by running rm -rf on my home directory. The sandbox didn't work. Everything is gone - Sebastien Guillemot, developer, post on X

Irony and data recovery

Paradoxically, the one place on the disk the script failed to wipe out was /tmp itself, an area full of junk and AI session logs that was supposed to be the operation's only permitted target. The rest of the home directory, including a week's worth of project files, was gone.

Because this was a development machine, much of the lost data existed in several other places at once, in git repositories, the nix package store, worktrees, and the agent's own session logs. That let Guillemot reconstruct most of his work, though the recovery process took time and wasn't loss-free.

Another entry in the coding agent mishap list

Guillemot's case joins a growing list of incidents in which coding agents built on large language models have executed destructive deletion commands on host systems. Earlier high-profile cases included a Claude-based tool wiping a company's database and an entire home directory on a Mac being deleted after a shell parameter expanded incorrectly during a simple repository cleanup command.

The common thread across these incidents is an architecture where the agent runs directly on the host with full user privileges, with no intermediate layer able to block a command from deleting critical directories. That's fueling growing calls to run coding agents in isolated environments, such as containers or micro-VMs, where the agent's home directory maps only to a workspace rather than the user's actual file system.

For companies using coding agents in day-to-day work, the incident is a reminder that a vendor's safety mechanisms, such as automatically downgrading a model once it flags a risky task, don't by themselves guarantee data safety. If an agent has write access to a real file system, even a well-designed safeguard script can fail because of an ordinary programming mistake, like reusing the same variable name.

The practical advice repeated after every such incident stays the same: don't run coding agents with full privileges on a machine holding data that can't be reproduced, and keep current backups independent of the system the agent operates on.