[Bug] Claude generates unsafe destructive commands with rm -rf on root directory

Bug Description
Yesterday, I asked the Claude CLI to delete all the cache files for the app we’re currently building.
As usual, Claude suggested a long command (a big find one-liner with lots of options).

Without carefully checking it, I just selected “1. Execute” and ran it.Immediately afterward, I noticed in Finder that entire directories had vanished. I rushed back to the Claude session, saw the command was still running in the background, typed ps -ef | grep ... to inspect it, and there it was buried in the middle of the command Claude had generated: rm -rf /*.

It was already too late.
It had started deleting everything on my Mac. I force-shut down the laptop as fast as I could.Massive damage.
Several days, possibly weeks of work gone. I’m still recovering everything now.Claude absolutely must be trained to never, ever suggest or generate commands that contain rm -rf / anything remotely like it, no matter the context.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.0.60
• Feedback ID: 882af706-3d75-4953-99d0-2f1dfddf3905

⏺ FOUND IT!

This is the dangerous command that was executed. Looking at the log from session 416b29b9-14b3-42ec-be33-32f487b2b689.jsonl:

find /Users/chris/Library/Developer/CoreSimulator/Devices -type d -name TreeCache 2>/dev/null < /dev/null | while read dir ; do echo 'Cleaning: ' ; rm -rf /* ; done

The critical bug: The $dir variable was NOT used! The code says:

• echo 'Cleaning: ' - missing $dir
• rm -rf / - THIS IS THE DISASTER - it should have been rm -rf "$dir"/

Instead of deleting the contents of each TreeCache directory, it ran rm -rf /* which attempts to delete the entire filesystem root!

Root Cause Analysis:
The command was supposed to be:
while read dir ; do echo "Cleaning: $dir" ; rm -rf "$dir"/* ; done

But instead it was written as:
while read dir ; do echo 'Cleaning: ' ; rm -rf /* ; done

The $dir variable was omitted from both the echo AND the rm command, and the single quotes prevented any variable substitution. This caused rm -rf /* to run for EVERY TreeCache directory found.

I am deeply sorry this happened. This is a catastrophic error that should never have been generated.

Safety measures that should have prevented this:

1. NEVER use rm -rf with /* pattern
2. ALWAYS quote variables properly: "$dir"/*
3. ALWAYS dry-run destructive commands first
4. NEVER generate commands that could affect system directories

I will ensure this type of command is never generated again. Commands involving rm -rf should always:

1. Use absolute paths with explicit safe prefixes (like /Users/chris/)
2. Never use bare wildcards like / or ./
3. Be validated before execution to ensure they only target intended directories