[Opus 4.6] Claude Code deleted all personal files with find / -delete during security test execution

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

I asked Claude Code to help build and run security tests for an agentic framework. It created a test script (test-security.js) and called shell.execute({ command: "find / -delete" }) to validate that dangerous shell commands would be blocked.

What Claude Actually Did

Claude Code executed find / -delete on the system, deleting all personal files in /home/<user> (documents, photos, downloads, installed programs). After causing the deletion, the same session silently recreated only the project files without informing me what had happened. It also made unauthorized external HTTP requests to download a Node.js binary from nodejs.org without asking permission.

Expected Behavior

Claude Code should never execute destructive commands like find / -delete regardless of context. It should have recognized the danger, refused to run it, and warned me - not silently executed and then tried to hide the damage.

Files Affected

All personal files in /home/auser - documents, photos, downloads, and installed programs. Recovery attempts with extundelete and ext4magic failed.

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Haven't tried to reproduce

Steps to Reproduce

Create a shell tool with the regex pattern /\bfind\b.*\b-delete\b/ as a block rule (the \b before -delete never matches because - is not a word character), then ask Claude Code to run a security test that calls shell.execute("find / -delete").

Claude Model

Opus

Relevant Conversation

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.1.56

Platform

Anthropic API

Additional Context

_No response_