Auto mode permitted recursive deletion of entire home directory during a docker-compose task (working dir was a subdirectory)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

While running in Auto mode (the classifier-based permission mode), a Claude Code session that I asked to bring a project up locally with Docker ended up deleting the entire contents of my home directory (/home/hare) — including directories far outside the session's working directory.

The session's working directory was ~/Dropbox/dev/cosly. Everything under ~ was removed: synced work files (~/Dropbox), ~/.ssh, shell configs, and ~/.claude itself, which destroyed the session transcript that would have identified the exact command.

Timeline (KST, 2026-07-06):

• ~01:39 — I asked Claude Code to run the modified project locally with Docker; the test DB container started (kernel log shows the docker veth interface coming up at 01:39).
• Between ~01:54 and ~02:09 — the entire contents of /home/hare were deleted.
• 02:12 — I logged in on the physical console; the desktop session recreated default XDG folders, all timestamped 02:12.

Evidence collected afterwards:

• uptime: 2 days — no reboot occurred.
• dmesg: no OOM-killer events, no filesystem/disk I/O errors in the incident window.
• df -h / mount: filesystems healthy, nothing remounted read-only.
• ls -la /home: /home/hare itself keeps its original April 2026 creation date, but every file inside is timestamped after the incident — contents were deleted, not the account or partition.
• /home/docker (root-owned, same partition) was untouched, so the deletion ran with my user's privileges — consistent with the Claude Code session, which was the only process executing shell commands as my user at that time (verified via last: no other logins, no other agents running).

My Dropbox cloud copy survived only because the sync daemon was killed by the same event before it could propagate the deletions.

What Should Happen?

Per the Auto mode design (engineering blog: "How we built Claude Code auto mode"), the classifier is supposed to block actions that escalate beyond the user's request — mass deletion being a canonical example. A command whose effect was recursive deletion across the entire home directory, issued from a session whose working directory was a subdirectory several levels deep (~/Dropbox/dev/cosly), should have been flagged or blocked, or at minimum surfaced for manual approval.

Error Messages/Logs

No logs are available from my side: ~/.claude (including the session transcript) was deleted along with the rest of the home directory, and persistent journald was not enabled on this machine. The timestamps and command outputs (ls -la, last, dmesg, df) described above are the only local evidence that survived.

Steps to Reproduce

I do not have a deterministic reproduction — the exact command is unrecoverable because the session logs were destroyed by the incident itself. The scenario was:

1. On a Rocky Linux 10 server (accessed via SSH inside tmux), start Claude Code in ~/Dropbox/dev/cosly (a Node/Postgres web app).
2. Enable Auto mode (autoMode.classifyAllShell not configured; defaults).
3. Ask Claude Code to run the locally modified project with Docker for testing (docker compose / container startup for a Postgres test DB was involved).
4. Sometime within the following ~30 minutes, the entire home directory contents were deleted without any approval prompt reaching me.

Since this cannot be reproduced from my side, my main ask is whether the team can check server-side telemetry for this session window (2026-07-06, roughly 01:39–02:09 KST) to identify what the classifier evaluated and why it passed. I can provide account details privately.

Claude Model

Other

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

1.0.201

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

Other

Additional Information

• Claude Code version at the time of incident: 2.1.200 or 2.1.201 — I updated on July 3, 2026 (both versions were released that day); the exact one was not recorded and local logs were destroyed in the incident. The version in the "Claude Code Version" field above is my post-incident reinstall.
• The autoMode.classifyAllShell setting was not explicitly configured (defaults in effect). If the default routes only certain command patterns through the classifier, the deletion command may never have been evaluated at all — I cannot verify this from my side.
• Speculation on mechanism (explicitly speculative, no logs): (1) a cleanup/reset command with a variable-built path that resolved empty or to $HOME at execution time, so the command text looked scoped while its runtime effect was not; or (2) the deletion happened inside a generated helper script whose contents were not what the classifier evaluated.
• Hardware: Dell Latitude 7390 (i7-8650U, 16GB RAM). No resource exhaustion at the time (memory and disk healthy).
• Happy to share account details privately so the team can locate the session in server-side telemetry.