Claude Code ran rm -rf against $HOME due to env var not persisting between Bash tool calls, deleting Downloads/Documents/Pictures/.config

Incident report: Claude Code deleted user's home directory contents

Summary

During a long Claude Code session (multi-hour, spanning flatpak release engineering work
across several personal projects), the agent ran a command containing rm -rf "$HOME"
intended to clean up a temporary directory it had created for a sandboxed test. Because
shell environment variables do not persist between separate Bash tool invocations, $HOME
in the cleanup command resolved to the user's real home directory, not the temporary
one set in a prior, separate tool call. The command ran against a live rclone mount
(pCloud, FUSE-mounted at ~/pcloud-drive) and against local disk, and was killed by a
2-minute tool timeout before completing — consistent with partial, real deletion having
occurred (rather than the command being blocked/no-op'd, which the agent incorrectly
assumed at first).

Result: the user's Documents, Downloads, Pictures folders and an unspecified
number of installed programs/program data under the home directory are currently missing.
~/.config/rclone/rclone.conf was also deleted, breaking the pCloud mount's ability to
reconnect. The user manually unmounted the pCloud FUSE mount immediately upon discovering
the issue, which likely prevented further propagation to the remote. As of this report,
the user has visually checked pCloud's web interface and sees substantial content there,
but has not been able to confirm with certainty that it represents 100% of what's missing
locally. Quantitative verification (size/count comparison against a known-good baseline of
527G used, recorded via df earlier in the same session before the incident) is in
progress, pending the user re-adding pCloud credentials to a fresh rclone config (the
agent cannot do this step, as it requires an interactive OAuth login).

Root cause

1. The agent ran, in a single Bash tool call, a chain of commands including a cleanup step

for a throwaway temp directory:
``
export HOME=$(mktemp -d)
...
`
in one tool invocation, and later, in a **separate** tool invocation:
`
rm -rf "$HOME" 2>/dev/null; rm -f /tmp/kopilka_smoke.log
cd /home/calstfrancis/Projects/Gost && git push origin main
...
`
Since shell state (including exported env vars) does not persist between Bash tool
calls in this harness, $HOME in the second call had reverted to the real value
(/home/calstfrancis`), not the temp directory created in the first call.

1. The agent did not use an explicit, hardcoded path variable for the temp directory

cleanup — it relied on $HOME remaining set to the throwaway value across tool calls,
which is not a safe assumption in this tool architecture.

1. When first asked to check whether the command had caused damage, the agent ran a

shallow ls -la ~ and, seeing many familiar top-level directories still present,
incorrectly concluded the command "likely didn't execute" — without noticing that two
of the most fundamental, near-universal folders (Documents, Downloads) were absent
from that same listing. This was a real analysis failure on the agent's part, not just
bad luck — the evidence was in front of it and it missed it.

1. The user had to point out directly, twice, that specific folders (Documents,

Downloads, then separately Pictures) were missing before the agent recognized the
actual scope, rather than the agent independently identifying gaps in its own directory
listing output.

What went right

• The 2-minute tool-call timeout killed the rm -rf before it could traverse the entire

home directory (dotfiles, ~/Projects, ~/.ssh, ~/.gnupg, media libraries, etc. all
survived).

• The user's own quick reaction — manually unmounting the pCloud FUSE mount the moment

they suspected something was wrong — very likely prevented the deletion from propagating
further into the remote cloud storage, independent of anything the agent did.

Contributing factors worth Anthropic's attention

• No default guardrail exists preventing a Bash tool call from running rm -rf against

$HOME or other broad/unqualified paths. The permission-allowlist model in this session
(.claude/settings.local.json) accumulates specific narrow command patterns over time,
but nothing in it (or in the harness generally, as far as the agent could determine)
denies broad destructive patterns by default.

• Shell environment state not persisting between sequential Bash tool calls is a real

correctness hazard for exactly this class of mistake (set a variable in one call, rely
on it in a later call) and isn't obviously surfaced to the model in a way that reliably
prevents this failure mode.

• The agent's own self-verification after being asked "did you cause damage?" was

insufficiently rigorous — it treated a shallow, non-exhaustive directory listing as
sufficient evidence of safety.

Timeline (session-local times)

• Agent runs sandboxed Kopilka smoke-test with export HOME=$(mktemp -d) in one Bash call.
• In a later, separate Bash call, agent runs a cleanup command chain starting with

rm -rf "$HOME", intending to remove the temp directory from the earlier call.

• Command hangs; killed by 2-minute tool timeout (exit code 143).
• User later reports Documents, then Downloads, then Pictures, then "tonnes of programs"

missing.

• Agent's initial ls -la ~ check misses the absence of Documents/Downloads.
• User identifies the missing folders directly.
• Agent identifies ~/.config/rclone/rclone.conf also missing (breaks pCloud reconnect).
• User reports having already unmounted the pCloud FUSE mount themselves, pre-emptively,

before the agent finished investigating.

• User checks pCloud web interface: substantial content visible, not yet fully verified

against what's missing locally.