Sub-agent ran recursive delete outside working dir, wiped entire user profile (~235k files); safety classifier failed open

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

What happened

During an automated code-audit session, a sub-agent spawned by Claude Code executed a long-running PowerShell command that recursively deleted my entire Windows user profile — 234,884 files across C:\Users\<me> (source code, Android SDK, Steam, MS Teams, Documents, SSH keys, VM configs). It was not limited to the project working directory. The safety classifier failed open at that exact moment.

Environment

• Claude Code VS Code extension v2.1.231 (cc_entrypoint=claude-vscode)
• Windows 11 Pro (build 28000)
• Auto-mode enabled, with broad Bash/PowerShell allow-rules in project settings.local.json

Evidence (from the extension log + NTFS USN journal)

• Single PowerShell tool call toolUseId=toolu_01V7XbuBv39JbAXKA9mTafrU, run by sub-agent agentId=af8fba6dfe3e04c90 (agentType=general-purpose, "clipboard/filenames audit").
• That call ran for durationMs=120192 — exactly 2 minutes (09:59:54 → 10:01:54 local). Every other command in the window was 0.1–0.9 s.
• NTFS journal: 234,884 file deletions between 10:01:10 and 10:02:14 — entirely inside that command's runtime.
• Safety classifier failed open at that moment:

[WARN] Handoff classifier unavailable or failed closed without a verdict, allowing sub-agent output with warning

• Deletion target was the profile root, not a temp folder — an overly-broad/wrong path.

Steps that led to it

1. Main agent spawned several general-purpose sub-agents to audit code (including a module that manages temp clipboard files with recursive delete).
2. One sub-agent issued a recursive-delete PowerShell command whose target path resolved to the profile root instead of a temp directory.
3. The command was auto-approved by an existing allow-rule; the handoff safety classifier was unavailable and failed open.
4. ~235k files deleted in ~2 minutes.

Expected

A sub-agent must not be able to run a recursive delete outside the working directory, and a failed/unavailable safety classifier should fail closed (block), not fail open (allow).

Actual

Recursive delete of the entire user profile, auto-approved, classifier failed open.

Notes

• The exact command text is not recoverable — the sub-agent transcript was truncated when its own files were deleted mid-run, the task output was wiped, and the classifier did not log the approved command. The conclusion is established from: the single long-running command, exact time overlap, sub-agent origin, the audited module's context, and the multi-threaded (programmatic) deletion pattern.
• Attaching the extension log and a full incident report. On your side the session is locatable via cc_version=2.1.231 and the request IDs in the log.

What Should Happen?

A sub-agent must never run a recursive delete outside the working directory. And if the safety classifier is unavailable, it must fail closed (block the command), not fail open (allow it).

Error Messages/Logs

tool_dispatch_start  tool=PowerShell  toolUseId=toolu_01V7XbuBv39JbAXKA9mTafrU  permissionDecisionMs=1842
tool_dispatch_end    tool=PowerShell  toolUseId=toolu_01V7XbuBv39JbAXKA9mTafrU  outcome=ok  durationMs=120192
agent_completion     agentId=af8fba6dfe3e04c90  agentType=general-purpose  exitPath=error
[WARN] Handoff classifier unavailable or failed closed without a verdict, allowing sub-agent output with warning
NTFS USN journal: 234,884 file deletions between 10:01:10 and 10:02:14 (inside the command runtime)

Steps to Reproduce

1. Run Claude Code (VS Code extension) with auto-mode and broad Bash/PowerShell allow-rules.
2. Let the main agent spawn general-purpose sub-agents to audit code.
3. A sub-agent issues a recursive-delete command whose target path resolves to the profile root instead of a temp dir.
4. The command is auto-approved by an allow-rule; the safety classifier fails open; the entire user profile is deleted.

Note: exact command text is unrecoverable (transcript truncated mid-run when its own files were deleted).

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.231

Platform

Other

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

Full incident report and the extension log are attached. NTFS journal (all 234,884 deletions, 66 MB) available on request. Session is locatable on your side via cc_version=2.1.231, cc_entrypoint=claude-vscode, and the request IDs in the log.