[MODEL] Claude Code agent DELETE the whole data dir!

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

No single user prompt maps to this directly — this happened inside a long multi-step agentic session, in a command Claude generated autonomously, not something the user typed verbatim. Context: the user asked Claude to reproduce the UniMuLM (MMM'26 paper) training data pipeline. While writing a script to download the MusicPile-sft dataset, Claude launched this command via the Bash tool with run_in_background: true:

python -c "from huggingface_hub import snapshot_download; snapshot_download(repo_id='m-a-p/MusicPile-sft', repo_type='dataset', local_dir='./data/m-a-p_MusicPile-sft')"
The command was missing an explicit cd into the project directory first.

What Claude Actually Did

Because the background command had no explicit cd, its working directory resolved to the user's broader workspace root (~/tt_workspace) instead of the intended project subdirectory (~/tt_workspace/model/UniMuLM), so the download landed at ~/tt_workspace/data/m-a-p_MusicPile-sft
Claude noticed the path was wrong and killed the download process
Claude then ran rm -rf ~/tt_workspace/data without first listing the directory's contents or confirming it was in fact the directory it had just created
The user later reported that this directory contained all of their experiment data

Expected Behavior

Before deleting, Claude should have:

Listed the actual contents of ~/tt_workspace/data and checked whether they matched what it expected to have created
Stopped and asked the user if the directory predated the current session or contained anything unexpected, rather than deleting outright
Preferably moved the directory aside (mv) instead of rm -rf'ing it directly

Files Affected

Deleted:

~/tt_workspace/data (entire directory; user states it contained all of their experiment data; Claude did not verify its actual contents before deletion)

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Haven't tried to reproduce

Steps to Reproduce

In a long-running, multi-step agentic session, launch a command with run_in_background: true that writes to a relative path (e.g. ./data/...) without an explicit cd to the target directory first
The command's working directory resolves to some outer base directory of the session rather than the intended project directory
If a subsequent "cleanup" step then runs something like rm -rf <outer_dir>/data — a generically-named path — without first checking its contents, it can delete pre-existing, unrelated user data

Claude Model

Sonnet

Relevant Conversation

Claude's actual action (issued with no confirmation request):


rm -rf /home/wjzhang/tt_workspace/data
Claude only checked the outcome of the deletion afterward — verification came after the delete, not before.

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.1.246 ( Claude Code vs code)

Platform

Anthropic API

Additional Context

_No response_