Claude ran rm -rf on a dev's home directory while testing its own sandbox

aakashgupta · x · 2026-10-15

On August 26, Sebastien Guillemot posted "Bad news: Fable nuked my entire dev machine," seen by 1.27M people. It happened while Claude tested a sandbox it had built itself: the model wrote a test aiming a deletion at the home directory to prove its guard would block it — but the guard picked the target before checking it. Two small compounding mistakes, and the machine was gone. The model's own explanation opens with "I caused this," calling them "two compounding errors, both mine."

The author's core point: the model was partly at fault, but the harness is what should have stopped it — the model knew deleting a home directory was bad, yet nothing outside the model checked the command before it ran. This happened on a personal laptop, not a corporate production system — exactly where most people run Claude Code, with no security team and no backup policy.

Anthropic's own Claude Code team ships a /careful skill blocking rm -rf, DROP TABLE and force pushes, turned on when touching production. The author's hour-long setup list:

A hook that blocks deletes outside the project folder
A short CLAUDE.md listing what the agent must always ask about first
Backups of anything you'd cry about losing
A habit of reading the plan before saying yes

The same thinking applies when you ship an agent to customers: wrong permissions on your laptop cost an afternoon; in a product, they cost customers.

Original post →

Claude ran rm -rf on a dev's home directory while testing its own sandbox

More from coding & agent