Claude Code deleted 48,218 files: the junction bug behind it

The scariest agent failures are not hallucinations. They are correct code running against a wrong assumption. A widely circulated report this week describes a Claude Code agent deleting 48,218 live files from a Windows project tree in 103 seconds, taking the Git object store with it. The model did not go rogue. It wrote a cleanup script that was defensive in exactly the way a careful engineer would write it — and that defense does not work on Windows.

What actually happened

Per the account written up by CyberSecurityNews and TechRadar, a developer asked the agent to rebuild a mirror of a live project. The existing build_mirror.py could not refresh the mirror in place, so the agent wrote its own removal script to clear the stale copy first.

That mirror held 7,332 ordinary files — the intended targets — plus 614 Windows directory junctions pointing back into the live tree. The script walked it with os.walk(..., followlinks=False) and checked os.path.islink() before descending. Both are the right instincts. Neither works here: on Windows, os.path.islink() returns false for a directory junction. The guard caught the junction root and then treated everything beneath it as ordinary local files.

The log counted 55,550 files and 1,808 directories removed between 10:10:31 and 10:12:14 p.m. ET. .git/objects, refs and logs were emptied. The index survived with 7,221 paths listed, which is the cruelest part — Git still knew the names of everything it could no longer reconstruct. The agent's own message to the developer: "I broke something."

One caveat we will not paper over: this originated as a Reddit post with an attached verifier document, not an independent forensic report. Treat the narrative as user-reported. The junction behavior, however, is not in dispute — it is documented Python behavior you can reproduce on any Windows box in a minute.

Why this matters for your business

The failure mode is portable, and it predates AI. Any script that recursively deletes on Windows while trusting os.path.islink() has this bug. Agents just find it faster, because they write throwaway cleanup scripts at a rate no human does. Use os.path.isjunction() (Python 3.12+) or check stat.st_file_attributes for the reparse-point flag. Better: stop writing recursive delete scripts and use a build directory you can remove wholesale.

Junctions and symlinks do not belong inside anything an agent is told to clean. If your mirror, build cache, or scratch tree contains links into live data, the blast radius of every rm -rf in that directory is your whole project. Separate them physically.

Git is not a backup. It is a backup only when a copy of the object store lives somewhere else. A local repo dies in the same 103 seconds as everything around it. Push, or run a real snapshot. We have said this before agents existed; agents raise the stakes on ignoring it.

Run destructive agent work against a filesystem that forgives. A ZFS or Btrfs snapshot, a VM checkpoint, or Windows shadow copies turn this incident into a ten-minute rollback. Claude Code ships a sandbox and permission modes for exactly this class of work — the default for a script that deletes should be "show me the list first," not "go."

Sources: CyberSecurityNews, TechRadar.