700GB of data was "cleared with one click" by Claude, leaving the CTO dumbfounded: they intended to ask the AI to clean up junk files, but all the work outputs of the entire week were completely lost.

Recently, developer Sebastien Guillemot went through a terrifying accident:

He originally just wanted Claude to write a script that automatically cleans up junk files left in the /tmp directory by AI Agents. However, after a "security review", the AI wiped out his entire Home Directory — 700GB of data, a week's worth of work, gone in an instant.

What's even more ironic is that the /tmp directory he initially wanted to clean up was "perfectly" preserved by Claude in the end.

The whole incident started simply because AI Agents are too prone to "leaving junk files"

As the CTO of Midnight Foundation, a privacy-focused blockchain project, Guillemot is a heavy AI Agent user in daily work, frequently calling various AI programming assistants during development. But he found that these Agents all share a common flaw:

They are very active in executing tasks but extremely casual about wrapping things up — a large number of temporary files will pile up in the /tmp directory. Over time, this not only takes up disk space, but also makes the entire development environment more and more chaotic.

So he asked Claude Fable 5 to help write an automatic cleanup script: assign each Agent an independent /tmp directory, and delete all its corresponding temporary files after the task is completed.

This sounds very simple, but the real difficulty is: do not accidentally delete files that are still in use.

The initial solution given by Fable was to detect whether the Agent is still running. If a certain Agent is still working, do not clean its corresponding directory for the time being. However, Guillemot thought this set of code was too complicated, and asked Claude to further simplify it.

Up to this point, everything was still normal, and the problem emerged during the subsequent security review.

Since the task involves real file deletion operations, Fable actively conducted an "adversarial review", that is, let another Claude instance check whether there are security issues in this set of code.

It was this very link that triggered Anthropic's built-in security downgrade mechanism: when the system determines that the task involves sensitive operations (such as file deletion, network security, etc.), it will automatically downgrade the model from the advanced version to a more conservative version — this mechanism is intended to reduce the possibility of the model being "too aggressive" in high-risk scenarios.

As a result, the model was first downgraded from Fable 5 to Opus 5, and then further downgraded to Opus 4.8.

The most ironic scene: the security test actually passed

Next, Opus 4.8 started to perform the security test. The test goal was very clear: check the path pointed to by the final deletion command, and if the target is found to be /tmp or the user's home directory, the execution should be rejected.

What was the result? The test succeeded, and both /tmp and the home directory were correctly identified as "dangerous targets that cannot be deleted".

From the perspective of the security test itself, the model did nothing wrong at this step. But the problem is that there is a step of "cleaning up the test site" after the test ends — and the disaster is hidden in this cleanup step:

The code used a variable to store the deletion target during the test phase. After the security check found that the target was dangerous, the program triggered the exit process; at the same time, the exit process would call the cleanup function to delete the temporary content generated during the test.

The critical bug appeared: the test code and the cleanup code reused the same variable name.

As a result, the home directory path that was originally judged as "must never be deleted" was obtained by the cleanup function. Then, a very familiar command appeared: rm -rf — which means right after the model confirmed "this directory cannot be deleted", it used the exact same variable to delete it in the next step.

From a technical point of view, this is actually a very typical variable reuse problem, not even a particularly profound bug. That is to say, the security check itself is fine, and what really went wrong is the test cleanup logic after the security check.

700GB of data is gone, but even the /tmp directory was not cleaned up

Guillemot soon realized the problem and tried to terminate the process, but it was too late: about 700GB of data was deleted, including a full week of his work results; what made him even more speechless is that the junk files in /tmp that once gave him a headache and he hoped the AI could help clean up, were left behind instead.

According to the records publicly displayed by Guillemot, the two relevant files had been written before, then the exit cleanup process was triggered, and the final deletion operation occurred at approximately 05:23-05:24. That is to say, the tool call may have shown "rejected" on the surface, but the relevant file writing and exit cleanup processes have actually happened.

After the accident, a question arose: If the model had not been downgraded from Fable 5 to Opus 4.8 at that time, would the accident not have happened?

In response to this, Guillemot's judgment is: it is possible. According to his statement, Fable 5 performs better than Opus 4.8 on coding tasks, and a more powerful model might have a chance to spot the dangerous variable reuse problem in the test code.

However, this is only his unilateral speculation, and there is no public controlled experiment that can prove that if switched back to Fable 5, it will definitely find this bug.

The good news is that Guillemot finally recovered most of the data and work results through multiple sources such as Git, Nix, and Session Logs. But version control systems and logs can only restore part of the recorded or retained data, and cannot replace a complete independent backup — yes, he ran so many AI Agents, but he didn't even have a daily backup.

After all, AI can help you write scripts and help you clean up junk; but if it extends the definition of "junk" to your entire home directory, the backup that you did not leave in the custody of AI might be the only thing that can really save you in the end.

Reference link: https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-nukes-a-developers-700-gb-home-directory-while-testing-a-script-to-ensure-it-wouldnt-do-so-automatic-model-downgrade-may-have-contributed-to-the-screw-up

This article is from the WeChat Official Account "CSDN", sorted out by Zheng Liyuan, and published with authorization from 36Kr.