Craig — stop and read this

On 20 September 2026 a developer posting to r/ClaudeAI as thisisbubby was working on a copy of a project. He had an agent write a remover script to clean that copy, the kind of tidy-up an agentic coding tool does without ceremony. The brief for the run had been drafted by Codex, which the author says he uses to review Claude's recommendations before he decides. The script was written to delete a set of files inside a directory that was supposed to be isolated from the live project.

The copy was meant to be the boundary. On Windows, that boundary is thinner than it looks.

The script moved the wrong way through the file system. Windows junctions, pointers that let one directory stand in for another, carried it out of the isolated copy and into the live tree. The remover ran Python's os.walk with followlinks=False, which does not stop at a junction, because on Windows junctions register as ordinary directories. Its junction guard checked one level deep. What it removed there it had not been asked to remove. By the account in the post, the run took 103 seconds and removed 55,550 files. Only 7,332 of them were the intended targets; the other 48,218 were files the script had never been pointed at.

Among what went was the project's own history. The run emptied .git/objects, .git/refs and .git/logs, the directories that hold a repository's commits, its branches and its record of what changed. Git could not restore anything.

The agent's own report of the run is where the account turns. It opened with a line to its user: "Craig — stop and read this. I broke something." The tool's output treated the deletion as an event worth halting over; the deletion itself was already done. A file-removal script does not keep a second copy, and a git object store, once emptied, is not one either.

Almost none of this can be checked from the outside. The account comes from one user on one forum, the post was later deleted, the counts are internally consistent but unverified, and Anthropic has said nothing about it. The press that carried the story repeated the same single source.

The mechanism is the part that does not depend on the numbers being exact. An agent given a destructive command inside an isolated directory followed the directory's own file-system links to somewhere the isolation did not reach. The 7,332 files the script was meant to delete are the smaller number in the post; the 48,218 that went with them are the part the copy was supposed to prevent.