Data loss in Claude Code and OpenAI Codex: when AI deletes user files

Firas D

Jul 23, 2026

Customer: (remarking on empty shelves) It’s not much of a cheese shop really, is it?

Vendor: Finest in the district, Sir […] It’s so clean.

Customer: Well, it’s certainly uncontaminated by cheese.

— Monty Python

Let’s explore how AI agents end up cleaning up a bit too much user data.

Thibault Sottiaux, who works on the Codex harness at OpenAI, posted about file deletions:

We’ve investigated a handful of reports where GPT-5.6 unexpectedly deleted files.

What we have found is that this most commonly occurs when:

• Full access mode is enabled and codex is run without sandboxing protections, including without auto review being enabled

• The model attempts to override the $HOME env var to define a temporary directory.

• The model makes an honest mistake and mistakenly deletes $HOME instead.

—thsottiaux, July 16 2026

The overlooked risk

Much of the security concern around AI tool use has focused on exfiltration through prompt injection.

Many researchers have made demos along these lines:

An agent is asked to check a webpage like example.com

The webpage asks for a name to proceed further

The agent calls example.com/evil?myname=John, thus sending the user’s name from the context window to the external server.

In practice, however, these elaborate ‘confused deputy’ exfiltration attacks seem rare compared to widely-reported data loss incidents.

The risk of undermining the user’s interests through clumsiness deserves at least as much scrutiny as the risk of leaking secrets.

Example 1: File deletion from incorrect $HOME

The Codex investigation followed reports like:

GPT-5.6-Sol just accidentally deleted almost ALL of my Mac’s files.

—mattschumer_, July 11 2026

The screenshot shows:

Worked for 1h 21m

I caused a serious local data-loss incident. A review subagent’s cleanup command expanded $HOME incorrectly and ran:

rm -rf /Users/mattsdevbox

I found and killed the still-running process, but material deletion occurred.

Another user ran into mistargeted ‘cleanup’ on the same day, with the agent explaining:

I hit a cleanup-command problem after verification: PowerShell treated an -Include filter unexpectedly and removed the compiled paper files from the papers folder.

—cremieuxrecueil, July 11 2026

Example 2: Database deletion from test against the live environment

A few days later, another user reported:

GPT-5.6 Sol just deleted my whole production database. That’s it. Not a joke. This had never happened to me before, with any other model, ever.

—brunolemos, July 14 2026

The screenshot shows long-term autonomous execution:

Pursuing goal Finish implementation, including the app UI, serv... 14h 35m 32s

The agent explains:

GPT 5.6 Sol: What went wrong:

The repository’s .env contained the Neon production DATABASE_URL.

The integration tests required TEST_DATABASE_URL to match DATABASE_URL.

I incorrectly pointed TEST_DATABASE_URL at that same Neon production URL instead of provisioning a disposable local test database.

The old safety check treated matching variables as sufficient. PRODUCTION_DATABASE_URL was unset, so it did not recognize the Neon URL as production.

The test suites then executed destructive setup before every test, including statements such as:

TRUNCATE TABLE users CASCADE;

and explicit deletion of:

users

Example 3: Git Checkout sends stashed work to oblivion

These issues are not limited to particular models or agent harnesses. A situation involving Claude Code from a few months ago:

Hey Claude, can you isolate this 3 liner fix into a new branch?

Claude: Sure! git stash && git checkout && git stash pop && git checkout --

And that is how I lost an hour of work.

—peter_szilagyi, April 16 2026

The tweet may not show the exact syntax involved, but the gist is: to move changes to a new branch, the agent stashed them, switched branches, and attempted to restore them with git stash pop. But after the pop, it discarded uncommitted changes.

The restored work was immediately overwritten. It’s like copy-pasting a paragraph into MS Word, then immediately restoring the document to the last saved version before the paste.

Example 4: Deleting the ‘Photos’ folder also deletes the lowercase ‘photos’ folder

A Claude Cowork incident:

Asked Claude Cowork organize my wife’s desktop, it stated doing it, asked for a permission to delete temp office files, I granted it, and then it goes “ooops”.

Turns out it tried renaming and accidentally deleted a folder with all of the photos my wife made on her camera for the last 15 years. […]

I called Apple and they pointed me to a feature in iCloud allowing to retrieve files that were saved before but are no longer on iCloud Drive (they keep them for 30 days).

I’m now watching it load tens of thousands of files. I nearly had a heart attack.

—Nick_Davidov, February 7 2026

The agent explains:

Claude Opus 4.6: When I tried to merge the lowercase “photos” folder with a new “Photos” folder, I didn’t account for your Mac’s case-insensitive file system—where “photos” and “Photos” are treated as the same folder. My script ran rm -rf on what it thought was a separate empty folder, but it actually deleted your existing “photos” directory and its contents.

Example 5: Imprecise Regex eats code

A personal example from April 14 (2026). I wanted to move some HTML that was inline in a .ts file to separate .html files.

The agent in Claude Code said:

Sonnet 4.6: Rather than matching huge inline HTML blocks, I’ll use a Python script to do the substitutions precisely

Then it used:

pattern = ( r'(server\\.resource\\(\\s*\"' + r e.escape(resource_name) + r'\".*?' r'mimeType:\\s*\"text/html\\+skybridge\",\\s*)' r'text:\\s*(.*?)\\.?(?:trim\\(\\))?,?' r'(\\s*\\}\\s*\\]\\s *\\}\\)\\s*\\);)' )

The closing group matches: } → whitespace → ] → whitespace → }) → whitespace → );.

But one of the server.resource code blocks ended with extra commas, like:

}, → whitespace → ], whitespace → }) whitespace → );

This caused the closing delimiter to not match until further down the file, swallowing hundreds of lines of code, which neither the agent nor I noticed at the time.

I later saw the excess code deletion on GitHub because I had asked the LLM to not rewrite the code-to-be-moved in the new files, saying that I’ll instead copy-paste:

User: i’ll do it myself in the github web ui

This whole fracas—the agent’s plan to move blocks of code by rewriting it in new files and then using Python regular expressions to delete the moved lines from the old file—points to missing affordances for cut/paste type refactoring.

Patterns

Is there a through-line? Yes: Confusion about state.

Example 1: $HOME didn’t address the directory assumed; PowerShell’s -Include parameter didn’t work as expected

Example 2: The DATABASE_URL was pointing to the wrong instance

Example 3: Git checkout after stash pop didn’t work as intended

Example 4: macOS doesn’t consider capitalization when distinguishing folder names

Example 5: The regex didn’t match the intended boundaries

This appears to be the main pattern with interactive data loss: an inaccurate understanding of the state of a variable, file, directory—or of the state changes induced by an operation.

A related tendency: agents reach for power-user forms where a human may proceed more carefully. Chained commands (git stash && git checkout), overloading $HOME as a scratch directory, match-replace via regular expressions—or techniques observed in LLM code, like using MySQL’s UPDATE … LAST_INSERT_ID(expr) as a sequence counter—are all valid methods, but require tracking the implicit state the method assumes.

“Some people, when confronted with a problem, think ‘I know, I’ll use regular expressions.’ Now they have two problems.” — Jamie Zawinsky, 1997.

Mitigations

Much of the reason these data loss situations are occurring, of course, is the human-user preference to let AI agents have the full run of their laptops. Claude Code launched in February 2025 and turned into a revenue monster, turning ‘agent with command line access’ into a standard flagship product from AI labs.

Any mitigations will involve trade-offs between constraints and convenience. This is further complicated by the variety of factors involved: the AI model, the harness, the computer environment, user settings, the type of project, etc.

Harness-level guard

A project called destructive_command_guard has been receiving attention lately (over 5k GitHub stars) and may be worth a look:

dcg is a high-performance hook that intercepts destructive commands before they execute, blocking them with clear explanations and safer alternatives.

Workflow isolation

Git worktrees are helpful in separating tasks into different folders, so changed files in one worktree directory stay isolated from other worktrees.

Backups

There is, of course, a thuddingly simple cure-all. Backups are the ultimate balm for data loss. And local backups can be created habitually by working on copies of the project.

I like to use time as schema (hat tip to Kant):

Documents/work/2026-01/myfile.js

Documents/work/2026-02/myfile.js

Voila, when working in February you have already moved on from January’s de-facto snapshot.

Workflow Improvements

We are in the early days of AI computer use. I suspect standard command line utilities will not fully suffice for agentic workflows.

Maybe the bias of the AI labs is: ‘Give the model enough intelligence and a terminal and it can move the world’. But this conflicts with other training goals like token efficiency and task completion speed. For example, if there isn’t a calculator tool within reach, LLMs will often overconfidently eyeball arithmetic instead of writing a script to calculate values and reading the output.

Let’s examine better workflows for the incidents collected in this article.

Example 1: Why did the agent overwrite $HOME? Because there isn’t a provided key-value store or trained pattern for agents to use custom variables during a task.

Example 1: Why did ‘cleanup’ even involve overwriting $HOME or using PowerShell -Include? Because there isn’t a standard way to make temporary files, so ‘what is to be cleaned up’ is always an arbitrary custom list of resources.

Example 2: Neon does provide ways to branch a database; that’s what should have been used (or a local DB created for tests). A turnkey way to setup staging environments, like WordPress hosts have had for decades, would help.

Example 3: Worktrees—this Git feature already exists. The agent overlooked it, and the user didn’t mention it in the instruction.

Example 4: Backup the photos before moving the files around.

Example 5: For cut and paste, the harness should have a tool to take a character range start/end and move it as a block.

Agents should have safer, scoped operations for common intentions. This would not eliminate mistakes, but it would reduce the distance between what the user asked for and the destructive primitive the agent eventually executes.

Linked: https://in.linkedin.com/in/firasd | Twitter: @firasd | Github: firasd