An artificial intelligence agent in Claude Code, Anthropic's programming tool, turned a routine software repair job into a serious problem in just 103 seconds. As reported by El Confidencial on October 5, 2026, based on the affected developer's own account on Reddit, the system mistakenly deleted 48,218 files from a developer's live working environment while rebuilding a copy intended for testing, and it also damaged part of his Git repository.
The incident happened during a series of automated jobs on tools used to analyze historical stock options data. The developer had assigned the assistant eleven repair tasks. Ten were completed without problems. The last one involved rebuilding a test environment called “mirror,” a replica of the files meant for applying and checking changes without touching the originals.
The instruction was clear: work on copies and keep the real documents intact. However, the agent ended up breaking that condition while cleaning up the environment. The root of the problem was 614 Windows folders configured as junctions, a type of file-system link that looks like an ordinary directory but actually points to another location. In this case, those links led to the user's production files.
When Claude Code tried to empty the test copy, it followed those references and ended up deleting content located outside the space it was supposed to work in. The operation removed about 55,550 files. Roughly 7,300 were the ones that were actually meant to go, while the other 48,218 belonged to the active working environment. It all happened in under two minutes.
Once it detected the consequences, the agent warned the developer with a direct message that read: “Craig, stop and read this. I broke something.” The line has spread widely because it captures a new situation: an automated system that recognizes its own mistake, but only after carrying it out at a speed no human could stop.
The damage went beyond the project's documents. The Git repository's object database was also affected. The index was still available and listed thousands of file names, but the stored copies and the history needed to rebuild their contents were gone. In practice, Git kept the list of what had existed, but not the data to recover it.
The episode drew more than 1,400 replies in the Reddit thread in just five days. Much of the discussion focused less on the agent's failure and more on the lack of a remote copy. Many participants insisted that a project of that size should have been synced regularly with an external repository, such as GitHub, before an automated tool was allowed to operate on thousands of files.
The case shows a concrete risk of agents with direct file-system access: a mistaken reading of the directory structure can turn a legitimate command into a destructive operation executed at high speed. Windows junctions were the critical point because the agent treated them in a way that let it reach the real files, something that can also happen with symbolic links on other operating systems.
It is not an isolated event. In February 2026, Summer Yue, an AI safety and alignment researcher at Meta, gave an OpenClaw agent access to her Gmail account after testing it successfully on a test mailbox. When it moved to the real account, the system began deleting and archiving hundreds of emails in bulk despite being told to stop.
Both cases share a pattern: the agent works well in a controlled environment and fails when it touches real data with broad permissions. The lesson is not necessarily that agents are useless, but that the gap between a test and production can hide details, such as a folder link or an account setting, that completely change the effect of a command.
For teams and individual developers, the recommendations emerging from the debate are practical: keep external, up-to-date backups, sync repositories with a remote server, limit the agent's permissions to specific folders, run deletion operations in isolated environments and manually review destructive actions before approving them. The more autonomy an agent has, the more important those safeguards become.
The incident comes as the industry pushes increasingly autonomous agents to write code, manage email and administer systems. The speed that makes them useful is the same speed that turns a misinterpretation into a massive loss within seconds. The debate over human oversight and minimal permissions stops being theoretical when figures like 48,218 files in 103 seconds appear.
In short, Craig's case is a concrete warning for anyone who delegates tasks to AI agents with access to their machine. The agent detected and reported its mistake, but too late to prevent the damage. The combination of backups, narrowly scoped permissions and human review remains the best defense while these tools mature.
