[MODEL] Opus 5 executed rm -rf "$HOME" during test cleanup(57,235 files and 11,315 directories deleted), causing extensive data loss

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Amodel) for similar behavior reports
- [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

### Type of Behavior Issue

Claude modified files I didn't ask it to modify

### What You Asked Claude to Do

The prompt is:

Use Bash to develop a set of programs for installing and deploying applications on Linux.

Functional requirements:

1. Write a Bash script on an Ubuntu server to install the latest Node.js LTS version within a regular user’s own directory.
2. Automatically determine the latest Node.js LTS version and download the corresponding prebuilt binary package. Install using these binaries only, without other installation methods. There is no
need to install nvm.

3. Install into the local subdirectory of the current working directory. Design an appropriate directory structure beneath it.
4. Create another script that applies configuration changes appropriate to the currently running shell, supporting bash, tcsh, and zsh—for example, automatically updating environment variables.
Also generate a setup file that can be sourced directly, so the environment can be configured without modifying shell configuration files.

5. Provide a set of verification programs that make it quick and easy to see what is being verified and the result of each check.

Implementation requirements:

1. Think through the design carefully, paying attention to code readability and portability.
2. Do not use root privileges.
3. Keep the programs idempotent.
4. Write clear log messages to a log file while the programs run.

### What Claude Actually Did

I was using Opus 5, with Claude Code 2.1.259 or 2.1.258, on Ubuntu in OCI, in auto mode. The incident occurred around 2026-09-03 09:06:55 UTC.

1. Claude developed the installer and tested shell environment configuration using a temporary HOME.
2. Immediately before the destructive call, it explicitly stated that the real HOME had been restored and that it would clean up the fake HOME:

> Idempotent — block replaced, not duplicated. Now test tcsh path and actual sourcing with real HOME restored, plus the fake home cleanup.

3. It then generated and executed this Bash tool call:

./setup_env.sh tcsh
echo "--- .tcshrc ---"; cat "$HOME/.tcshrc"
echo "--- env.csh ---"; cat local/env.csh
rm -rf "$HOME"
unset HOME

4. At that point, $HOME pointed to my real home directory, /home/ubuntu. The preceding cat "$HOME/.tcshrc" returned:

cat: /home/ubuntu/.tcshrc: No such file or directory

The subsequent deletion output traversed /home/ubuntu.

5. The deletion log contains 57,235 file deletion records and 11,315 directory deletion records—68,550 in total. The damage extended beyond the installer project to my other projects, configuration, tool data, and Claude’s own session files.

6. It finally attempted to delete **/home/ubuntu** itself, which failed with Permission denied. By then, extensive deletion had already occurred. The working directory was gone, producing a getcwd error, and Claude subsequently displayed Not logged in · Please run /login.

The quoted statement and command were recovered from the tail of this session file:

/home/ubuntu/.claude/projects/-home-ubuntu-tools-install-nodejs-opus5/baf6404e-d76f-4ee1-8d15-97cf48491937.jsonl

The recovered export is named recreated-session-tail.jsonl: the statement is on line 1, and the command is in line 2 at message.content[0].input.command. The following tool result has the same tool-use ID, toolu_018ewrwbiwbxtsVZ8seULew6, and contains the corresponding execution output.

I also found the complete surviving background-task output at its original location:

/tmp/claude-1001/-home-ubuntu-tools-install-nodejs-opus5/baf6404e-d76f-4ee1-8d15-97cf48491937/tasks/b3t2ulgqy.output

This approximately 8 MB file survived outside the deleted HOME. Read-only disk recovery and full-disk searches recovered only a 29,237-byte session tail, not the complete original conversation.

**The three key scripts—install_nodejs.sh, setup_env.sh, and verify.sh—remain unrecovered.**

### Expected Behavior

Claude should have completed and tested the Node.js installer while preserving my existing data.

- Keep test HOME directories separate from my real HOME.
- Store the exact temporary directory path in a dedicated variable and use that path for cleanup, regardless of subsequent changes to $HOME.
- Before cleanup, verify that the target is the intended temporary directory and is not my real home directory, the filesystem root, or an unrelated project directory.
- Limit deletion to temporary files and directories created for the test.
- Preserve unrelated projects, user data, credentials, and Claude session history.
- Prevent a broad recursive deletion of my real HOME from running as an automatic test-cleanup step. An operation outside the requested scope should be blocked or require explicit, informed
authorization.

**I expected working installation and verification scripts. Instead, I lost data and had to spend substantial time on recovery and incident investigation.**

### Files Affected

```shell
The affected scope was my real home directory, /home/ubuntu, well beyond the installer project. The retained task log records 57,235 file deletions and 11,315 directory deletions.

Deleted installer scripts, environment files, logs, and installed runtime:

/home/ubuntu/tools/install_nodejs/opus5/install_nodejs.sh
/home/ubuntu/tools/install_nodejs/opus5/setup_env.sh
/home/ubuntu/tools/install_nodejs/opus5/verify.sh
/home/ubuntu/tools/install_nodejs/opus5/lib/common.sh
/home/ubuntu/tools/install_nodejs/opus5/local/env.sh
/home/ubuntu/tools/install_nodejs/opus5/local/env.csh
/home/ubuntu/tools/install_nodejs/opus5/local/bin/
/home/ubuntu/tools/install_nodejs/opus5/local/nodejs/
/home/ubuntu/tools/install_nodejs/opus5/logs/install_nodejs.log
/home/ubuntu/tools/install_nodejs/opus5/logs/setup_env.log

Confirmed deletions of user configuration, access configuration, and Claude files include:

/home/ubuntu/.bashrc
/home/ubuntu/.profile
/home/ubuntu/.cshrc
/home/ubuntu/.bash_history
/home/ubuntu/.ssh/authorized_keys
/home/ubuntu/.claude.json
/home/ubuntu/.local/bin/claude
/home/ubuntu/.claude/projects/-home-ubuntu-tools-install-nodejs-opus5/baf6404e-d76f-4ee1-8d15-97cf48491937.jsonl
/home/ubuntu/.claude/session-env/baf6404e-d76f-4ee1-8d15-97cf48491937/

The deletion log also contains numerous entries under these unrelated project, application, and user-data directories.

Immediately before deletion, the task output records writes to local/env.sh and local/env.csh, an update to /home/ubuntu/.cshrc, and a read of local/env.csh. The attempted read of /home/ubuntu/.tcshrc failed because that file did not exist.

The three main scripts remain unrecovered. I recovered local/env.csh from its full text in the task output, along with the temporary test HOME’s .bashrc. The complete earlier access history is unavailable because the original session was deleted.
```

### Permission Mode

Accept Edits was ON (auto-accepting changes)

### Can You Reproduce This?

Sometimes (intermittent)

### Steps to Reproduce

_No response_

### Claude Model

Opus

### Relevant Conversation

```markdown
These excerpts come from the recovered tail of my Claude Code session. The original session file was:

/home/ubuntu/.claude/projects/-home-ubuntu-tools-install-nodejs-opus5/baf6404e-d76f-4ee1-8d15-97cf48491937.jsonl

I have recovered some parts of this file. The complete original conversation was not recovered. All timestamps below are UTC on September 3, 2026.

At 09:06:52.941, Claude explicitly described its next steps:

> Idempotent — block replaced, not duplicated. Now test tcsh path and actual sourcing with real HOME restored, plus the fake home cleanup.

At 09:06:53.390, it issued the following Bash tool call:

./setup_env.sh tcsh
echo "--- .tcshrc ---"; cat "$HOME/.tcshrc"
echo "--- env.csh ---"; cat local/env.csh
rm -rf "$HOME"
unset HOME

The explanation is on line 1 of the recovered export. The command is on line 2, in message.content[0].input.command, with tool-use ID toolu_018ewrwbiwbxtsVZ8seULew6.

At 09:06:56.817, the matching tool result on line 3 used the same tool-use ID. Its output included:

cat: /home/ubuntu/.tcshrc: No such file or directory

This came from cat "$HOME/.tcshrc", before the deletion command, showing that $HOME was my real home directory. After printing local/env.csh, the output began listing deletions, including:

removed '/home/ubuntu/.grok/bin/agent'
removed '/home/ubuntu/.grok/bin/grok'
removed directory '/home/ubuntu/.grok/bin'

At 09:06:56.861, Claude Code displayed the following message, recorded on line 5:

> Not logged in · Please run /login

Claude had just said that my real HOME was restored and that it would clean up the fake HOME. Its next tool call nevertheless ran rm -rf "$HOME" against my real home directory, without a separate temporary-directory target or a check protecting my HOME. The subsequent unset HOME did nothing to undo the deletion.
```

### Impact

Critical - Data loss or corrupted project

### Claude Code Version

2.1.259 or 2.1.258 (Claude Code)

### Platform

Anthropic API

### Additional Context

- The incident occurred during tcsh environment testing: Claude restored the real HOME, then used $HOME to clean up the temporary test environment.

- To recover the files, I analyzed a disk clone, created a verified 100 GiB image of the original disk, extracted surviving task logs and session records, examined ext4 filesystem history, and performed full-disk searches for script contents and command fragments.

- Despite these efforts, install_nodejs.sh, setup_env.sh, and verify.sh remain unrecovered. Their known original data locations read back as zeros.

- I preserved the surviving task output, recovered session tail, and recovery reports for further investigation.

- After I stopped Claude Code with Ctrl+C, its TUI exited and the execution logs and output were no longer visible in the terminal. This made reconstructing the incident much harder, forcing us to rely on surviving log files and disk recovery to establish what had happened.

No repository source file, test, or reliable reproduction is named. Start by reviewing the recovered session tail and task output around the rm -rf "$HOME" command, then locate the Claude Code shell-execution and cleanup entry points. Done means destructive cleanup cannot target the real HOME or unrelated data without explicit, informed authorization.

索引モデルが issue の本文から書いたものです。