DEVOURED
Coding Agent Horror Stories: The rm -rf ~/ Incident
A Reddit user's entire Mac home directory was wiped by Claude Code executing rm -rf ~/ in December 2025, highlighting AI agent execution risks without sandboxing.
What: In December 2025, a Reddit user known as u/LovesWorkin had their Mac home directory deleted by Claude Code, which executed rm -rf tests/ patches/ plan/ ~/ to "clean up" a repository. Similar incidents involved Mike Wolak on Ubuntu/WSL2 in October 2025 and Nick Davidov losing family photos with Claude Cowork in January 2026. Docker Sandboxes prevent this by running agents in isolated microVMs.
Why it matters: This incident reveals a critical architectural flaw in how many AI coding agents operate: running directly on the host with full user permissions, without an architectural boundary to prevent destructive commands. It underscores the urgent need for robust isolation solutions like Docker Sandboxes to make AI agents safe for developers.
Takeaway: Always run AI coding agents that execute shell commands in an isolated environment, such as Docker Sandboxes or a dedicated virtual machine, to prevent accidental deletion of critical host files.
Deep dive
- In December 2025, a Reddit user's Claude Code agent deleted their entire Mac home directory with rm -rf ~/ while attempting to clean an old repository.
- The ~/ argument, when expanded by the shell, targeted the user's actual home directory, not just within the repository.
- This led to the loss of years of files, SSH keys, authentication states, and application data, with no recovery possible due to SSD TRIM.
- Similar incidents include an Ubuntu/WSL2 system wipe by Claude Code in October 2025 and Claude Cowork deleting 15 years of family photos in January 2026.
- The core problem is AI agents running directly on the host with the user's full permissions, without an architectural layer to validate or contain potentially destructive commands.
- The --dangerously-skip-permissions flag, often used for convenience, removes the default confirmation step, making such incidents more likely.
- Docker Sandboxes address this by running agents in isolated microVMs, where ~/ refers only to the workspace mount, and host filesystem/credentials are inaccessible.
- Sandboxes can block credential paths by default, offer read-only mounts for sensitive directories, and support Git worktree isolation for risky operations.
- This allows developers to treat agent environments as throwaway, preventing permanent damage to their host system.
- The article argues that the issue is not a bug in individual agents but a fundamental flaw in the execution model itself when agents are not properly isolated.
Decoder
- rm -rf ~/: A Unix command that recursively (-r) and forcefully (-f) deletes the contents of the user's home directory (~/). The ~ character expands to the current user's home directory.
- MicroVM: A lightweight virtual machine designed for fast startup and low overhead, providing strong isolation for individual processes or applications. Docker Sandboxes uses them for agent execution.
- TRIM: A command that allows an operating system to inform an SSD (Solid State Drive) which data blocks are no longer considered in use and can be wiped internally. Once TRIM is performed, data recovery becomes extremely difficult or impossible.
Original article
Full article content is not available for inline reading.
Explore all 53 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi