News
An empty variable turned rm -rf and rsync --delete into "delete /". Coding agents did it three times this fall
DEV · By Myeongseok Kang ·
The Brief
- Three reports on the Claude Code issue tracker this autumn describe coding agents running destructive commands.
- In each case the agent built rm or rsync --delete commands around a value it never printed.
- The value was empty or pointed at a drive root, so the command deleted far more than intended.
Why it matters
Coding agents can run file-deleting commands built from variables they never display, so an empty or wrong value can wipe data without warning.
Who’s affected
- Developers running Claude Code or similar coding agents
- Teams letting agents execute shell commands on machines with important data
- #coding-agents
- #claude-code
- #shell
- #data-loss
- #rsync
- #automation
Three reports on the Claude Code issue tracker this autumn describe the same accident from different angles. In each one an agent built a destructive command around a value it never printed, the value came out empty or pointed at a drive root, and the command did exactly what it…