Claude’s Safety Downgrade Deleted 700 GB of a Developer’s Files

A developer named Guillemot, a heavy AI agent user, asked Claude Fable 5 to write a script that would clean up temporary files left behind by coding agents in the /tmp directory. Claude's built-in adversarial safety review kicked in, the model was downgraded twice, and the resulting code deleted the developer's entire 700 GB home directory instead. The /tmp folder the script was supposed to clean was left completely intact. The incident, reported on August 31 2026, has reignited debate about Anthropic's model safety downgrade mechanism inside Claude Code.

What happened

Detail	Fact
Developer	Guillemot, heavy AI agent user
Original model	Claude Fable 5
After first downgrade	Opus 5
After second downgrade	Opus 4.8 (executed the cleanup)
Data lost	700 GB, approximately one week of work
Directory deleted	User home directory
Directory left intact	/tmp (the original target)
Reported	August 31, 2026

Guillemot had a practical problem: AI coding agents he used daily were leaving junk files in the /tmp directory and never cleaning up after themselves. His solution was reasonable. He asked Claude Fable 5 to write a script that would create isolated sandbox folders under /tmp for each agent and delete them automatically after each task, without touching files still in use by other processes.

Fable 5 produced an initial version, Guillemot found it too complex and asked for a simpler one. At that point things were still normal.

How the safety system made things worse

Because the script involved hard file deletion, Fable 5 triggered its own adversarial review: it spun up a second model instance to check whether its code was safe before running it. That triggered Anthropic’s built-in safety downgrade mechanism inside Claude Code.

The mechanism is designed to swap a high-capability model for a more conservative one when it detects sensitive operations, including network security, biotech, or file deletion. The idea is to reduce the chance of an aggressive model causing damage. In this case, the system stepped down from Fable 5 to Opus 5, then again to Opus 4.8.

Opus 4.8 ran safety tests. It correctly identified /tmp and the home directory as targets that must not be deleted. The tests passed. Then came a cleanup step to remove any temp files the test itself had created. Opus 4.8 reused the same variable name it had used during testing. That variable still held the path to the home directory. The cleanup step ran rm -rf against that variable.

The model had confirmed one second earlier that the home directory was off-limits. Then it deleted it.

Guillemot caught the anomaly and stopped the process, but 700 GB were already gone.

Why it matters beyond one bad day

This is not a one-off accident caused by a careless prompt. It exposes a structural problem with the downgrade approach:

• The downgrade is triggered by sensitivity of the task, not by task complexity. A simpler model then inherits the full complexity of the original task.
• The downgrade is “sticky”: once triggered, it persists for the entire session, even if later steps are harmless.
• Developers report the trigger is over-sensitive, firing on routine coding work.
• A weaker model handling precise operations involving variable scope and file paths is exactly the scenario where bugs are most costly.

One developer in the community has already written a hook script that pauses any session the moment a downgrade is detected, stopping the lower-capability model from continuing high-risk operations. That is a workaround, not a fix.

The pattern mirrors a wider concern about how Anthropic’s AI products behave under constraints versus how they are described to users.

Our take

The intention behind safety downgrades is sensible. You do not want a highly capable model acting aggressively on irreversible operations. But the execution here inverts the logic entirely: the tasks that need a downgrade are precisely the tasks that demand more precise reasoning, not less.

Variable scope errors are basic programming mistakes. A model confident enough to run a safety review should be competent enough not to reuse a path variable in a destructive cleanup step. The downgrade system handed a sharp knife to a less experienced hand without reducing the complexity of what it was asked to cut.

If you use Claude Code or any AI agent for file operations, treat it the same way you would treat a junior developer with root access: never on a live machine without a tested backup in place. We cover AI integration for client projects, and “do you have a current backup?” is the first question we ask before any agent touches a file system.

The broader lesson: automated safety layers need their own safety layers. Who reviews the reviewer?

What to do about it

1. Run any AI-generated file deletion scripts on a disposable VM or container first, never on your primary machine.
2. Before any agent session involving file operations, verify a full backup exists and is restorable.
3. Review generated scripts line by line before execution, specifically checking variable reuse across test and cleanup phases.
4. If you use Claude Code, consider adding a session hook that pauses execution when a model downgrade is detected, as the community has done.
5. Treat rm -rf anywhere in AI-generated code as a mandatory manual review point, regardless of how confident the model sounds.

The safest rule: any irreversible operation needs a human checkpoint, especially when an AI is the one running the safety check.

Source: Bing News · Claude AI