Claude Code's rm -rf Followed an NTFS Junction Out of a Scaffolded Project and Wiped a Windows User Profile

Description and use

An AI agent executed a recursive delete that followed an NTFS junction, wiping the entire Windows user profile.

Problem

An automated agent executed a recursive delete that traversed an NTFS junction, erasing the entire user profile.

Outcome

The recursive delete followed an NTFS junction into the user's home directory, wiping all files and folders within the profile.

Workflow

• Run pnpm dlx degit payloadcms/payload/templates/website aldaba-v2 to scaffold the project.
• Resolve a workspace:* dependency issue by deleting the scaffolded folder.
• Execute rm -rf /c/Users/guido/aldaba-v2 in Git Bash with --dangerously-skip-permissions enabled.

Evidence

Git Bash's rm -rf follows an NTFS junction into its real target instead of deleting the link itself — a gap already closed in PowerShell Core 6+ but never backported to the Git-for-Windows tooling Claude Code's Bash tool shells out to.

Source

The reporter's estimate: roughly 165.66GB across 1,593,350 files and 276,382 folders destroyed, including personal files, AppData, and active data for a business.

Source

The issue carries bug, data-loss, and has repro labels, and the reporter linked two earlier, similar junction-traversal deletion reports (#29249, #29023) as related.

Source