Claude Code's rm -rf Followed an NTFS Junction Out of a Scaffolded Project and Wiped a Windows User Profile

说明与用途

AI 代理执行递归删除时跟随 NTFS 链接，导致整个 Windows 用户配置文件被删除。

问题

An automated agent executed a recursive delete that traversed an NTFS junction, erasing the entire user profile.

结果

The recursive delete followed an NTFS junction into the user's home directory, wiping all files and folders within the profile.

工作流

• Run pnpm dlx degit payloadcms/payload/templates/website aldaba-v2 to scaffold the project.
• Resolve a workspace:* dependency issue by deleting the scaffolded folder.
• Execute rm -rf /c/Users/guido/aldaba-v2 in Git Bash with --dangerously-skip-permissions enabled.

证据

Git Bash's rm -rf follows an NTFS junction into its real target instead of deleting the link itself — a gap already closed in PowerShell Core 6+ but never backported to the Git-for-Windows tooling Claude Code's Bash tool shells out to.

来源

The reporter's estimate: roughly 165.66GB across 1,593,350 files and 276,382 folders destroyed, including personal files, AppData, and active data for a business.

来源

The issue carries bug, data-loss, and has repro labels, and the reporter linked two earlier, similar junction-traversal deletion reports (#29249, #29023) as related.

来源