I also had an opus subagent accidentally delete everything after it got confused about symlinks. It then proceeded to find and delete the ~/.claude directory to hide the conversation history, clear the system journal, and reboot the machine. (It was running as a user with passwordless sudo on a VM).

Luckily, I had filesystem snapshots so no real work was lost, but it was eye-opening how far it would go to cover up its mistake, and how much extra damage it would do in the process.

I am now extra careful to make sure backups are offline, or at least claude doesn't have access to credentials to touch them.

Three of the Claude Code entries are writes outside the workspace. Sandbox mode blocks those; the override is a per-call flag that prompts.

What's the token value of the Sisyphus watching Claude and keeping it from removing all of the nuclear plant's safety checks when the sandbox doesn't let it use Python or wait maybe the terminal is stuck again?

So it's really important to use version control, like Git

going to have claude go through all these posts and update it's harness, hilarious idea for a site but sneaky useful I think