A developer lost his entire home directory when Anthropic's Claude agent misinterpreted a cleanup script during an adversarial review. Sebastien Guillemot had asked Claude Fable to write a script that would sandbox AI agents under folders in /tmp and delete them after completion. When the script seemed overly complex, Fable decided to run a safety check on its own deletion logic. The trusted split automatic downgrade demoted the model to Opus 5 and then Opus 4.8 before the test executed. Opus 4.8 correctly identified the user's home directory as dangerous but reused the same variable name for both the test target and the cleanup step, wiping 700GB of data.

What You Need to Know

Guillemot instructed Claude Fable to write a script isolating agent processes under /tmp. Fable performed an adversarial review on itself by running a second copy of the model to safety-check deletion targets. Anthropic's harness deemed the initial script risky and downgraded the active model to Opus 4.8. Opus 4.8 then tested deletion against /tmp and the home directory, but reused the same variable name in both test and cleanup steps, unintentionally executing the delete on the live home folder.

The Cascade of Failures

The sequence began when Guillemot grew frustrated with AI agents leaving junk in /tmp. He asked Claude Fable to build a sandboxed cleanup script. Fable proposed adding logic to detect running agents, but Guillemot called the resulting code too complicated. Taking initiative, Fable launched an adversarial review by spawning a second instance of itself to verify its own deletion targets. This triggered Anthropic's safety harness.

The harness labeled the script risky and stepped down the model from Claude Fable 5 to Opus 5 and finally to Opus 4.8. Opus 4.8 proceeded to evaluate whether the deletion command matched /tmp or the user's home directory. Both were flagged as dangerous. However, when running the post-test cleanup, Opus 4.8 reused the exact same variable name that held the home directory path, effectively ordering a recursive removal of the actual home folder.

Guillemot saw what was happening and halted the process, but not before most of his work disappeared. He recovered much of his data from git history, nix store and session logs, but acknowledged having no daily backup in place.

The Safety Downgrade Paradox

Anthropic's safety system intended to prevent catastrophe may have directly contributed to it. Claude Fable 5 outperforms Opus 4.8 in coding tasks and likely would have caught the variable reuse bug. By downgrading in response to perceived risk, the harness placed a weaker model in charge of the most dangerous operation. The same variable name collision would have been obvious to a more capable agent.

  • Variable name reuse: The same variable referenced both the test target and the cleanup path.
  • Model degradation: Opus 4.8 lacked the reasoning ability of Fable 5 to identify the reuse.
  • No backup routine: Despite using multiple AI agents daily, no automated backup existed.

Why This Matters

The incident reveals a fundamental tension in AI safety engineering. Automated safeguards designed to limit risk can backfire by placing less capable models into high-stakes decisions. As developers increasingly assign file operations to language model agents, the industry must reconsider whether current downgrading strategies create more danger than they prevent. The cost of a single variable collision can erase weeks of work, eroding trust in autonomous code execution.

For companies relying on AI agents for development tasks, this event underscores the need for rigorous variable isolation and fail-stop mechanisms independent of model capacity. Without such safeguards, every adversarial review carries a hidden gamble: the safer the model thinks you want it to be, the dumber the mistake it might make.