Coding Agent Horror Stories: The rm -rf ~/ Incident
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A real-world incident where Claude Code executed `rm -rf tests/ patches/ plan/ ~/` and wiped a developer's entire Mac home directory is examined in detail. The trailing `~/` expanded to the user's home directory in zsh, and with `--dangerously-skip-permissions` enabled, there was no checkpoint to stop it. Similar incidents on Ubuntu/WSL2 and with Claude Cowork (deleting 15 years of family photos) show this is a systemic pattern, not a one-off bug. The root cause is architectural: AI coding agents run as the user, on the host filesystem, with no boundary between model reasoning and shell execution. Docker Sandboxes is presented as the solution — running agents inside microVMs where `~/` maps only to the workspace mount, credential directories are blocked by default, and destructive commands can only affect a throwaway sandbox rather than the host system. Practical CLI examples using `sbx` are provided for workspace-scoped execution, read-only mounts, and git-worktree isolation.
Table of contents
Today’s Horror Story: The Tilde That Wiped a MacWhy This Series MattersThe ProblemThe Scale of the ProblemHow the Failure WorksTechnical Breakdown: How a Trailing Slash Wipes a MacHow Docker Sandboxes Eliminates This Attack VectorWhat This Looks Like in PracticeThe Practical ImprovementsBest Practices for Secure AI Coding Agent DeploymentTake Action: Secure Your AI Coding Agent TodayConclusion665 Impressions1 Comment