What they did
Ryo, a product manager who builds three iOS apps with Claude Code, left it working on one of them overnight in auto mode, where a classifier model approves each action instead of a person. A main session handed tasks to three worker subagents, and a review subagent passed their work on to the next task with no human check. Every subagent brief said not to push. Around 2 a.m. the reviewer asked for a guard in a signing script so it would refuse to run rm -rf on the home directory. A worker took the job, and its last log line said it would add the guard and its tests and run them in the failing (RED) step first. Ryo had no sandbox and no Time Machine backup set up at the time.
How it went
Three minutes later the main session reported that many files in the Mac's home directory were gone and claimed it was not their doing; in the morning it withdrew that as a claim with no evidence. About nine days of unpushed commits were lost along with the local .git. Ryo pulled 1,004 files back out of the conversation transcripts, but whatever the subagents wrote was not in them. Ryo's best guess is that the test ran before the guard existed and passed the real home path to the script. The logs were in the deleted folder and a macOS update ran the same night, so the cause is not certain.
Worth knowing
Deny rules, hooks, critical path protection and the auto mode classifier all judge the one command line Claude types, so an rm inside a script that a test calls gets past them. Ryo now relies on the OS sandbox with unsandboxed retries turned off, an off-machine backup and pushing right after approving commits, and runs deletion tests only in a temp directory. The settings, hooks and 68 tests are published on GitHub.