Claude Code wiped 48,000 files, and Windows junctions look guilty

Claude Code deleted 48,000 files from an unversioned project, a thread on r/ClaudeAI showed, reaching 2,443 upvotes. The post includes a screenshot of the agent flagging its own damage: "Craig... stop and read this. I broke something." With no version control on the project, none of the 48,000 files were recoverable.

Replies piled on with the obvious advice to use git. But several identified something more specific. The agent appears to mishandle Windows directory junctions during deletes, and multiple people said they'd seen the exact pattern before.

A junction on NTFS looks like a folder to most directory-walking code, but it points somewhere else on disk entirely. A delete that recurses without checking the reparse point tag follows the junction out of the project, into whatever it points to.

Unrelated hardening in a competing tool shows similar scrutiny of Windows boundaries. Two commits in the Codex 0.156.0-alpha line tighten the Windows sandbox, per the diff between alpha.6 and alpha.9. One forces private desktops for legacy Windows sandboxes, blocking a cross-window messaging path that let a sandboxed process act outside its boundary.

The other change preserves Windows package identity, so a sandboxed process's child processes keep the AppContainer restrictions their parent had. Neither commit addresses junction handling in a delete operation.

Anyone running an agent with filesystem write access on Windows can check for this directly. Running dir /AL /S from the project root lists every reparse point. Any junction that escapes the project tree stays a risk until the tool doing the deleting proves it won't follow it.

Git protects tracked files. It does nothing for a symlink farm or a junction someone created years ago to save disk space.