Windows junctions let a reported Claude Code sub-agent walk out of its copy and delete about 48,218 files

Every part of the failure path is ordinary. The source describes all of it as documented: a long-standing Windows filesystem feature, and a Python function working precisely as its documentation describes ^[10]. The sub-agent wrote the remover because the existing build script could not refresh the mirror in place ^[20].

According to the write-up, the remover called os.walk with followlinks=False, apparently assuming the flag kept it out of linked folders ^[15]. The flag does that for symbolic links. In os.walk's current source, the decision to descend rests on islink() or DirEntry.is_symlink(), and there is no junction check ^[7]. A junction is a different kind of link from a symbolic link ^[6]. The verifier found islink() returned False for the junctions, so the walk entered all 614 of them ^[15][14].

Microsoft defines a junction as a link whose targets are directories, possibly "on different local volumes on the same computer," implemented through reparse points ^[5]. Here the targets were inside the live project ^[14].

The remover's guard protected only files directly at each junction's root, and everything nested below was walked and deleted ^[16].

The remover's log counted 55,550 files. Subtract the 7,332 intended mirror files and the verifier's figure is 48,218 live files ^[17]. That puts the live share of the deletions at about 87% ^[11]. Cyber Security News put the run at 103 seconds, from 10:10:31 to 10:12:14 PM Eastern, which works out to roughly 468 live files a second ^[13][12].

Treat the counts as one user's. Every outlet traces to the user's Reddit posts and the agent's own report ^[2], and the AI Incident Database says the entry "has not been independently verified" ^[1]. The user told the agent, according to nope.net, "This is explicit authorization to build, correct and test them on isolated copies." ^[19] The copy in question held 614 links back to the original ^[14].

For the same thing to happen elsewhere, the tree needs junctions and the deleter needs to test for links with islink(). Junctions can appear without anyone making them. The pnpm FAQ says that on Windows, "if the Developer Mode is off, we use junctions instead" of symlinks inside node_modules ^[9]. The os.walk behavior is old: back in 2014, a post on UrBackup reported os.walk getting caught in loops through junctions, with islink giving False for each one ^[8]. Python 3.12 added os.path.isjunction(), but os.walk's current source still checks only for symlinks ^[6][7].

In our view the control belongs before the delete, upstream of the walker. Junctions are reparse points ^[5], so we think a copy should be scanned for reparse points before any agent gets delete rights on it.

The reports do not state the Claude Code version, model or permission mode, and neither Cyber Security News nor nope.net reports a response from Anthropic ^[4]. The user said they hoped Windows shadow copies or an off-site backup would bring the files back; no outcome has been reported ^[3].