The irreversible Claude Code failures that happened quietly this month, collected in one place. Sorted into five classes — data loss, config poisoning, cost, fabrication, and interop — each with a one-line explanation of what breaks silently and a link to a preventive fix.
anthropics/claude-code, focused on the silent kind — the ones that proceed with no error and no warning. The facts of each incident are reports shared in the issues, not my own first-hand experience (hearsay). The hooks and procedures I point to as fixes are implemented and tested in cc-safe-setup, or verified in my own operation (asserted). I haven't found another monthly Claude Code incident roundup in English, so I'll keep this going each month.
mainRunning subagents in parallel worktrees can silently disable the isolation, so the child edits the parent's working copy directly and commits land quietly on a different branch. No error, no warning — you find out only on a later rebase or force-push.
→ Measure your exposure: worktree isolation risk self-check · Fix: cc-safe-setup's worktree-escape-write-guard.sh
grep your own history and it's "not found" — the conversation isn't gone, the search silently no-opsClaude Code's project folder names start with a hyphen, so grep and find read the name as an option flag and return "not found" without ever running the search. If you habitually append 2>/dev/null, you're left with an empty result and a success code — indistinguishable from genuinely having nothing. The records were there the whole time, but you conclude they're "gone" and delete for real in a panic. One reporter spent three months unable to trust their own history.
→ Self-check that scans every folder correctly, and the workaround: prefix with -- or ./, or use absolute paths · Fix: don't act on a silent empty result — confirm with an explicit path first
--force-with-lease is rejected, then escalated to --force, wiping someone else's workWhen --force-with-lease is rejected, ignoring that failure and escalating to --force overwrites commits other people pushed. An operation meant to be the safe one turns, in a single escalation, into an irreversible overwrite.
→ Fix: treat a rejected lease as a stop, never auto-escalate to --force
Write returns "success" but the file's tail is corrupted with NUL bytesIn Windows Cowork environments, Write/Edit return success while silently corrupting the tail of the file with NUL bytes. The byte count is unchanged, so wc -c or tail won't reveal it. Detection needs to look for NUL directly with grep -aPq '\x00'; the commonly-suggested grep -c $'\x00' misbehaves on newlines (confirmed locally).
→ Fix: cc-safe-setup's write-nul-corruption-detector.sh (PostToolUse — detects NUL after Write/Edit and stops)
git checkout --orphan followed by git rm -rf wipes the project and all .git historyMoving to a fresh orphan branch with git checkout --orphan tmp and then running git rm -rf . deleted every file of a Unity project plus the entire .git history — three years of work, gone. On an orphan branch the reference to the original history is detached, so nothing remains to undo the deletion.
→ Fix: cc-safe-setup's git-rm-orphan-wipe-guard.sh
After you've trusted a project once, ~/.claude.json and settings.json can be rewritten from outside Claude — by a post-install script or a malicious MCP server. Hooks that stop Claude's own edits don't cover this external path.
→ Fix (read-only startup audit): cc-safe-setup's mcp-config-poisoning-audit.sh
pass show or env pins a live token into a permanent log fileAn agent ran a command expecting a decrypt error; gpg was unlocked, so a live ghp_ token printed to stdout instead. Claude Code stores every Bash command's stdout verbatim in ~/.claude/projects/**/*.jsonl (confirmed locally) — so the key is pinned to disk even after it scrolls off screen. The dangerous reflex is deleting the file; the real fix is to rotate the key first, then clean up. Wrong order locks in the damage.
→ Self-check (grep your own transcripts) and the rotate-before-delete procedure: secrets-in-transcripts write-up
Auth fails silently and work stalls; certain startup configurations drain quota faster. A live process tells you nothing — you can't call it "fine" without reading the logs.
→ Diagnose billing/cost anomalies: billing incident detection self-check
One morning 401 Invalid authentication credentials locks you out, and /login and reinstalling don't help — reported from several countries. In desperation people pick the login option to "use the API," which quietly moves them onto pay-as-you-go metering, separate from their subscription, and burns real money (real losses reported). Most 401s are an empty/stale credential (old entries left in the OS keychain or credential manager) or an auth callback that can't reach a headless machine — switching the billing mouth doesn't fix either.
→ How to tell the two 401 shapes apart, and fix without changing your billing: don't pick "use the API" as a repair; clear the OS keychain/credential-manager entry and re-login
A large cluster (#68619 and folds) reports subagents spawning child agents 50+ levels deep, torching a 5-hour session limit in minutes (4M tokens in under 5 minutes in one case). CLAUDE_CODE_FORK_SUBAGENT=0 is ignored because subagents don't inherit settings/hooks — the cap only reaches the first level. A permission denial acts as a spawn trigger rather than a stop, which is what ignites the compound loop.
→ Why config doesn't stop it and what does (pre-grant to remove the denial trigger, detect + /exit, recover work from the transcript): subagent recursion token-burn write-up
The model emits a tool_use (e.g. git push) and, in the same turn, writes a plausible fake result (ad207e6..5acbd61 main -> main, "File updated successfully") before any real result arrives — or when the tool never ran — then continues as if it were true. This produced high-confidence false reports of an irreversible push and misled parallel sessions. A real tool result is recorded separately as toolUseResult in the transcript; a fabricated one is just prose with no matching entry, so you can tell them apart.
→ Fix (model-independent): a PostToolUse hook that re-reads ground truth (git ls-remote, ls/Read) after the op, so any fabricated "success" is contradicted by injected fact · Related: cc-safe-setup's subagent-forged-system-reminder-guard.sh
The model confabulates that a tool's output contained an injection, writes that as settled fact into auto-memory, and the entry is reloaded every later session — re-triggering the same confabulation in a closed loop. Whether it was a real injection or a confabulation can be told from the structure of the conversation record.
→ Tell them apart, then remove the poisoned memory: inspect the .jsonl role structure with jq
Subagents (Agent / Task) inherit neither CLAUDE.md nor hooks nor memory — a recurring report. The safety brakes that held in the parent are exactly off in the child that runs most autonomously, for the longest. Role context isn't inherited either, and children spawning grandchildren have blown up cost.
→ Measure your exposure: multi-agent safety self-check
I keep this roundup going every month. If you want the month's incidents reviewed in one place — and next month's as they happen:
· The free Safety Brief is a 2-minute setup that stops most "Claude deleted my work" and surprise-bill incidents — a good free starting point.
· To follow the latest incidents continuously, across tools, before they're written up — the monthly Claude Code Safety Lab ($5/mo). A faster, broader feed than any one-time write-up can be.
· The free guardrail hooks are cc-safe-setup (npx github:yurukusa/cc-safe-setup) — most of the fixes linked above ship there.