User reported a Claude Code session deleted a macOS home folder
Review RAT-071 · Catalogue RAT-071
Original macOS user report says keychain, SSH keys, and home-directory data disappeared after ordinary folder-access prompts. Its local transcripts contain no Bash calls, and the reporter explicitly cannot identify the command or what was approved. Causation, organizational victim, and independent corroboration are unresolved.
Reviewed: · Rule: roguewatch-organizational-harm-v1
Dates and discovery
- Incident date
- Not disclosed
- Added to research / record
- Posted to RogueWatch
- No linked public incident
- First observed
- 2026-10-30T13:13:36.456152Z UTC
- Discovery channel
- User-supplied comparison audit
- Discovery source
- https://rogueaitracker.com/incidents/claude-code-macos-home-deletion-report/
When to reconsider
New first-party traces or substantive corroboration from another publisher clarifies the identified authorization, organizational-victim, chronology, or outcome gap.
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- Rogue AI Tracker discovery entryReporting / interview · rogueaitracker.com
- github.comOriginal account · github.com
Decision history
- · Case-by-case comparison audit
RAT-071: awaiting-evidence. Original macOS user report says keychain, SSH keys, and home-directory data disappeared after ordinary folder-access prompts. Its local transcripts contain no Bash calls, and the reporter explicitly cannot identify the command or what was approved. Causation, organizational victim, and independent corroboration are unresolved. Source checks: read: https://github.com/anthropics/claude-code/issues/93408. Original macOS user report says keychain, SSH keys, and home-directory data disappeared after ordinary folder-access prompts. Its local transcripts contain no Bash calls, and the reporter explicitly cannot identify the command or what was approved. Causation, organizational victim, and independent corroboration are unresolved.
Evidence source - · Retained review-queue assessment
Original macOS user report says keychain, SSH keys, and home-directory data disappeared after ordinary folder-access prompts. Its local transcripts contain no Bash calls, and the reporter explicitly cannot identify the command or what was approved. Causation, organizational victim, and independent corroboration are unresolved.
Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.