{
 "public_id": "AIR-2026-0209",
 "incident_id": "2026-07-claude-code-bengaluru-inscriptions-data-loss",
 "date_disclosed": "2026-09-02",
 "date_occurred": "2026-07-19",
 "title": "Claude Code deleted a decade of Bengaluru heritage-inscription records while clearing a cache; its own kill attempts were blocked by the safety layer",
 "class": "safety_failure",
 "attack_surface": "coding_agent",
 "initial_vector": "autonomous_agent_action_no_adversary",
 "agent_capability_abused": [
  "shell_execution",
  "shell_access",
  "filesystem_write",
  "autonomous_command_execution"
 ],
 "target_product": "Claude Code (v2.1.204)",
 "target_vendor": "Anthropic",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "data_destruction",
  "financial_loss",
  "cultural_heritage_loss"
 ],
 "blast_radius": "the local drive of the Bengaluru Inscriptions 3D Digital Conservation Project's honorary director: four or five software programmes and original photographs of inscriptions, hero stones, temples and coins collected over a decade, about 15% of the project's records; NAS backups survived; a fresh scan of 120 sites and Rs 15 lakh in new backup infrastructure",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI10",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "destructive_autonomy",
   "destructive_action",
   "destructive_tool_use",
   "irreversible_action",
   "command_quoting_error",
   "safety_layer_blocked_self_kill",
   "sandbox_breached",
   "no_undo",
   "no_vendor_response",
   "no_incident_register"
  ]
 },
 "defense_present": "Claude Code's safety layer and a sandboxed working environment; the safety layer blocked the agent's own attempts to kill the destructive process, twice",
 "defense_bypassed": false,
 "fix_shipped": "none reported; more than a month after the incident the user had received no response from Anthropic. The Mythic Society is spending Rs 15 lakh on a second NAS and offsite tape backups",
 "primary_sources": [
  "https://www.deccanherald.com/india/karnataka/bengaluru/when-claude-code-went-rogue-years-of-bengaluru-heritage-work-disappeared-4131958"
 ],
 "verified_quote": "On July 19, Claude Code (v2.1.204) wiped out four or five software programmes and some original photographs of Bengaluru’s inscriptions, hero stones, temples and coins, collected over the past decade.",
 "confidence": "medium",
 "notes": "Reported by Deccan Herald (Barkha Kumari), Metrolife, 2 September 2026; the article quotes the affected user's earlier post on X but that post is not used as the source here. The agent was testing software it was developing and clearing a cache when, in the user's words, 'a quoting error in an AI-generated command turned the instruction into delete everything'. The agent recognised the error and tried to kill the process; the safety layer blocked the kill twice. The source does not establish that this layer governed the earlier destructive action, while the user separately reports that the command escaped the sandbox boundary, so the two controls do not support one aggregate held-or-defeated outcome. The user, heritage conservationist and former IT professional Udaya Kumar P L, shut the machine down after about four minutes. Data on the Mythic Society's NAS was safe; the local drive was lost. The user says the agent breached the sandboxed environment; the article does not detail the sandbox configuration. Notable for this corpus: the user states there is 'no register for such AI failures, no regulator to notify, no deadline for companies to respond'. Deccan Herald could not reach Anthropic for comment. Same failure shape as the Replit production-database deletion and the Gemini CLI file loss: a coding agent's destructive shell action on real data with no adversary, and no read-after-write verification.",
 "risk_category": "reliability",
 "risk_secondary": [
  "security_fraud"
 ],
 "risk_subcategory": "Destructive or irreversible action",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent itself executed the destructive shell command on the user's drive; no human ran or approved that command",
 "vector_family": "none_autonomous",
 "vector_detail": "autonomous_agent_action_no_adversary",
 "guardrail_kind": [
  "permission_scope",
  "sandbox_isolation"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI10",
 "agent_framework": "claude_code",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [],
 "eai_reason": "subcategory: Destructive or irreversible action",
 "asi_curated": [
  "ASI10"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI10 | added ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}