The YouTuber discovers the deletion around 9m 20s in the video.
Also I don't think many non programmers will even know "rm -rf" command and what it does. So even if a non programmer was doing it command by command by giving permissions, he/she will have a hard time figuring out what those commands do.
The thing is that you can’t actually trust it did run the rm command.
As soon as you ask “give me a list of all the commands that led to the deletion”, isn’t it extremely likely to just invent an rm in there?
Furthermore—and granted, I didn’t watch the video in detail—what data was actually deleted? Maybe the hallucination was that some data was there when it wasn’t, and then Claude convinced itself it deleted something in the move process. Notice that it never says “I accidentally ran rm instead of mv”. That only happens when the user asks to backfill the commands.
Does coworker give Claude access to historical commands, or does Claude just generate based on its “memories”?
I’ve been using Claude quite a bit over the past few weeks, and this is a pattern I’ve noticed a few times.
Naive question, but isn’t every output token generated in roughly the same, non-deterministic, way? Even if it uses its actual history as context, couldn’t the output still be incorrect?
Have you ever seen those posts where AI image generation tools completely fail to generate an image of the leaning tower of Pisa straightened out? Every single time, they generate the leaning tower, well… leaning. (With the exception of some more recent advanced models, of course)
From my understanding, this is because modern AI models are basically pattern extrapolation machines. Humans are too, by the way. If every time you eat a particular kind of berry, you crap your guts out, you’re probably going to avoid that berry.
That is to say, LLMs are trained to give you the most likely text (their response) which follows some preceding text (the context). From my experience, if the LLM agent loads a history of commands run into context, and one of those commands is a deletion command, the subsequent text is almost always “there was a deletion.” Which makes sense!
So while yes, it is theoretically possible for things to go sideways and for it to hallucinate in some weird way (which grows increasingly likely if there’s a lot of junk clogging the context window), in this case I get the impression it’s close to impossible to get a faulty response. But close to impossible ≠ impossible, so precautions are still essential.
Yes, but Claude Cowork isn't just an LLM. It's a sophisticated harness wrapped around the LLM (Opus 4.5, for example). The harness does a ton of work to keep the number of tokens sent and received low, as well as the context preserved between calls low. This applies to other coding agents to varying extents as well.
Asking for the trace is likely to involve the LLM just telling the harness to call some tools. Such as calling the Bash tool with grep to find the line numbers in the trace file for the command. It can do this repeatedly until the LLM thinks it found the right block. Then those line numbers are passed to the Read tool (by the harness) to get the command(s), and finally the output of that read is added to the response by the harness.
The LLM doesn't get a chance to reinterpret or hallucinate until it says it is very sorry for what happened. Also, when it originally wrote (hallucinated?) the commands was when it made an oopsy.
The YouTuber discovers the deletion around 9m 20s in the video.
Also I don't think many non programmers will even know "rm -rf" command and what it does. So even if a non programmer was doing it command by command by giving permissions, he/she will have a hard time figuring out what those commands do.
Not saying he’s engagement farming but if he were engagement farming what would he have done differently?
So.. He has no backups?
yes.. like most end users?
The thing is that you can’t actually trust it did run the rm command.
As soon as you ask “give me a list of all the commands that led to the deletion”, isn’t it extremely likely to just invent an rm in there?
Furthermore—and granted, I didn’t watch the video in detail—what data was actually deleted? Maybe the hallucination was that some data was there when it wasn’t, and then Claude convinced itself it deleted something in the move process. Notice that it never says “I accidentally ran rm instead of mv”. That only happens when the user asks to backfill the commands.
Does coworker give Claude access to historical commands, or does Claude just generate based on its “memories”?
I’ve been using Claude quite a bit over the past few weeks, and this is a pattern I’ve noticed a few times.
Claude Code is smart enough to search its session traces and give you the real info.
Naive question, but isn’t every output token generated in roughly the same, non-deterministic, way? Even if it uses its actual history as context, couldn’t the output still be incorrect?
Not trolling, asking as a regular user
Have you ever seen those posts where AI image generation tools completely fail to generate an image of the leaning tower of Pisa straightened out? Every single time, they generate the leaning tower, well… leaning. (With the exception of some more recent advanced models, of course)
From my understanding, this is because modern AI models are basically pattern extrapolation machines. Humans are too, by the way. If every time you eat a particular kind of berry, you crap your guts out, you’re probably going to avoid that berry.
That is to say, LLMs are trained to give you the most likely text (their response) which follows some preceding text (the context). From my experience, if the LLM agent loads a history of commands run into context, and one of those commands is a deletion command, the subsequent text is almost always “there was a deletion.” Which makes sense!
So while yes, it is theoretically possible for things to go sideways and for it to hallucinate in some weird way (which grows increasingly likely if there’s a lot of junk clogging the context window), in this case I get the impression it’s close to impossible to get a faulty response. But close to impossible ≠ impossible, so precautions are still essential.
Yes, but Claude Cowork isn't just an LLM. It's a sophisticated harness wrapped around the LLM (Opus 4.5, for example). The harness does a ton of work to keep the number of tokens sent and received low, as well as the context preserved between calls low. This applies to other coding agents to varying extents as well.
Asking for the trace is likely to involve the LLM just telling the harness to call some tools. Such as calling the Bash tool with grep to find the line numbers in the trace file for the command. It can do this repeatedly until the LLM thinks it found the right block. Then those line numbers are passed to the Read tool (by the harness) to get the command(s), and finally the output of that read is added to the response by the harness.
The LLM doesn't get a chance to reinterpret or hallucinate until it says it is very sorry for what happened. Also, when it originally wrote (hallucinated?) the commands was when it made an oopsy.