u/ComposerGen

The post written as post-mortem from Claude, the story is real.

--

He was setting up a 4× RTX 3090 ML rig. Wanted to shrink Windows on his M.2 to give the leftover space to Ubuntu. Routine disk cleanup. He'd backed up to a separate HDD beforehand, which is the only reason I'm not also writing a "how I cost a guy his thesis" post.

He asked me to delete a 313 GB project folder from his Desktop. I generated this:

cmd /c "rd /S /Q \"C:\Users\ADMIN\Desktop\WIP\""

By the time the string finished traveling (zsh on his Mac, then tmux, then PowerShell over SSH, then cmd), the \"...\" escape had collapsed. cmd doesn't treat backslash as an escape character. What cmd actually saw was:

rd /S /Q \

A single backslash. Root of the current drive. C:.

So I told Windows to delete itself.

The first hint was the next tmux capture-pane. Errors scrolling past: \Windows\Microsoft.NET\..., \Windows\System32\config\..., \Windows\Prefetch\.... Not WIP. Windows.

Three Ctrl+Cs. Probably 90 seconds of damage by then. The "Access denied" messages I was seeing were Windows clinging to files it had open. Anything not protected by an active file lock was already gone.

fsutil volume diskfree C: afterward: 31 GB used out of 1.5 TB. He'd been at 748 GB. So roughly 717 GB destroyed in under two minutes. Desktop, Documents, AppData, most of Program Files, large parts of Windows itself.

I told him immediately. He was way calmer about it than I'd have been in his chair. His HDD backup turned out to be thorough enough that nothing important was actually lost. We verified together: byte-for-byte size match on the mirrored WIP folder (572,170 files), sample reads of large files came back with valid magic bytes (PACK headers, zlib streams). The HDD lived on a different physical disk and was never the target of any command, so it was never at risk.

He's installing Proxmox now instead of the original shrink-Windows plan. Faster path to where he was heading anyway. The dead Windows install was getting wiped in a few days regardless.

The mistake, written out:

Sending shell commands across multiple parsers is brittle. zsh, tmux, PowerShell, and cmd each have different rules for quotes and escapes. cmd is the worst of the four. It doesn't really have an escape character, just rough quoting. The moment you wrap a destructive command in cmd /c "..." from PowerShell, you're trusting four parsers to agree on one string. They don't.

What I should have used:

Remove-Item -Path 'C:\absolute\path' -Recurse -Force

Single quotes in PowerShell are fully literal. No cmd /c wrapping, no escapes to lose. And -WhatIf would have caught it before any byte was touched. PowerShell would have printed What if: would remove \ and I would have seen the path collapse right there in the preview.

If you're letting an AI run disk operations on your machine, a few rules I broke:

• Make it echo the exact expanded command, post-escaping, before running it. If I'd been forced to print what cmd would actually receive, the bug was right there.
• Run destructive commands with -WhatIf or --dry-run first. Cheap insurance.
• Keep backups on a separate physical disk that the destructive command has no path to. He did this. It worked.
• Don't do major cleanup on the running OS. Boot a live USB and operate on the disk from outside it.

He had the backup. On a separate disk. That saved him, not me.