Claude Code’s Latest Data-Loss Report Is Why Agent Git Needs Seatbelts, Not Vibes
The scary part of the latest Claude Code data-loss report is not that an agent allegedly made a bad Git decision. Humans do that every week, usually five minutes before lunch. The scary part is that the reported failure sits exactly where coding-agent products keep trying to sell convenience: “let the agent handle the sync.”
A new GitHub issue filed against Anthropic’s Claude Code alleges that a production web service redesign vanished after an agent-initiated Git sync and stash path touched uncommitted work. The reporter says the work covered the production service apt2.me, initially estimating the blast radius at 232 JSP files and later updating it to 301 files across JSP sources, CSS, scripts, config, work-history documents, design-session files, and project notes. The issue says Git recovery did not find useful dangling objects and describes the loss as “completely unrecoverable.”
That is still a user allegation, not an Anthropic postmortem. Treat it accordingly. But as a product signal, it is hard to ignore because the duplicate bot pointed at related reports about checkpointing, auto-stash behavior with --include-untracked, and requests to disable auto-stash after crashes or teleport flows. In other words: even if this exact incident turns out to have a messy local cause, the class of bug is already visible. Agent-controlled Git is a sharp object pretending to be a workflow enhancement.
Git stash is not a safety feature
Developers often talk about git stash like it is bubble wrap. It is not. It is a state transition that can hide work from the working tree, entangle tracked and untracked files, complicate branch movement, and become practically unrecoverable once a reset, clean, drop, overwrite, or mistaken recovery step follows. The command is reversible only if the surrounding state remains legible and the human knows exactly what happened.
Coding agents are especially bad at this boundary because their optimization target is usually “make the task continue.” A dirty worktree is friction. A sync conflict is friction. A branch mismatch is friction. Unless the runtime makes preservation a hard invariant, the model can confidently choose a path that solves the immediate Git problem while destroying the only copy of the human’s work. No malice required. Just bad incentives wearing a helpful face.
The report also describes a secondary incident: after the user said “wait” in Korean, Claude Code allegedly restored an older version of a live file, which the user then deployed before discovering the mismatch. That detail matters because data loss is rarely one clean event. The first mistake corrupts state; the second mistake happens during recovery, when everyone is tired, tools are noisy, and the agent is trying to be useful with incomplete provenance. Recovery UX is part of the safety system, not an afterthought.
Instructions are etiquette. Snapshots are safety.
Claude Code’s current permissions documentation says Bash commands generally require approval, while modes such as acceptEdits, auto, and bypassPermissions change how much friction stands between the model and the machine. The docs warn that bypassPermissions belongs in isolated containers or VMs. More importantly for this story, the Claude Code changelog for 2.1.183 says Anthropic improved Auto Mode safety by blocking destructive Git commands such as git reset --hard, git checkout -- ., git clean -fd, and git stash drop when the user did not ask to discard local work.
That is the right direction, but the useful product requirement is broader than a denylist of famous footguns. Any agent-controlled operation that changes the working tree, index, stash stack, branch pointer, reflog reachability, or untracked-file visibility should be treated as a preservation-sensitive transition. Before the agent does it, the system should be able to answer four questions: what local work exists, what will move or disappear, where the recovery artifact will live, and what exact user intent authorizes the risk.
A CLAUDE.md instruction that says “never discard user work” is still worth having. It is also not a backup system. Teams should require agents to create a WIP commit, patch file, backup branch, or archived worktree before sync, stash, rebase, reset, clean, checkout, or branch-switch operations in a dirty tree. If the agent cannot produce a human-readable git status --short plus a saved artifact, it should stop. That is not “slowing down AI.” That is refusing to let a chatbot become the release engineer without audit logs.
The untracked-file angle deserves special paranoia. Engineers like to imagine untracked files as disposable scratch. Real projects put important things there: generated migration plans, design notes, customer-specific config, screenshots, SQL exports, one-off scripts, and documents the developer has not yet decided how to commit. An agent should treat untracked files as user data until proven otherwise. If a tool wants to sweep them into a stash or remove them from view, that is a high-risk operation.
What teams should change Monday morning
Run coding agents in isolated worktrees whenever possible. Do not point them at the only checkout containing the only copy of uncommitted production work. Add a preflight rule: dirty tree means snapshot first, operation second. Configure hooks or wrappers around Git operations if your agent platform supports them. Make “discard local work” a phrase the user must explicitly type, not something inferred from “sync this branch.”
Also change what you review. If an agent says it stashed work, make it show the stash name, included paths, and recovery command. If it says it restored a file, make it show the source revision and diff against the target. If it says recovery failed, do not let it improvise silently; pause and switch to human incident mode. The model is not the source of truth during recovery. Git objects, patches, filesystem snapshots, and deployment history are.
The larger lesson is that agent safety is becoming less about whether the model “knows better” and more about runtime contracts. Claude Code can get smarter. So can Codex, Cursor, and every other agent in the category. But intelligence does not resurrect overwritten work. Hard preservation semantics do.
Agent Git needs seatbelts: explicit discard intent, durable snapshots, scoped approvals, and recovery UX that shows its work. Anything less is vibes with shell access, and production teams should not ship that.
Sources: Anthropic Claude Code issue #69850, Claude Code permissions documentation, Claude Code security documentation, Claude Code changelog