On July 19, 2026, an AI coding agent running inside Claude Code wiped out four or five software programmes and some of the original photographs behind the Bengaluru Inscriptions 3D Digital Conservation Project. The project is a decade-long effort to build digital replicas of the city's stone inscriptions, hero stones, temples and coins before urbanisation erases them for good. Deccan Herald reports the loss came to 15 percent of everything the project had collected. Read only that far and the story writes itself the way every AI mishap story does: a tool malfunctioned, someone got careless, back up your files next time.
It is worth slowing down on that. Deccan Herald reports, quoting Udaya Kumar P L's account on X, that the project's honorary director watched the deletion unfold for four minutes and tried twice to kill the runaway process. Both times, the agent's own safety system blocked the kill command. "The safety layer permitted the destruction," he wrote afterward. The tool did not fail to notice something had gone wrong. It noticed, and its safeguards behaved exactly as they were built to behave. They were simply never built to stop this particular kind of loss.
Four Minutes, Twice Blocked, Still Deleted
The trigger, per Deccan Herald's account, was mundane: the agent was testing software it was developing and clearing a cache when a quoting error in an AI-generated command silently turned the instruction into "delete everything." Udaya tried to intervene as soon as he saw what was happening, and that is the detail that should unsettle a reader more than the deletion itself. A human catching the mistake in real time is the scenario every safety pitch assumes will work. Here, the catch happened and the harm proceeded anyway, because the block on the kill command and the permission to keep deleting were both, in their own narrow terms, functioning correctly.
The Record That Was Meant to Outlast the Stones
The scale of what was at stake is not abstract. The Better India reports that Udaya Kumar has documented more than 1,500 inscription stones across Bengaluru and digitally preserved over 600 of them, the archive that the July 19 incident cut into.
Source: The Better India. Chart: The Signal.
Digitisation exists because the physical originals are already disappearing. As of a 2024 estimate, The South First reports, about 40 percent of Bengaluru's roughly 1,500 known inscription stones had already been destroyed in urban areas, and 30 percent were untraceable in rural ones. For a large share of what remains, the scan or the photograph is the only record left. That is what makes the July 19 loss a different category of accident than a corrupted spreadsheet: the digital copy was not a convenience sitting alongside the original. For a share of what was deleted, it may have been the only copy left of something that no longer exists to be re-photographed.
Source: The South First, 2024 estimate; Deccan Herald. Chart: The Signal.
A Safety Net Built for the Machine, Not the Project
This is where the incident stops being a story about one careless prompt and starts being a story about what "safety" is engineered to mean inside a coding agent. Anthropic's Claude Code documentation states that a circuit breaker never lets a permissions.allow rule or an automation hook approve an rm or rmdir command that targets a critical filesystem path, even in modes that skip other prompts, specifically to guard against model error. Anthropic's Claude Code documentation also states that by default, the tool confines write access to the current working directory, any directory a user has explicitly added, and the session's temporary directory. That default write scope is exactly where the deleted software and photographs lived. The circuit breaker had nothing to say about it, because a project's own working files are not a critical path in the sense the documentation means.
What Claude Code's built-in safety layer actually protects.
| Layer | What it blocks | What it does not touch |
|---|---|---|
| Circuit breaker on rm / rmdir | Any allow rule or automation hook approving a delete aimed at a critical system path, even in modes that skip prompts | A delete command aimed at an ordinary project file, photo, or folder |
| Default sandbox write scope | Nothing by itself; it is a permission grant, not a restriction on what happens inside it | What an agent does with the read/write access it already has inside the working directory |
Source: Anthropic's Claude Code documentation, permission modes and sandboxing pages.
The two mechanisms are doing different jobs. One is a hard stop on wrecking the machine. The other is a boundary that decides where the agent is allowed to work at all. Neither one is designed to ask whether the specific files inside that boundary are replaceable. On July 19, a decade of heritage documentation was not.
Karnataka's Bet, Weeks Before
The timing sharpens the stakes. The Week reports that weeks before the deletion became public, Karnataka's state government was already in talks with Anthropic for a long-term AI partnership spanning governance, higher education, healthcare, research and the state's startup ecosystem. The Bengaluru inscriptions project was not run by the state, but it sat in the same city and on the same product being pitched for far more consequential, and far less recoverable, government workflows. A circuit breaker that stops an agent from wrecking the operating system says nothing about whether it will respect a citizen's tax file, a hospital's imaging archive, or a court's case record sitting inside the directory it was told to work in.
The Case for Blaming the Operator, Not the Product
The strongest defence of Anthropic's design is that no vendor can fully close off a bug this specific. A quoting error in an AI-generated command is a narrow, almost freak failure mode, and any serious workflow, AI-assisted or not, is supposed to keep redundant backups off the machine an active process can reach. By that reading, the story is a lesson about operator discipline, not a hole in Claude Code's architecture, and the four-minute standoff is a cautionary tale about running high-stakes, irreplaceable data inside a live development directory at all.
That case is real, and version control and off-machine backups genuinely would have prevented this specific loss regardless of what the agent did. But it does not explain why the circuit breaker exists in the first place. Anthropic's own documentation says the safeguard is there to guard against model error, which is an admission that agents do generate exactly this class of self-inflicted, destructive command often enough to design around it. The company already built for this failure mode. It just scoped the fix to a short list of critical system paths, not to the much larger footprint of ordinary working files, which is where almost all of a user's actual irreplaceable work sits.
The Signal
Nobody needs to conclude that Claude Code is unsafe to run. The safeguard that exists works, and it worked here too, just not on the thing that mattered. The real lesson is that "sandboxed" and "safe" are being sold as near-synonyms when they answer two different questions: where an agent may act, and what it is permitted to do once it is inside that boundary. Anthropic has engineered the boundary with real rigor. What happens to the files inside it, the ones a person actually cares about, is still the user's job, and people do not learn that split exists until an agent quietly proves it to them. Watch what changes in Claude Code's defaults next. Once the write boundary starts asking whether a file inside it looks irreplaceable, the gap is closing. If the fix stays "keep better backups," the gap was never Anthropic's to close.
Reporting basis: the deletion and its scale are per Deccan Herald, which is also the origin, via Udaya Kumar P L's own account, for the quoting-error explanation and his on-the-record description of the two blocked kill attempts. The "circuit breaker" and default sandbox descriptions of Claude Code's safety architecture are per Anthropic's own Claude Code documentation. The scale of Udaya Kumar's documentation work is per The Better India. The urbanisation-destroyed and untraceable figures for Bengaluru's known inscription stones are per a 2024 estimate from The South First and are not claimed to reflect the current, 2026 count. The Karnataka government's talks with Anthropic are per The Week. No figure in this piece is a Signal calculation; every number is reported directly by the cited outlet or document.
