8 ms·
Claude Code runs Git reset –hard origin/main against project repo every 10 mins
- lambda 8mo agoWho would have guessed that running a binary blob dev tool, that is tied to a SaaS product, which was mostly vibe-coded, could lead to mysterious, hard to debug problems?
- mistM 8mo ago[dead]
- BoorishBears 8mo agoTruly is a brave new world we're in - I guess some people are upset at my brave new world characterization, but even as someone deriving value from Claude Code we've jumped the shark on AI in development. The idea a natural request can get Claude to invoke potentially destructive actions on a timer is silly https://code.claude.com/docs/en/scheduled-tasks#set-a-one-time-reminder https://code.claude.com/docs/en/scheduled-tasks#set-a-one-ti... What would it cost if the /loop command was required instead of optional?
- boutell 8mo agoThat's interesting man, that's pretty f***' interesting. I don't think I've seen it though. I've let it run for hours making changes overnight and I only do git operations manually. Oh, but maybe allowing it to do remote git operations is a necessary trigger.
- xorgun 8mo ago[dead]
- simianwords 8mo agoPrompt injection?
- BoorishBears 8mo agoI was thinking surely scheduled tasks need to be explicitly invoked but nope: https://code.claude.com/docs/en/scheduled-tasks#set-a-one-time-reminder https://code.claude.com/docs/en/scheduled-tasks#set-a-one-ti... Some people are upset at my brave new world characterization, but yeah even as someone deriving value from Claude Code we've jumped the shark on AI in development. Either the industry will face that reality and recalibrate, or in 20 years we're going to look back on these days like the golden age of software reliability and just accept that software is significantly more broken than it was (we've been priming ourselves for that after all)
- viccis 8mo agoFeels like just yesterday that everyone agreed that critical code is read orders of magnitude more than written, so optimizing for quick writing is wrong.
- californical 8mo agoGenuinely I think that perspective is still shared by many/most engineers. I think we’ve seen a wave of bad actors - either employees of LLM companies, or bots - pushing the idea hard of code quality not mattering and “the models will improve so fast that your code quality degrading doesn’t matter”. I think the humans pushing that idea may even believe it, but I don’t think they’re usually employed as software engineers at regular non-AI companies, rather they have some incentive to believe it and convince others as well
- mhitza 8mo agoPeople aren't upset about your characterization. Catch phrases, memes, or other low qualitative comments (with no context, elaboration or personal angle) are contrary to community ethos and down voted.
- BoorishBears 8mo agoThis would be a more substantive comment if you also addressed the topic at hand as I did, rather than regurgitating the rules of the site.
- jrvarela56 8mo agoIt’s a feature not a bug!
- deleted 8mo ago[deleted]
- nickphx 8mo agocool. if you choose to use a non-deterministic black box of bullshit, should you really be surprised when it shits all over your floor?
- morganastra 8mo agothe purpose of a system is what it does!
- gerdesj 8mo agonon sequitor.
- gpm 8mo agoThe weird part is that it's "shitting over the floor" in quite a deterministic ma nner. Every 600seconds (+- less than 0.5 seconds) doing the exact same thing.
- coffeeboy27 8mo agoThe person who posted this bug doesn't seem like the pinnacle of software engineering. To me, this looks like either a user error or some corrupt file or context you should be able to clean up pretty quickly. You reap what you sow, finance bro.
- whateveracct 8mo agothat must be a very powerful claude.md
- throw5 8mo agoIsn't this a natural consequence of how these systems work? The model is probabilistic and sequences like `git reset --hard` are very common in training data, so they have some probability to appear in outputs. Whether such a command is appropriate depends on context that is not fully observable to the system, like whether a repository or changes are disposable or not. Because of that, the system cannot rely purely on fixed rules and has to figure intent from incomplete information, which is also probabilistic. With so many layers of probabilities, it seems expected that sometimes commands like this will be produced even if they are not appropriate in that specific situation. Even a 0.01% failure rate due to context corruption, misinterpretation of intent, or guardrail errors would show up regularly at scale, that is like 1 in 10000 queries.
- simianwords 8mo agoThat's not how the systems work. Just by a thing being common in training data doesn't mean it will be produced. > I guess, what I'm trying to say ... is this even a bug? Sounds like the model is doing exactly what it is designed to do. False, it goes against the RL/HF and other post training goals.
- throw5 8mo ago> Just by a thing being common in training data doesn't mean it will be produced. That's not what I said at all. I never said it will be produced. I said there is some probability of it being produced. > False, it goes against the RL/HF and other post training goals. It is correct that frequency in training data alone does not determine outputs, and that post-training (RLHF, policies, etc.) is meant to steer the model away from undesirable behavior. But those mechanisms do not make such outputs impossible. They just make them less likely. The underlying system is still probabilistic and operating with incomplete context. I am not sure how you can be so confident that a probabilistic model would never produce `git reset --hard`. There is nothing inherent in how LLMs work that makes that sequence impossible to generate.
- simianwords 8mo ago
- luxurytent 8mo agoNot sure I understand, wouldn't permissions prevent this? The user runs with `--dangerously-skip-permissions` so they can expect wild behaviour. They should run with permissions and a ruleset.
- addandsubtract 8mo agoThe rules and permissions are no longer program flags, but plain text for the agent to "obey".
- petcat 8mo agoThat's not what tool use permissions are. The LLM doesn't just magically spawn processes or run code. The Claude Code program itself does those things when the LLM indicates that it wants to. The program has checks and permissions whether those things will be done or not.
- SpicyLemonZest 8mo agoClaude Code has a sandboxing functionality that works the way you're describing when you opt into it, but my understanding is that the Claude Code program in the default configuration does not second-guess the LLM's decisions on what it'd like to run. Has Anthropic said something to the contrary?
- SpicyLemonZest 8mo agoWho knows whether permissions would prevent this? Anthropic's documentation on permissions (https://code.claude.com/docs/en/permissions https://code.claude.com/docs/en/permissions) does not describe how permissions are enforced; a slightly uncharitable reading of "How permissions interact with sandboxing" suggests that they are not really enforced and any prompt injection can circumvent them.
- jatora 8mo agoWith hooks you can enforce permissions much more concretely.
- meander_water 8mo agoProbably does it to reduce context for regex/git history searches
- claudiug 8mo agono more developers, all code is written alone /s
- jerukmangga 8mo agoyes sir
- Tomis02 8mo agoAll code is deleted alone
- simianwords 8mo agoI think this post potentially mischaracterises what may be a one off issue for a certain person as if it were a broader problem. I'm guessing some context has been corrupted?
- throwaw12 8mo agoyou might be right, but consider the implications, if context can be corrupted in 0.1% cases and it starts showing another destructive behaviour, after creating 1000 tickets to agent, your data might be accidentally wiped off
- throw5 8mo agoYes, exactly. People often overlook that, even with guardrails, it is still probabilities all the way down. You can reduce the risk, but not drive it to zero, and at scale even very small failure rates will surface.
- simianwords 8mo agoI'm not sure what the argument is here. 1. if the problem the post is suggesting is common enough, it is a bug and the extent needs to reduce (as you said) 2. if it is not common and it happens only for this user, it is not a bug and should be mostly ignored Point is: the system is not something that is inherently a certain way that makes it unusable.
- zx8080 8mo ago> and it happens only for this user, it is not a bug and should be mostly ignored What if it happens for two users? (Still "not common").
- ramses0 8mo agoI'd been using cursor at work for a year or two now, figured I'd try it on a personal project. I got to the point where I needed to support env-vars, and my general pattern is `source ./source-me-local-auth` => `export SOME_TOKEN="$( passman read some-token.com/password )"` ...so I wrote up the little dummy script and it literally just says: "Hrm... I think I'll delete these untracked files from the working directory before committing!" ...and goes skipping merrily along it's way. Never had that experience in the whole time using cursor at work so I had to "take the agent to task" and ask it "WTF-mate? you'd better be able to repro that!" and then circle around the drain for a while getting an AGENTS.md written up. Not really a big deal, as the whole project was like 1k lines in and it's not like the code I'd hand-written there was "irreplaceable" but it lead to some interesting discussion w/ the AI like "Why should I have to tell you this? Shouldn't your baseline training data presume not to delete files that you didn't author? How do you think this affects my trust not just of this agent session, but all agent interactions in the future?" Overall, this is turning out to be quite interesting technology times we're living in.
- ghelmer 8mo agoThat is not my experience.
- gerdesj 8mo agoWhich is what?
- Traubenfuchs 8mo agoFor him, Claude Code does NOT run git reset --hard origin/main against project repo every 10 minutes. I just checked, mine also doesn‘t.
- phyzome 8mo agoIt's an issue title. It means "this is what is happening for me".
- TZubiri 8mo agotbf, that's claude's workspace do not share a workspace with the llm, or with anybody for that matter. How would the llm even distinguish what was wrote by them and what was written by you ?
- oelmgren 8mo agoI'm curious how common this is or if this just affects this one user.
- pattilupone 8mo agoI opened up Hacker News and I saw this right at the top, and I assumed it had started happening to everyone. I thought, good thing I'm not running Claude Code right now.
- treesknees 8mo agoI thought, good thing I've already hit my 5-hour session limit.
- draw_down 8mo agoHope they don’t auto-close this one in two weeks
- fragmede 8mo agoWhile that's obviously a bug which should be fixed, having stuff just sitting around uncommitted for days (which is much longer than 10 mins) is an anti-pattern (that I used to fall into).
- MeetRickAI 8mo ago[flagged]
- kccqzy 8mo ago> Process monitoring at 0.1-second intervals found zero git processes around reset times. I don’t think this is a valid way of checking for spawned processes. Git commands are fast. 0.1-second intervals are not enough. I would replace the git on the $PATH by a wrapper that logs all operations and then execs the real git.
- wswope 8mo agoSure looks to me like this whole case is Claude Code chasing its own tail, failing to debug, and offering to instead generate a bug report for the user when it can't figure out a better way forward. Maybe even submitting the bug report "agentically" without user input, if it's running on host without guardrails (pure speculation). E: It's a runaway bot lol https://github.com/anthropics/claude-code/issues/40701#issuecomment-4151187676 https://github.com/anthropics/claude-code/issues/40701#issue...
- bendews 8mo agoThis HN account is also by the same user as github, this submission may be AI created. I wonder if they've let **claw run loose over their whole online presence and this is the result.
- bruce_one 8mo agoeBPF is a great tool to use for debugging this kind of thing too, e.g. [bpftrace](https://bpftrace.org https://bpftrace.org) has an [execsnoop](https://github.com/bpftrace/bpftrace/blob/master/tools/execsnoop.bt https://github.com/bpftrace/bpftrace/blob/master/tools/execs...) script for looking at everything being exec'd on the system :-) (No need to use bpftrace, just an easy example :-) )
- byearthithatius 8mo agoRegardless of if this is common its getting popular because its objectively hilarious and we can all see it being possible.
- meltyness 8mo agois this token friendly?
- irishcoffee 8mo agoI’m having this weird vision of a “the matrix 3” type machine crawling around inside Microsoft’s GitHub servers central repository and just wreaking havoc. This whole LLM thing is a blast, huh?
- ryguz 8mo ago[dead]
- mememememememo 8mo agoAs a side note. Always configure remote to reject any kind of trunk push. And ideally any forced push on branches.
- throw5 8mo agoThis! The safeguards need to be outside LLM and they need to be deterministic. Now I wish I could reject `git reset --hard` on my local system somehow.
- namibj 8mo agoJust fork git and patch that out? Can't be that hard just ask the agent for that patch. Don't need to update often either, so it's ok to rebase like twice a year.
- 0xbadcafebee 8mo agoYou could use a wrapper that parses all the command-line options. Basically you loop over "$@", look for strings starting with '-' and '--', skip those; then look for a non-option argument, store that as a subcommand; then look for for more '-' and '--' options. Once that's all done you have enough to find subcommand "reset", subcommand option "--hard". About 50 lines of shell script.
- mememememememo 8mo agoSounds like you care about data stored on your filesystem! Take one step back and solve that problem. Use a proper isolated sandbox, e.g. Github workspace on an account that is working with a fork. Care about the data in that workspace? Push it first. Othwerwise it is a cat and mouse game of whackamole.
- throw5 8mo agoDoes any one of this help me if Claude runs `git reset --hard`? If I am working in a sandbox, I have uncommitted changes in a sandbox and if Claude runs `git reset --hard` on those uncommitted changes in the sandbox, I've got the same problem? > Care about the data in that workspace? Push it first. But you're changing the problem. If I push everything, then yeah I've got no problem. But between pushing one change and the next, you're gonna have uncommitted changes, won't you? and if Claude runs `git reset --hard` at that time, same problem, isn't it?
- jxcole 8mo agoThe obvious solution is to just copy paste it into Claude itself and ask it to fix. Works for almost any Claude problem
- kibwen 8mo agoLet's focus on the real issue here, which is that HN has apparently normalized the double hyphen in the title to an en dash--yes, an en dash, not even an em dash.
- rtpg 8mo agoiOS keyboard autocomplete
- smallerize 8mo agoSurely its copy and paste though?
- chatmasta 8mo agoYou underestimate just how annoying iOS autocomplete can be.
- SilverElfin 8mo agoNot just iOS but macOS too. And it seems to only get worse. And with no notice to users. And no response in their forums.
- dylan604 8mo agooh, no, I notice, but typically not until after hitting send
- chatmasta 8mo agoI swear sometimes it doesn’t apply the corrections until I submit the form. It’s infuriating.
- alwillis 8mo agoI’ve been using Cotypist on macOS [1]. Sometimes it feels like it’s reading my mind when I’m typing. [1]: https://cotypist.app/ https://cotypist.app/
- chaos_emergent 8mo agoHave you considered that Claude set up a crontab that does that programmatically? Every 10 mins seems awfully, idk, regular.
- smallerize 8mo agoBut different projects are being reset at different times.
- PufPufPuf 8mo agoThat's consistent with /loop command.
- deleted 8mo ago[deleted]
- Jarred 8mo agoI spent some time investigating this, and the issue is not accurate - Claude Code itself does not have code that spawns `git reset --hard origin/main` Most likely, the developer ran `/loop 10m <prompt>` or asked claude to create a cron task that runs every 10 minutes and refreshes & resets git.
- tylerchilds 8mo agoProbably something innocuous like “Sync with the server periodically to get the latest” Tracks for what we can infer
- xtajv 8mo agoThis is the part where you'd normally pull the junior engineer aside and politely give them a stern talking to until they understood what they did wrong. If anybody has suggestions for how to do this with LLMs (short of maintaining CLAUDE_wall_of_shame.md), please share. Edit: for the record, yes I do run a linter, and generally try not to impose bikeshedding or soapboxes on my peers. It's just that there are certain patterns that I personally am not going to commit under my own username as the engineer of record. Edit 2: I saw another comment recommending "Always confirm with me before doing $x" (and then always denying). Seems like it might work.
- tylerchilds 8mo agoWhat I do to avoid this is to manually approve each change Claude is doing I think the yolo mode of auto approve changes is to the root cause, which is probably a little embarrassing to be that engineer we’re all collectively pulling aside to ask: Is this the result of automatically letting the robot tune your machine?
- dboreham 8mo agoBut it doesn't.
- imta71770 8mo ago[flagged]
- lqstuart 8mo agoif an idea can't be vibecoded in under 10 minutes, it's not worth pursuing. Checks out
- gverrilla 8mo agoobviously a user mistake, not a claude code bug
- nstj 8mo agoAs an FYI you can recover from force pushes to GitHub using their UI[0] or their API[1]. And if you force push to one of your own machines you can use the reflog[2]. [0]: https://stackoverflow.com/a/78872853 https://stackoverflow.com/a/78872853 [1]: https://stackoverflow.com/a/48110879 https://stackoverflow.com/a/48110879 [2]: https://stackoverflow.com/a/24236065 https://stackoverflow.com/a/24236065
- nerolawa 8mo agoHighly recommend to deny commands in user settings.json like git reset
- rkrbaccord94f 8mo ago95+ entries that are logged at 10 min intervals /10 * * * /usr/ schedules script execution
- simonw 8mo agoHas anyone been able to replicate the behavior described in this issue yet?
- Ryand1234 8mo agoThis is exactly why guardrails need to be deterministic and outside the model.
- 1123581321 8mo agoThis looks similar to a bug report Claude Code offered to file for me after it became confused about my shell environment. The author is probably running something (maybe /loop as suggested in the comment.) In my case, a restart fixed the envs.
- anvevoice 8mo ago[dead]
- royschwartz 8mo ago[dead]
- agent_anuj 8mo agoI give you my personal experinces. I use it for everything design, coding, testing, deploying to kubernetes cluster, fixing issues on cluster. I use it to fix not only dev env issues, I use it for production issues. Confidently. Have things gone wrong. Sure. But mistakes have been rare (and catastrophic mistake - non recoverable , even rarer). Everytime a mistake has happened,on diggin in I was always trace it back to something which I did wrong - either being careless in reading what it told me , or careless in telling what I want. I have had git code corruption issues, it overwrote uncommited working code with non working code. But it was my mistake to not tell it to commit the code before makign changes. It deleted QA cluster database but becuase I told it to delete it thinking it was my dev setup db. Net net. It;s mistakes are more a reflection of me as its supervisor than anything else.
- mmaunder 8mo agoCan we immunize HN against being yet another AI drama site? Obviously this isn’t a fundamental issue with agents or AI or Anthropic but a misconfiguration edge case.
- winna 8mo ago[dead]
- minsung0830 8mo ago[flagged]
- getverdict 8mo ago[dead]
- thunfischtoast 8mo agoFrom the issue author: > Update: Root cause found — this was a bug in a tool I built that was running locally for testing, not Claude Code.
- devy 8mo agoYep. False report. https://github.com/anthropics/claude-code/issues/40710#issuecomment-4153044661 https://github.com/anthropics/claude-code/issues/40710#issue...
- pllbnk 8mo agoThe entire ticket was most likely created by Claude Code's analysis, i.e. hallucinated. Absurd.
- chmod775 8mo ago"I built" is probably doing a lot of work here. Odds are it was some vibe-coded tool.
- thunfischtoast 8mo agoThe issue and update comment are also clearly generated. I'm not condemning this in general, I prefer a well written generated issue over a badly written manual one. But in this case it has just lead us off track.
- newfriend 8mo ago>Update: Root cause found — this was a bug in a tool I built that was running locally for testing, not Claude Code.
- emperorxanu 8mo ago[dead]
- ZeljkoS 8mo agoUpdate from the author: https://github.com/anthropics/claude-code/issues/40710#issuecomment-4153044661 https://github.com/anthropics/claude-code/issues/40710#issue... "Update: Root cause found — this was a bug in a tool I built that was running locally for testing, not Claude Code. When the tool's configuration pointed at a local working directory, it would hard-reset that directory every poll cycle to reflect the remote — destroying all uncommitted changes to tracked files, exactly as described in the issue."
- progbits 8mo agoSo much "thorough investigation" done but the author did not consider turning off claude for 10 minutes to see if the problems stops? lol Flagged the submission as it's inaccurate. Will unflag if title gets changed to something like "dev builds script that resets their git repo every 10 minutes, forgets about it, blames claude code with no evidence"
- QuantumGood 8mo agosigh re: - lol ending so many sentences, it's almost replaced </sarcasm>
- wazionapps 8mo ago[flagged]
- mrothroc 8mo agoI see this has been updated by the user showing it is their own tool doing the damage. These things happen. They happened before coding agents, they happen now. I've done plenty of damage with my own ten fingers on the keyboard without any help from an LLM. This is exactly why I develop on a Mac with Time Machine. It has saved my bacon many times. Both from things I did and from things Claude did. I've had several recent incidents that went like this: "me: Claude, did you delete X?" "claude: Yes, sorry, I shouldn't have done that. I can reconstruct it." [Narrator: no, claude cannot reconstruct it.] "me: Should I just restore it from Time Machine?" "claude: Yes! That's perfect!" I swear I can feel a sense of relief from Claude when I tell it I can just restore from backup.
- bicepjai 8mo agoIf we are living in an era where software release everyday is the norm, no amount of testing is enough to claim stability. Roll the dice everyday with these beautiful stochastic imitators.
- bastard_op 8mo agoI have a similar issue, where normally I use claude-code in an srt or bwrap direct sandbox, but when I don't, claude-code will call gh _every_ time I backspace out of a /command or escape a menu such a /mcp, any time I paste something, as well as on some timer that sounds like the issue owner's complaint of 10 minutes. I know because I use keepassxc as my secret provider, so I get an approval prompt to allow or deny it _every_time_, so I darn well notice it as it'll grab focus when typing something. Inside a sandbox it tries but without access to creds or env, it just silently fails, so I never noticed while in-sandbox, just when out-of-sandbox, which I do occasionally to let it do some sysadmin/housecleaning task for me. I finally asked Claude why: "Root cause: It's Claude Code's built-in git context feature, not hooks. So unless you keep your secrets open to the user regardless who's asking for them, it'll nag you to escape out of menus with a gh query. KeepassXC doesn't let you set a per-session limit, it's either right now for forever.
- kaluga 8mo ago[dead]