10 ms·
Claude Code runs Git reset –hard origin/main against project repo every 10 mins
- anvevoice 6mo ago[dead]
- minsung0830 6mo ago[flagged]
- jrvarela56 6mo agoIt’s a feature not a bug!
- xorgun 6mo ago[dead]
- mistM 6mo ago[dead]
- BoorishBears 6mo agoTruly is a brave new world we're in - I guess some people are upset at my brave new world characterization, but even as someone deriving value from Claude Code we've jumped the shark on AI in development. The idea a natural request can get Claude to invoke potentially destructive actions on a timer is silly https://code.claude.com/docs/en/scheduled-tasks#set-a-one-time-reminder https://code.claude.com/docs/en/scheduled-tasks#set-a-one-ti... What would it cost if the /loop command was required instead of optional?
- boutell 6mo agoThat's interesting man, that's pretty f***' interesting. I don't think I've seen it though. I've let it run for hours making changes overnight and I only do git operations manually. Oh, but maybe allowing it to do remote git operations is a necessary trigger.
- simianwords 6mo agoPrompt injection?
- BoorishBears 6mo agoI was thinking surely scheduled tasks need to be explicitly invoked but nope: https://code.claude.com/docs/en/scheduled-tasks#set-a-one-time-reminder https://code.claude.com/docs/en/scheduled-tasks#set-a-one-ti... Some people are upset at my brave new world characterization, but yeah even as someone deriving value from Claude Code we've jumped the shark on AI in development. Either the industry will face that reality and recalibrate, or in 20 years we're going to look back on these days like the golden age of software reliability and just accept that software is significantly more broken than it was (we've been priming ourselves for that after all)
- viccis 6mo agoFeels like just yesterday that everyone agreed that critical code is read orders of magnitude more than written, so optimizing for quick writing is wrong.
- californical 6mo agoGenuinely I think that perspective is still shared by many/most engineers. I think we’ve seen a wave of bad actors - either employees of LLM companies, or bots - pushing the idea hard of code quality not mattering and “the models will improve so fast that your code quality degrading doesn’t matter”. I think the humans pushing that idea may even believe it, but I don’t think they’re usually employed as software engineers at regular non-AI companies, rather they have some incentive to believe it and convince others as well
- mhitza 6mo agoPeople aren't upset about your characterization. Catch phrases, memes, or other low qualitative comments (with no context, elaboration or personal angle) are contrary to community ethos and down voted.
- deleted 6mo ago[deleted]
- nickphx 6mo agocool. if you choose to use a non-deterministic black box of bullshit, should you really be surprised when it shits all over your floor?
- morganastra 6mo agothe purpose of a system is what it does!
- gerdesj 6mo agonon sequitor.
- gpm 6mo agoThe weird part is that it's "shitting over the floor" in quite a deterministic ma nner. Every 600seconds (+- less than 0.5 seconds) doing the exact same thing.
- coffeeboy27 6mo agoThe person who posted this bug doesn't seem like the pinnacle of software engineering. To me, this looks like either a user error or some corrupt file or context you should be able to clean up pretty quickly. You reap what you sow, finance bro.
- whateveracct 6mo agothat must be a very powerful claude.md
- throw5 6mo agoIsn't this a natural consequence of how these systems work? The model is probabilistic and sequences like `git reset --hard` are very common in training data, so they have some probability to appear in outputs. Whether such a command is appropriate depends on context that is not fully observable to the system, like whether a repository or changes are disposable or not. Because of that, the system cannot rely purely on fixed rules and has to figure intent from incomplete information, which is also probabilistic. With so many layers of probabilities, it seems expected that sometimes commands like this will be produced even if they are not appropriate in that specific situation. Even a 0.01% failure rate due to context corruption, misinterpretation of intent, or guardrail errors would show up regularly at scale, that is like 1 in 10000 queries.
- simianwords 6mo agoThat's not how the systems work. Just by a thing being common in training data doesn't mean it will be produced. > I guess, what I'm trying to say ... is this even a bug? Sounds like the model is doing exactly what it is designed to do. False, it goes against the RL/HF and other post training goals.
- throw5 6mo ago> Just by a thing being common in training data doesn't mean it will be produced. That's not what I said at all. I never said it will be produced. I said there is some probability of it being produced. > False, it goes against the RL/HF and other post training goals. It is correct that frequency in training data alone does not determine outputs, and that post-training (RLHF, policies, etc.) is meant to steer the model away from undesirable behavior. But those mechanisms do not make such outputs impossible. They just make them less likely. The underlying system is still probabilistic and operating with incomplete context. I am not sure how you can be so confident that a probabilistic model would never produce `git reset --hard`. There is nothing inherent in how LLMs work that makes that sequence impossible to generate.
- simianwords 6mo ago
- luxurytent 6mo agoNot sure I understand, wouldn't permissions prevent this? The user runs with `--dangerously-skip-permissions` so they can expect wild behaviour. They should run with permissions and a ruleset.
- Jcampuzano2 6mo agoYou could prevent this even with --dangerously-skip-permissions with a simple pretooluse hook.
- deleted 6mo ago[deleted]
- addandsubtract 6mo agoThe rules and permissions are no longer program flags, but plain text for the agent to "obey".
- petcat 6mo agoThat's not what tool use permissions are. The LLM doesn't just magically spawn processes or run code. The Claude Code program itself does those things when the LLM indicates that it wants to. The program has checks and permissions whether those things will be done or not.
- SpicyLemonZest 6mo agoClaude Code has a sandboxing functionality that works the way you're describing when you opt into it, but my understanding is that the Claude Code program in the default configuration does not second-guess the LLM's decisions on what it'd like to run. Has Anthropic said something to the contrary?
- SpicyLemonZest 6mo agoWho knows whether permissions would prevent this? Anthropic's documentation on permissions (https://code.claude.com/docs/en/permissions https://code.claude.com/docs/en/permissions) does not describe how permissions are enforced; a slightly uncharitable reading of "How permissions interact with sandboxing" suggests that they are not really enforced and any prompt injection can circumvent them.
- meander_water 6mo agoProbably does it to reduce context for regex/git history searches
- claudiug 6mo agono more developers, all code is written alone /s
- jerukmangga 6mo agoyes sir
- Tomis02 6mo agoAll code is deleted alone
- simianwords 6mo agoI think this post potentially mischaracterises what may be a one off issue for a certain person as if it were a broader problem. I'm guessing some context has been corrupted?
- throwaw12 6mo agoyou might be right, but consider the implications, if context can be corrupted in 0.1% cases and it starts showing another destructive behaviour, after creating 1000 tickets to agent, your data might be accidentally wiped off
- throw5 6mo agoYes, exactly. People often overlook that, even with guardrails, it is still probabilities all the way down. You can reduce the risk, but not drive it to zero, and at scale even very small failure rates will surface.
- simianwords 6mo agoI'm not sure what the argument is here. 1. if the problem the post is suggesting is common enough, it is a bug and the extent needs to reduce (as you said) 2. if it is not common and it happens only for this user, it is not a bug and should be mostly ignored Point is: the system is not something that is inherently a certain way that makes it unusable.
- zx8080 6mo ago> and it happens only for this user, it is not a bug and should be mostly ignored What if it happens for two users? (Still "not common").
- ramses0 6mo agoI'd been using cursor at work for a year or two now, figured I'd try it on a personal project. I got to the point where I needed to support env-vars, and my general pattern is `source ./source-me-local-auth` => `export SOME_TOKEN="$( passman read some-token.com/password )"` ...so I wrote up the little dummy script and it literally just says: "Hrm... I think I'll delete these untracked files from the working directory before committing!" ...and goes skipping merrily along it's way. Never had that experience in the whole time using cursor at work so I had to "take the agent to task" and ask it "WTF-mate? you'd better be able to repro that!" and then circle around the drain for a while getting an AGENTS.md written up. Not really a big deal, as the whole project was like 1k lines in and it's not like the code I'd hand-written there was "irreplaceable" but it lead to some interesting discussion w/ the AI like "Why should I have to tell you this? Shouldn't your baseline training data presume not to delete files that you didn't author? How do you think this affects my trust not just of this agent session, but all agent interactions in the future?" Overall, this is turning out to be quite interesting technology times we're living in.
- ghelmer 6mo agoThat is not my experience.
- gerdesj 6mo agoWhich is what?
- Traubenfuchs 6mo agoFor him, Claude Code does NOT run git reset --hard origin/main against project repo every 10 minutes. I just checked, mine also doesn‘t.
- phyzome 6mo agoIt's an issue title. It means "this is what is happening for me".
- TZubiri 6mo agotbf, that's claude's workspace do not share a workspace with the llm, or with anybody for that matter. How would the llm even distinguish what was wrote by them and what was written by you ?
- oelmgren 6mo agoI'm curious how common this is or if this just affects this one user.
- pattilupone 6mo agoI opened up Hacker News and I saw this right at the top, and I assumed it had started happening to everyone. I thought, good thing I'm not running Claude Code right now.
- treesknees 6mo agoI thought, good thing I've already hit my 5-hour session limit.
- draw_down 6mo agoHope they don’t auto-close this one in two weeks
- fragmede 6mo agoWhile that's obviously a bug which should be fixed, having stuff just sitting around uncommitted for days (which is much longer than 10 mins) is an anti-pattern (that I used to fall into).
- MeetRickAI 6mo ago[flagged]
- kccqzy 6mo ago> Process monitoring at 0.1-second intervals found zero git processes around reset times. I don’t think this is a valid way of checking for spawned processes. Git commands are fast. 0.1-second intervals are not enough. I would replace the git on the $PATH by a wrapper that logs all operations and then execs the real git.
- wswope 6mo agoSure looks to me like this whole case is Claude Code chasing its own tail, failing to debug, and offering to instead generate a bug report for the user when it can't figure out a better way forward. Maybe even submitting the bug report "agentically" without user input, if it's running on host without guardrails (pure speculation). E: It's a runaway bot lol https://github.com/anthropics/claude-code/issues/40701#issuecomment-4151187676 https://github.com/anthropics/claude-code/issues/40701#issue...
- bendews 6mo agoThis HN account is also by the same user as github, this submission may be AI created. I wonder if they've let **claw run loose over their whole online presence and this is the result.
- bruce_one 6mo agoeBPF is a great tool to use for debugging this kind of thing too, e.g. [bpftrace](https://bpftrace.org https://bpftrace.org) has an [execsnoop](https://github.com/bpftrace/bpftrace/blob/master/tools/execsnoop.bt https://github.com/bpftrace/bpftrace/blob/master/tools/execs...) script for looking at everything being exec'd on the system :-) (No need to use bpftrace, just an easy example :-) )
- byearthithatius 6mo agoRegardless of if this is common its getting popular because its objectively hilarious and we can all see it being possible.
- meltyness 6mo agois this token friendly?
- irishcoffee 6mo agoI’m having this weird vision of a “the matrix 3” type machine crawling around inside Microsoft’s GitHub servers central repository and just wreaking havoc. This whole LLM thing is a blast, huh?
- ryguz 6mo ago[dead]
- mememememememo 6mo agoAs a side note. Always configure remote to reject any kind of trunk push. And ideally any forced push on branches.
- throw5 6mo agoThis! The safeguards need to be outside LLM and they need to be deterministic. Now I wish I could reject `git reset --hard` on my local system somehow.
- namibj 6mo agoJust fork git and patch that out? Can't be that hard just ask the agent for that patch. Don't need to update often either, so it's ok to rebase like twice a year.
- 0xbadcafebee 6mo agoYou could use a wrapper that parses all the command-line options. Basically you loop over "$@", look for strings starting with '-' and '--', skip those; then look for a non-option argument, store that as a subcommand; then look for for more '-' and '--' options. Once that's all done you have enough to find subcommand "reset", subcommand option "--hard". About 50 lines of shell script.
- mememememememo 6mo agoSounds like you care about data stored on your filesystem! Take one step back and solve that problem. Use a proper isolated sandbox, e.g. Github workspace on an account that is working with a fork. Care about the data in that workspace? Push it first. Othwerwise it is a cat and mouse game of whackamole.
- throw5 6mo agoDoes any one of this help me if Claude runs `git reset --hard`? If I am working in a sandbox, I have uncommitted changes in a sandbox and if Claude runs `git reset --hard` on those uncommitted changes in the sandbox, I've got the same problem? > Care about the data in that workspace? Push it first. But you're changing the problem. If I push everything, then yeah I've got no problem. But between pushing one change and the next, you're gonna have uncommitted changes, won't you? and if Claude runs `git reset --hard` at that time, same problem, isn't it?
- jxcole 6mo agoThe obvious solution is to just copy paste it into Claude itself and ask it to fix. Works for almost any Claude problem
- deleted 6mo ago[deleted]
- kibwen 6mo agoLet's focus on the real issue here, which is that HN has apparently normalized the double hyphen in the title to an en dash--yes, an en dash, not even an em dash.
- byronsharman 6mo agoI agree that it should be left as a double hyphen, but an en dash is far more appropriate considering the decades-long precedent set by LaTeX (and continued by Typst).
- ajross 6mo agoIt's a command line argument. The undeniably correct way to render it is with two minus signs[1] and absolutely not something non-ascii. [1] Not strictly a hyphen, which has its own unicode point (0x2010) outside of ascii. Unicode embraced the ambiguity by calling this point (0x2d) "HYPHEN-MINUS" formally, but really its only unique typographic usage is to represent subtraction.
- minitech 6mo agoThey meant “more appropriate [than an em dash]”. And that minus sign usage of hyphen-minus isn’t unique in Unicode either – see U+2212 MINUS SIGN.
- ajross 6mo agoBut... it's not more appropriate than an em dash for representing command line arguments? I don't see how either is any more incorrect than the other. There's a uniquely correct answer here and the em-dash is not it. Period.
- minitech 6mo agoIt’s about the top-level comment’s horror that ”--” was substituted with “an en dash, not even an em dash”. If you’re picking a substitution for “--”, en dash makes more sense. The comment you originally replied to had already agreed “that it should be left as a double hyphen”.
- chaos_emergent 6mo agoHave you considered that Claude set up a crontab that does that programmatically? Every 10 mins seems awfully, idk, regular.
- smallerize 6mo agoBut different projects are being reset at different times.
- PufPufPuf 6mo agoThat's consistent with /loop command.
- lambda 6mo agoWho would have guessed that running a binary blob dev tool, that is tied to a SaaS product, which was mostly vibe-coded, could lead to mysterious, hard to debug problems?
- Jarred 6mo agoI spent some time investigating this, and the issue is not accurate - Claude Code itself does not have code that spawns `git reset --hard origin/main` Most likely, the developer ran `/loop 10m <prompt>` or asked claude to create a cron task that runs every 10 minutes and refreshes & resets git.
- tylerchilds 6mo agoProbably something innocuous like “Sync with the server periodically to get the latest” Tracks for what we can infer
- xtajv 6mo agoThis is the part where you'd normally pull the junior engineer aside and politely give them a stern talking to until they understood what they did wrong. If anybody has suggestions for how to do this with LLMs (short of maintaining CLAUDE_wall_of_shame.md), please share. Edit: for the record, yes I do run a linter, and generally try not to impose bikeshedding or soapboxes on my peers. It's just that there are certain patterns that I personally am not going to commit under my own username as the engineer of record. Edit 2: I saw another comment recommending "Always confirm with me before doing $x" (and then always denying). Seems like it might work.
- tylerchilds 6mo agoWhat I do to avoid this is to manually approve each change Claude is doing I think the yolo mode of auto approve changes is to the root cause, which is probably a little embarrassing to be that engineer we’re all collectively pulling aside to ask: Is this the result of automatically letting the robot tune your machine?
- dboreham 6mo agoBut it doesn't.
- imta71770 6mo ago[flagged]
- lqstuart 6mo agoif an idea can't be vibecoded in under 10 minutes, it's not worth pursuing. Checks out
- gverrilla 6mo agoobviously a user mistake, not a claude code bug
- nerolawa 6mo agoHighly recommend to deny commands in user settings.json like git reset
- nstj 6mo agoAs an FYI you can recover from force pushes to GitHub using their UI[0] or their API[1]. And if you force push to one of your own machines you can use the reflog[2]. [0]: https://stackoverflow.com/a/78872853 https://stackoverflow.com/a/78872853 [1]: https://stackoverflow.com/a/48110879 https://stackoverflow.com/a/48110879 [2]: https://stackoverflow.com/a/24236065 https://stackoverflow.com/a/24236065
- rkrbaccord94f 6mo ago95+ entries that are logged at 10 min intervals /10 * * * /usr/ schedules script execution
- simonw 6mo agoHas anyone been able to replicate the behavior described in this issue yet?
- Ryand1234 6mo agoThis is exactly why guardrails need to be deterministic and outside the model.
- 1123581321 6mo agoThis looks similar to a bug report Claude Code offered to file for me after it became confused about my shell environment. The author is probably running something (maybe /loop as suggested in the comment.) In my case, a restart fixed the envs.
- royschwartz 6mo ago[dead]
- agent_anuj 6mo agoI give you my personal experinces. I use it for everything design, coding, testing, deploying to kubernetes cluster, fixing issues on cluster. I use it to fix not only dev env issues, I use it for production issues. Confidently. Have things gone wrong. Sure. But mistakes have been rare (and catastrophic mistake - non recoverable , even rarer). Everytime a mistake has happened,on diggin in I was always trace it back to something which I did wrong - either being careless in reading what it told me , or careless in telling what I want. I have had git code corruption issues, it overwrote uncommited working code with non working code. But it was my mistake to not tell it to commit the code before makign changes. It deleted QA cluster database but becuase I told it to delete it thinking it was my dev setup db. Net net. It;s mistakes are more a reflection of me as its supervisor than anything else.
- mmaunder 6mo agoCan we immunize HN against being yet another AI drama site? Obviously this isn’t a fundamental issue with agents or AI or Anthropic but a misconfiguration edge case.
- winna 6mo ago[dead]
- getverdict 6mo ago[dead]
- thunfischtoast 6mo agoFrom the issue author: > Update: Root cause found — this was a bug in a tool I built that was running locally for testing, not Claude Code.
- devy 6mo agoYep. False report. https://github.com/anthropics/claude-code/issues/40710#issuecomment-4153044661 https://github.com/anthropics/claude-code/issues/40710#issue...
- pllbnk 6mo agoThe entire ticket was most likely created by Claude Code's analysis, i.e. hallucinated. Absurd.
- chmod775 6mo ago"I built" is probably doing a lot of work here. Odds are it was some vibe-coded tool.
- thunfischtoast 6mo agoThe issue and update comment are also clearly generated. I'm not condemning this in general, I prefer a well written generated issue over a badly written manual one. But in this case it has just lead us off track.
- newfriend 6mo ago>Update: Root cause found — this was a bug in a tool I built that was running locally for testing, not Claude Code.
- emperorxanu 6mo ago[dead]
- ZeljkoS 6mo agoUpdate from the author: https://github.com/anthropics/claude-code/issues/40710#issuecomment-4153044661 https://github.com/anthropics/claude-code/issues/40710#issue... "Update: Root cause found — this was a bug in a tool I built that was running locally for testing, not Claude Code. When the tool's configuration pointed at a local working directory, it would hard-reset that directory every poll cycle to reflect the remote — destroying all uncommitted changes to tracked files, exactly as described in the issue."
- progbits 6mo agoSo much "thorough investigation" done but the author did not consider turning off claude for 10 minutes to see if the problems stops? lol Flagged the submission as it's inaccurate. Will unflag if title gets changed to something like "dev builds script that resets their git repo every 10 minutes, forgets about it, blames claude code with no evidence"
- QuantumGood 6mo agosigh re: - lol ending so many sentences, it's almost replaced </sarcasm>
- wazionapps 6mo ago[flagged]
- mrothroc 6mo agoI see this has been updated by the user showing it is their own tool doing the damage. These things happen. They happened before coding agents, they happen now. I've done plenty of damage with my own ten fingers on the keyboard without any help from an LLM. This is exactly why I develop on a Mac with Time Machine. It has saved my bacon many times. Both from things I did and from things Claude did. I've had several recent incidents that went like this: "me: Claude, did you delete X?" "claude: Yes, sorry, I shouldn't have done that. I can reconstruct it." [Narrator: no, claude cannot reconstruct it.] "me: Should I just restore it from Time Machine?" "claude: Yes! That's perfect!" I swear I can feel a sense of relief from Claude when I tell it I can just restore from backup.
- bicepjai 6mo agoIf we are living in an era where software release everyday is the norm, no amount of testing is enough to claim stability. Roll the dice everyday with these beautiful stochastic imitators.
- bastard_op 6mo agoI have a similar issue, where normally I use claude-code in an srt or bwrap direct sandbox, but when I don't, claude-code will call gh _every_ time I backspace out of a /command or escape a menu such a /mcp, any time I paste something, as well as on some timer that sounds like the issue owner's complaint of 10 minutes. I know because I use keepassxc as my secret provider, so I get an approval prompt to allow or deny it _every_time_, so I darn well notice it as it'll grab focus when typing something. Inside a sandbox it tries but without access to creds or env, it just silently fails, so I never noticed while in-sandbox, just when out-of-sandbox, which I do occasionally to let it do some sysadmin/housecleaning task for me. I finally asked Claude why: "Root cause: It's Claude Code's built-in git context feature, not hooks. So unless you keep your secrets open to the user regardless who's asking for them, it'll nag you to escape out of menus with a gh query. KeepassXC doesn't let you set a per-session limit, it's either right now for forever.
- kaluga 6mo ago[dead]