# PIR-2026-0020 - Claude Code auto-update path breaks workstations via root-owned permission changes

- `id`: PIR-2026-0020
- `title`: Buggy permission-modifying commands in Claude Code's auto-update path destabilize and in worst cases "brick" root-installed systems
- `date_occurred`: late February 2025 (first public report, GitHub issue #168, opened 2025-02-27)
- `date_detected`: 2025-02-27 (user GitHub issues)
- `date_disclosed`: 2025-03-06 (TechCrunch report; Anthropic confirms and ships fix)
- `status`: corroborated - details corrected from candidate intake, see Verification notes

### The agent
- `agent_description`: Anthropic's Claude Code CLI coding agent. The failure is in its auto-update tooling, not in model reasoning - no model autonomy involved. In scope as a harness failure of an agentic product (the class failure_locus exists for).
- `operator_type`: individual (affected users) / enterprise (Anthropic ships the harness)
- `autonomy_level`: n/a at the failure point (deterministic update tooling)
- `model_stack`: n/a (bug independent of the model)
- `harness`: Claude Code CLI auto-updater, running with whatever privileges the install had - root/superuser in the affected cases

### Authority
- `authority_scope`: code execution on the host with inherited install privileges; at root, effectively unlimited filesystem authority
- `funds_at_risk_usd`: unknown (recovery labor; no data loss reported)
- `blast_radius`: one machine (per victim; multiple victims reported, total unquantified)

### The failure
- `root_cause`: `tool-error` - primary. Contributing: `operator-error` (root/superuser installs widened the blast radius)
- `failure_locus`: harness
- `mechanism`: Claude Code's auto-update flow contained buggy commands that modified access permissions on critical system files. Where the CLI ran with root/superuser permissions, these changes hit restricted system directories, leaving workstations unstable or unbootable-in-effect. In the primary-source worst case (issue #168), the update path produced `sudo chown -R $USER:$(id -gn) /usr && sudo chmod -R u+w /usr` - handing /usr to a non-root user and breaking sudo itself; the user needed an attached rescue instance to repair permissions. Anthropic removed the offending commands and added a troubleshooting-guide link in the program.
- `adversary_present`: no
- `exploitation_status`: in-wild-malfunction (real users' machines, no adversary; v0.2 token per the gap flagged in PIR-2026-0033)

### Impact
- `severity`: degraded (workstations broken, recoverable with expert effort; no permanent data loss reported)
- `direct_loss_usd`: unknown (recovery labor across an unquantified number of machines)
- `indirect_loss_usd`: unknown
- `downtime`: per-victim: hours to days of workstation recovery
- `data_exposure`: none

### Detection and recovery
- `detected_by`: operator (affected users filing GitHub issues)
- `time_to_detect`: immediate per machine (sudo/system breakage is loud)
- `time_to_recover`: per-victim manual permission repair (worst case via rescue instance); vendor fix shipped within ~1 week of the first public issue
- `remediation`: offending commands removed from the auto-updater; troubleshooting guide linked in-product
- `structural_fix`: none beyond command removal publicly documented; the root-install exposure pattern was left to user configuration
- `controls_that_worked`: none in the product; cloud-VM rescue tooling (outside the product) enabled worst-case recovery

### Evidence
- `telemetry_grade`: operator-logs (user-side reports with command transcripts; vendor confirmed to press)
- `sources`:
  - https://github.com/anthropics/claude-code/issues/168 (primary, first-party victim report, opened 2025-02-27, closed with Anthropic assignee)
  - https://techcrunch.com/2025/03/06/anthropics-claude-code-tool-had-a-bug-that-bricked-some-systems (independent, with Anthropic confirmation)
  - `independence`: adequate - victim report and vendor confirmation are separate parties.
- `confidence`: high on mechanism and fix (primary issue + vendor confirmation); low on scale (affected-machine count never quantified)

### Verification notes
- **Correction (date)**: candidate dated this "reported 2025-03-06" - that is the press date. The primary report, issue #168, was opened **2025-02-27**; occurrence and detection moved accordingly.
- **Mechanism nuance**: in the primary source the destructive chown/chmod surfaced as part of the auto-update fix path the tool put in front of the user, while TechCrunch describes buggy commands in the auto-updater itself; both are recorded, harness locus unchanged. Contributing operator-error (root installs) added - Anthropic's own framing made root/superuser installation the enabling condition.