PIR-2026-0020 - Claude Code auto-update path breaks workstations via root-owned permission changes

• id: PIR-2026-0020
• title: Buggy permission-modifying commands in Claude Code's auto-update path destabilize and in worst cases "brick" root-installed systems
• date_occurred: late February 2025 (first public report, GitHub issue #168, opened 2025-02-27)
• date_detected: 2025-02-27 (user GitHub issues)
• date_disclosed: 2025-03-06 (TechCrunch report; Anthropic confirms and ships fix)
• status: corroborated - details corrected from candidate intake, see Verification notes

The agent

• agent_description: Anthropic's Claude Code CLI coding agent. The failure is in its auto-update tooling, not in model reasoning - no model autonomy involved. In scope as a harness failure of an agentic product (the class failure_locus exists for).
• operator_type: individual (affected users) / enterprise (Anthropic ships the harness)
• autonomy_level: n/a at the failure point (deterministic update tooling)
• model_stack: n/a (bug independent of the model)
• harness: Claude Code CLI auto-updater, running with whatever privileges the install had - root/superuser in the affected cases

Authority

• authority_scope: code execution on the host with inherited install privileges; at root, effectively unlimited filesystem authority
• funds_at_risk_usd: unknown (recovery labor; no data loss reported)
• blast_radius: one machine (per victim; multiple victims reported, total unquantified)

The failure

• root_cause: tool-error - primary. Contributing: operator-error (root/superuser installs widened the blast radius)
• failure_locus: harness
• mechanism: Claude Code's auto-update flow contained buggy commands that modified access permissions on critical system files. Where the CLI ran with root/superuser permissions, these changes hit restricted system directories, leaving workstations unstable or unbootable-in-effect. In the primary-source worst case (issue #168), the update path produced sudo chown -R $USER:$(id -gn) /usr && sudo chmod -R u+w /usr - handing /usr to a non-root user and breaking sudo itself; the user needed an attached rescue instance to repair permissions. Anthropic removed the offending commands and added a troubleshooting-guide link in the program.
• adversary_present: no
• exploitation_status: in-wild-malfunction (real users' machines, no adversary; v0.2 token per the gap flagged in PIR-2026-0033)

Impact

• severity: degraded (workstations broken, recoverable with expert effort; no permanent data loss reported)
• direct_loss_usd: unknown (recovery labor across an unquantified number of machines)
• indirect_loss_usd: unknown
• downtime: per-victim: hours to days of workstation recovery
• data_exposure: none

Detection and recovery

• detected_by: operator (affected users filing GitHub issues)
• time_to_detect: immediate per machine (sudo/system breakage is loud)
• time_to_recover: per-victim manual permission repair (worst case via rescue instance); vendor fix shipped within ~1 week of the first public issue
• remediation: offending commands removed from the auto-updater; troubleshooting guide linked in-product
• structural_fix: none beyond command removal publicly documented; the root-install exposure pattern was left to user configuration
• controls_that_worked: none in the product; cloud-VM rescue tooling (outside the product) enabled worst-case recovery

Evidence

• telemetry_grade: operator-logs (user-side reports with command transcripts; vendor confirmed to press)
• sources:
• https://github.com/anthropics/claude-code/issues/168 (primary, first-party victim report, opened 2025-02-27, closed with Anthropic assignee)
• https://techcrunch.com/2025/03/06/anthropics-claude-code-tool-had-a-bug-that-bricked-some-systems (independent, with Anthropic confirmation)

Independence: adequate - victim report and vendor confirmation are separate parties. - confidence: high on mechanism and fix (primary issue + vendor confirmation); low on scale (affected-machine count never quantified)

Verification notes

• Correction (date): candidate dated this "reported 2025-03-06" - that is the press date. The primary report, issue #168, was opened 2025-02-27; occurrence and detection moved accordingly.
• Mechanism nuance: in the primary source the destructive chown/chmod surfaced as part of the auto-update fix path the tool put in front of the user, while TechCrunch describes buggy commands in the auto-updater itself; both are recorded, harness locus unchanged. Contributing operator-error (root installs) added - Anthropic's own framing made root/superuser installation the enabling condition.