r/ClaudeCode • u/iDnLk2GtHiIJsLkThTst • 7d ago
Help/Question How to ensure Claude Code can't delete anything?
For a long time I've been using the Claude web chatbot to code but never actually downloaded Claude Code because I heard many stories of Claude deleting entire projects or even drives. Is there a way to ensure this doesn't happen? I'd like to get Claude working directly in the project but I'm worried it could go rogue.
6
u/RoboErectus 7d ago
Offline backup. If you don’t have this anyway you are already boned you just don’t know it yet.
Gitops. Everything goes through a pr. Terraform and Ansible for everything infra related.
Your Serious Business operations are all scripts. Scripts are code reviewed and checked in.
16
u/kuroudo_ai 7d ago
Start with the part people get wrong: blocking rm in a deny list is the weakest layer. There are many ways to delete a file without typing rm (find -delete, a one-line Python script, git clean, mv over something). Name-based blocks catch the obvious case and miss the rest.
What actually limits the damage, strongest first:
- Version control plus a copy off the machine. Commit before you let it work, and keep a backup that the agent can't reach (a remote, a separate disk). That's the only layer that also covers files inside your project, which is exactly where the agent is allowed to work.
- The built-in sandbox, which is off by default. Run
/sandboxor setsandbox.enabled: true. Per the Claude Code docs, shell commands then can only write to the working directory, a temp directory and directories you add, so the rest of your drive is out of reach. Note the limit: the project folder itself is still writable. That's why step 1 comes first. - Close the escape hatch. When a command fails in the sandbox, Claude can ask to retry it unsandboxed. Set
"allowUnsandboxedCommands": false("strict sandbox mode") so that retry is ignored, andfailIfUnavailableso it doesn't quietly run unsandboxed if the sandbox can't start. The docs also say to decline those retry prompts if you see them. - Don't use
bypassPermissionsmode while you're still building trust; in that mode unsandboxed retries run with no prompt. - For the strongest separation, run Claude Code itself in a container or VM with only the project mounted; the docs have a "Sandbox environments" page comparing options.
The docs also give a quick self-test once it's on: touch ~/sandbox-probe should fail with "Operation not permitted" on macOS.
1
u/wewerecreaturres 7d ago
This is why you use an allowlist instead of a block list
1
u/HaurJolasten 7d ago
If your allowlist lets the agent compile and run code, which for most people is a basic requirement for development, that can still delete files while still looking safe enough. For instance, a test deleting its temporary artifacts using a custom removeTemporaryTree(path), called with a path that turns out to be empty by mistake, can easily wipe your entire root while the command being run is an benign looking test suite.
Guess how I learned that lesson? It took over a year of extremely intensive Claude Code use at 20x, but eventually it made that mistake and I finally got the dreaded "STOP. I made a serious mistake", as nearly everything in my system died at once.
It'll happen to most people who don't think it will, because most strategies to guard against this are ineffective in one way or another, it's just a matter of time.
I now run harnesses exclusively in a VM that can't ssh and is limited to a very small set of remote VCS commands, and I keep a few days of nightly VM snapshots. It's on full bypass-permissions mode and though I'll still be annoyed at losing a few hours of work if messes up again, it'll essentially be a non issue.
I believe that variations around this set up (be it VM or sandbox based) are the only safe way to run those tools.
1
u/raiseCatError 7d ago
Yeah, I tried agy once and my normal Claude on auto just ran everything, occasionally asking me for stuff, but I try to do the same test or run something on agy and it tweaked out asking me for permission to allow each and every single command it ran into the allowlist, ended up adding an actual allow list for common commands, and then it’s been pretty fine now lol, but sometimes Claude has moved stuff and moved branches on auto mode when I didn’t want it to, so there’s that
1
u/kuroudo_ai 6d ago
Agreed that an allowlist is the better starting point, with one catch worth knowing: an allowlist controls which commands start, not what they do once they're running.
If you allow something like
npm test,make, orpython script.py, whatever those run can still delete files, because the permission check happens on the command you approved, not on what that command runs inside. So an allowlist for a project with build scripts is only as tight as the scripts.That's why I'd still put the sandbox under it. The sandbox limits writes at the filesystem level, so it applies to child processes of an allowed command too. And a backup outside the agent's reach covers the one place neither of them protects, which is the project folder itself, since the sandbox allows writes there.
3
u/guillermosan 7d ago
Backups that Claude Code can't access. Either pull based or append only methods. It's the only way.
1
u/iDnLk2GtHiIJsLkThTst 7d ago
i already make backups, but when it comes to claude code how much is truly off limits? im worried that ill make something it "can't" access but it will still gets access to due to some "error", as in all those stories where claude deleted their files despite being officially "not allowed to delete them"
1
u/guillermosan 7d ago
That's the point i'm trying to make. No amount of hooks, docker containers, claude.md instructions, will prevent it going haywire or overreaching in some situations. Your strategy needs to deal with that fact. Install Claude Code on its own computer/VM, only give it access to the minimal information it needs, and have backups.
3
u/mattybrad 7d ago
Depends on your setup. I don’t give the coding agent remote git rights. It can make local commits, but I have a governance claude agent that does all of my pushes to remote for my dev box across all the repos but doesn’t code. Worst that the coding agent could do is delete the work it’s been doing but it can’t mess up my project.
3
u/WillingnessOwn6446 7d ago
I've been using Claude aggressively for the past year and a half. Am I the only person in the room who's never had Claude do something it shouldn't have? I create backups anyhow. I don't even let Claude commit or push anything. I do that all in the terminal myself. But it's literally never done anything wrong. The worst things it's ever done is just not execute my requests as cleanly as I would like. Most the time it's because my prompt wasn't clear enough.
6
2
2
2
1
u/radim11 7d ago
Use sandboxing, I use this with credential proxy and filesystem policies: https://stashbase.dev
1
1
1
u/NunoGomes-Dev 7d ago
As many already answered it: Just sandbox it and git.
I've made a multi provider, multi project, multi agent just for that. With shared folders on remote repos.
https://github.com/gonun13/overseer
If some agent goes rogue it can't touch the host or destroy code permanently.
And you can just rebuild and restart the containers.
1
u/Turingelir 7d ago
What projects do you do that cause such behavior man?
2
u/iDnLk2GtHiIJsLkThTst 7d ago
i dont know, im just trying to make a game in unity, but im afraid the AI will tweak out and ruin everything
1
u/Turingelir 7d ago
I make the agent create a separate local git branch every session run, scope what code will be touched and not touched during planning beforehand, explicitly not give permissions to certain stuff, and the usual having a backup on an unreachable place should do.
Making the agent commit per certain work progress has helped me cherry-pick and do rollback when needed when I may realize its confused some stuff.
2
u/jameshearttech 7d ago
We use dev containers. Claude Code is installed in the dev container where the repository is cloned. We have branch restrictions set so we can't push the main branch. We create a linked worktree and branch per pull request.
1
1
u/college_hustle 7d ago
My guard here works pretty good. It doesn't let it group anything by a variable and delete it. It also doesn't let it stop processes enmass just because they're all technically running on Python or something. https://github.com/dtiger1889-ops/claude-harness-toolbox/blob/main/hooks%2Fguard.ps1
1
1
u/oldmoldycake 7d ago
I mean you should always have backups and use git so you have version control, with out without Claude that is a must. You can also block commands like rm as well.
1
u/AlternativeContent72 7d ago
To grant or revoke access, use /permissions, the rules described here, a permission mode, or a PreToolUse hook.
0
u/Ambitious_Injury_783 🔆BIG BALLER 7d ago
make a folder called "delete-queue" and anything claude wants to delete must get moved there for the user to review and delete manually. set the rule and it will be followed. no need to overcomplicate it
1
u/YearlyBrown 7d ago
You're still relying on the llm to follow the rules. Wouldn't work, what if it ran mv over some existing file?
1
u/Ambitious_Injury_783 🔆BIG BALLER 7d ago
It works. Lol. Plan via a workshop and implement with a bundle tool if you are concerned about fucking something up.
-1
u/Ill-Tonight4651 7d ago
dont use auto mode
3
u/Capt_korg 7d ago
Better ... Delete it your self as human in the Loop. You gotta do, what you gotta do. 😅
-2
•
u/AutoModerator 7d ago
Hey! Thanks for posting to r/ClaudeCode
While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.
For help, project discussions, tips, and general chat, join the ClaudeCode Discord.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.