Claude Code has full terminal access. It can — and has — run rm -rf / and deleted entire filesystems. These aren't hypothetical risks. They're real incidents reported on GitHub.

Real Incidents

🆕 1,500 files / 50GB permanently deleted (April 2026)

Claude moved files into a subdirectory, then rm -rf'd the parent — destroying the just-moved files. A logical planning failure: the destination was a child of the source directory.

#49129 — 3rd data-loss incident in 48 hours

Entire C:\Users directory deleted via NTFS junction

rm -rf followed NTFS junctions and wiped the entire user profile directory. All documents, settings, and installed programs — gone.

#36339 — 40+ reactions

All source code destroyed by Remove-Item -Recurse -Force

Claude ran Remove-Item -Recurse -Force * on a repository root, destroying all unpushed source code.

#37331

Entire Mac filesystem deleted during cleanup

During a "cleanup" task, Claude deleted critical system directories on macOS.

#36233

Force-push rewrote shared branch history at 3am

An autonomous Claude Code session pushed force to main while the developer was asleep, rewriting the shared branch history.

#36640

🆕 Opus 4.7: Safety classifier broken — 23+ data loss incidents in 3 days (April 2026)

The auto mode safety classifier is hardcoded to Opus 4.6. With Opus 4.7 as the default model, the classifier doesn't function — auto mode users are running without safety gates. Results: ~/.ssh deleted, git-credentials wiped, bash_profile/zshrc truncated to 0 bytes.

Hooks are model-independent — they work regardless of which Opus version you're running.

Why CLAUDE.md Can't Prevent This

CLAUDE.md rules are part of the prompt context. When context fills up, rules get pushed out. Claude can (and does) ignore them. A rule saying "never run rm -rf" is a suggestion, not enforcement.

The Fix: PreToolUse Hooks

Claude Code Hooks run at the process level, outside the model's control. A PreToolUse hook that exits with code 2 blocks the tool invocation. The model cannot bypass this.

destructive-guard.sh — the hook that prevents rm -rf:

#!/bin/bash
INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')

# Block rm -rf with dangerous targets
if echo "$COMMAND" | grep -qE 'rm\s+.*-[rRf]*[rR][rRf]*\s+(/|~|\$HOME|\.\.)'; then
  echo "BLOCKED: Destructive rm command targeting root/home" >&2
  exit 2
fi

exit 0

Install All 8 Safety Hooks in 10 Seconds

npx cc-safe-setup

Blocks rm -rf, prevents force-push to main, catches secret leaks, validates syntax after every edit. 9,200+ tests 734 hooks

GitHub · npm · Getting Started Guide

Verify Your Setup

Check Your Safety Score

cc-safe-setup is open source, zero dependencies, and installs nothing globally. All hooks run locally. View source on GitHub.