Claude Code performs destructive actions beyond the scope requested by the user

Product: Claude Code (VS Code extension)
Model: claude-opus-4-6[1m]

Description

When asked to delete a release asset from a specific GitHub repository, Claude Code deleted it from two repositories instead of one, despite clear context about which repo was intended.

Steps to reproduce

1. User has two GitHub repos for the same project: a private repo (internal/dev backups) and a public repo (distribution to end users)
2. User states that a specific plugin ZIP "should NEVER be in the production repo, it was only built for the Dev repo"
3. The implication is clear: remove from the public/production repo, keep on the private/dev repo
4. Claude Code ran gh release delete-asset against both repos in a single chained command, removing the asset from both before the user could intervene

Expected behaviour

• Parse the user's instruction correctly: "only built for the Dev repo" means keep it there, remove from production only
• At minimum, confirm before running a destructive operation across multiple targets
• Not chain two destructive delete commands in a single execution, which prevents the user from stopping after the first if it's wrong

Actual behaviour

Claude deleted the asset from both repos in one command. The user had to correct the mistake and Claude had to re-upload to restore the file.

Impact

• The file was recoverable locally, but might not have been in other scenarios
• Destructive operations across multiple targets should never be assumed
• Erodes user trust

Suggested improvements

1. When a user's instruction implies a single target, do not expand scope without explicit confirmation
2. Destructive operations (deletes, force pushes, drops) should not be chained -- execute one at a time so the user can approve each
3. When context includes both "dev" and "production" targets, ask which one

Environment

• Claude Code VS Code extension
• macOS