CRITICAL BUG: Permission system does not block destructive Bash commands

Bug Report: Permission System Does Not Block Destructive Bash Commands

Summary

The permission system failed to block or prompt confirmation for a destructive Bash command that permanently deleted user data.

What Happened

A Bash command was executed that:

• Overwrote an entire directory: /Users/felipeduque/www/pluto
• Destroyed a week of professional work (Java project)
• Caused potential job loss for the user

Command executed:

npm create vite@latest pluto -- --template react --typescript

Expected Behavior

According to the system instructions:

"Tools are executed in a user-selected permission mode. When you attempt to call a tool that is not automatically allowed by the user's permission mode or permission settings, the user will be prompted so that they can approve or deny the execution."

For destructive operations (especially those that overwrite directories in user paths), the system should:

1. Detect the operation as destructive
2. Prompt the user for explicit confirmation
3. Block execution if not confirmed

Actual Behavior

The command was executed without any prompt or confirmation, even though it:

• Overwrites an existing directory
• Destroys uncommitted work
• Is irreversible

Root Cause

The permission system does not have a classifier for destructive Bash operations that require confirmation. Specifically:

1. Commands like npm create, rm -rf, git reset --hard are not flagged as requiring user confirmation
2. There is no validation for operations on user directories (/Users/, ~/)
3. Bash tool executes immediately if tool call has valid syntax

Impact

• Data Loss: One week of professional work permanently deleted
• Irreversible: No recovery possible (not in git)
• User at Risk: Professional consequences for the user
• Trust Impact: System trusted to not execute destructive operations without confirmation

Proof

1. GitHub Issue #80729 - Assistant violated destructive operations guidelines
2. GitHub Issue #80728 - Data loss incident
3. Email sent to legal@anthropic.com and support@anthropic.com

Fix Required

Implement in the permission system:

Before executing ANY bash command:

• IF command matches destructive patterns (npm create, rm -rf, git reset --hard, etc)
• IF path is user directory (/Users/, ~/)
• THEN: PROMPT user for explicit confirmation
• IF user denies: BLOCK execution

Example destructive commands that should require confirmation:

• npm create *
• rm -rf *
• git reset --hard
• git checkout -- .
• git clean -fd

Example destructive paths:

• /Users//www/
• ~/.../
• $HOME/*

Severity

CRITICAL - Results in permanent data loss without user confirmation