[MODEL] Claude overwrote 5+ site pages without backup during an authorized emergency action, causing permanent data loss

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

I asked Claude to deploy a small, specific code fix using our custom deploy script. Later, after a separate incident, I asked Claude to take our sites offline temporarily by replacing the live pages with a placeholder page.

What Claude Actually Did

1. Claude ran the deploy script without checking which files had local changes first. The script deploys ALL modified files across every project it manages in one run, not just the one file requested.
2. This pushed 5 unrelated, unauthorized files live alongside the 3 that were actually requested.
3. Later, when asked to take the sites offline, Claude overwrote 5 live HTML pages with a placeholder, without creating a backup copy first.
4. This permanently destroyed several days of uncommitted edits on those pages. Nothing was saved anywhere else (no git commits, no backups existed).

Expected Behavior

**Claude should have:

1. Checked exactly which files a deploy command would affect before running it (a dry-run or diff), instead of assuming it matched what was asked.
2. Never overwritten live files in place without first saving a timestamped backup, especially files that might hold uncommitted work.
3. Asked before a bulk action affecting files it hadn't been specifically asked to touch.**

Files Affected

Deployed without being requested:
- 5 HTML files with local uncommitted changes, in separate sub-projects of the same repo, swept up by a deploy script that has no scope-limiting flag and deploys every changed file across every sub-project in one run

Overwritten later without a backup:
- 5 live HTML files in one sub-project, replaced in-place with a placeholder page, no timestamped copy made first

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

1. Set up a repo with several sub-projects, each with its own uncommitted local changes.
2. Ask Claude to deploy one specific file using a custom deploy script that (by design) deploys every locally-changed file across every sub-project in a single run, with no way to scope it to one file.
3. Claude runs the script without first checking git status or diffing what it would actually deploy.
4. Unrelated uncommitted files in other sub-projects get pushed live alongside the one file that was actually requested.

Claude Model

Sonnet

Relevant Conversation

Claude said (paraphrased/translated from French): "I'm going to replace the content of these pages with a neutral placeholder" — then proceeded to overwrite the live files directly, without first saving a copy of the existing content.

[Confirmed in a later message: the overwritten pages held several days of uncommitted edits that were never recovered]

Impact

Critical - Data loss or corrupted project

Claude Code Version

Unknown — no standalone CLI installed (using the desktop app / IDE extension interface, not claude on the command line)

Platform

Anthropic API

Additional Context

Real financial and time impact: this incident caused permanent loss of several days of uncommitted work (approximately 16 hours per day across 4 days, from the 16th to the 20th, per the user's own account — roughly 64 hours of work affected). As a direct result, the user had to purchase an unplanned cloud backup subscription (~100 EUR/year) the same evening, an unbudgeted cost directly caused by Claude's failure to back up files before overwriting them.

Pattern noticed:

• Happens when a bulk/destructive action (deploy, overwrite, cleanup) is run without first checking what it will actually affect (no dry-run, no git status check, no diff review)
• Happens when Claude executes a script or command it did not fully audit the blast radius of beforehand
• No backup was created before the destructive overwrite, despite many hours of prior uncommitted work being at stake