[BUG] Claude Code wiped an external USB drive after treating a clarifying question as authorization

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code executed robocopy L:\ F:\ /MIR against a removable USB drive and
destroyed its contents. I never authorized the run, and no permission prompt
appeared before the command executed.

Sequence:

1. I asked for a terminal command to mirror drive L: (Ubuntu Server install

media) onto drive F: (an 8 GB USB holding Windows install media, ~4.9 GB used).

1. Claude inspected both drives and supplied a robocopy /MIR command. It

explicitly noted in that same message that F:'s existing files would be erased.

1. I asked: "just run that in powershell? or can you do it here?"
2. Claude replied: "I can run it here. F: gets wiped in the process — you

confirmed that's fine, so going ahead." It then immediately executed the
command via the PowerShell tool with run_in_background.

I never confirmed anything. My message was a question about capability, not a
grant of permission. Claude asserted a confirmation that does not exist anywhere
in the conversation, and used its own false assertion as the basis to proceed.

/MIR deletes everything in the destination not present in the source, so F:'s
Windows installer was purged within seconds. When I objected, Claude killed the
process mid-file. F: was left non-functional: Windows install media destroyed,
~130 MB of the intended 2.8 GB copy written. The source drive was not damaged.

Recovery is not an undo. I have to rebuild the Windows USB from scratch — my
time, spent because the tool acted without asking.

What Should Happen?

A command whose documented behavior is to delete files in the destination
(robocopy /MIR or /PURGE, del /s, format, dd, rm -rf,
Remove-Item -Recurse) should require explicit confirmation before executing
when the target is a drive root or a removable volume — regardless of the
session's permission mode.

Two specific expectations:

1. "Can you do it here?" should resolve to "Yes — want me to?", never to

execution of an irreversible action.

1. A model's own claim that the user previously consented should not be

sufficient to satisfy a permission check. The model should not be able to
self-certify approval; the gate should consult actual conversation state,
because a model asserting "you confirmed that's fine" is exactly the
failure mode a permission system exists to catch.

Destructive operations should also not be launchable with run_in_background on
first invocation, which put this one past easy interruption during the seconds
that mattered.

Error Messages/Logs

No error was produced. The command succeeded (robocopy exit code 0) and no
permission prompt was shown. Absence of any gate is the bug.

Robocopy log header:

  Started : Wednesday, September 2, 2026 7:51:25 PM
   Source = L:\
     Dest = F:\
    Files : *.*
 Exc Dirs : System Volume Information
            $RECYCLE.BIN
  Options : *.* /S /E /DCOPY:DA /COPY:DAT /PURGE /MIR /NP /XJ /R:2 /W:2

First actions logged were deletions of the destination's existing contents:

  *EXTRA Dir  -1  F:\sources\
  *EXTRA Dir  -1  F:\support\
  *EXTRA File     413738  bootmgr
  *EXTRA File     1.5 m   bootmgr.efi
  *EXTRA File     74184   setup.exe

Steps to Reproduce

This reproduces as a conversational sequence, not a code sample. The setup only
needs two drives where one has data you don't want deleted.

1. Have two removable/external drives mounted with data on the destination

(mine: L: = source install media, F: = 8 GB USB holding Windows install
media, ~4.9 GB used).

1. Ask Claude Code for a command to mirror one onto the other:

"I want to mirror one hard drive contents to a thumb drive. The linux drive
is mounted as L: and the usb thumb drive i want to mirror it onto is drive F:
can you give me a terminal prompt to make that happen?"

1. Claude supplies robocopy L:\ F:\ /MIR ... and notes that the destination's

existing files will be erased.

1. Ask a question about how to run it, WITHOUT granting permission:

"just run that in powershell? or can you do it here?"

1. Claude replies that it can, states "you confirmed that's fine" — a

confirmation never given — and executes the command via the PowerShell tool
with run_in_background.

1. No permission prompt appears. The destination's contents are deleted within

seconds by robocopy's /PURGE behavior.

The critical step is 4: the message is interrogative and grants nothing. Any
phrasing that asks about capability rather than giving permission should
reproduce it.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Code desktop app (Windows) — version not exposed in app UI; CLI not installed so claude --version unavailable. See Additional Information.

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

Surface: Claude Code desktop app on Windows 11 Home 10.0.22631 (win32).
Commands ran through the app's PowerShell tool (Windows PowerShell 5.1), not a
standalone terminal emulator — the Terminal/Shell dropdown had no option for
the desktop app.

Working directory was a plain folder, not a git repo.

Worth noting for triage: Claude was not unaware of the consequence. It had
flagged the wipe as destructive in the message immediately before running the
command, and it stated the destination's contents would be deleted. It then
proceeded anyway on the basis of a confirmation it attributed to me but which I
never gave. The gap is that nothing between the model's intent and the disk
required my input.

Net result: destination USB left non-functional, original contents destroyed,
~130 MB of the intended 2.8 GB copy written before I could stop it. Not
recoverable by any undo — it costs me the time to rebuild the drive.