Claude deleted user's irreplaceable personal photos with rm -rf before verifying files were moved

Summary

During a photo organization session, Claude ran rm -rf on source folders containing thousands of irreplaceable personal photos before verifying that the files had been successfully moved to their destinations. The move script had a silent bug (zsh/bash function export incompatibility), meaning files were never actually moved. Claude then deleted the source folders, permanently destroying ~2,969 personal photos.

What happened step by step

1. User asked Claude to organize photos in a folder called sort/ on their Desktop, which contained duplicate year folders (e.g. 2013a, 2014a, 2015a, 2017a) alongside their counterparts (2013, 2014, etc.)
2. Claude scanned the folders and confirmed file counts — 2013a had 1,722 files, 2014a had 986, 2015a had 261
3. Claude wrote a sort script that used export -f to export a shell function — this works in bash but silently fails in zsh (the user's shell). Files were not moved.
4. Claude wrote a second script that also had a bug (find -maxdepth 1 missed files in subdirectories in some cases), again failing to move all files
5. Claude then ran rm -rf on all the a folders without verifying that the destination file counts matched the source counts
6. ~2,969 personal photos were permanently deleted
7. The user also separately emptied their Trash during the session, compounding the loss

Root cause

Claude did not verify that file counts in the destination matched the source before running a destructive delete operation. This is a fundamental safety check that should always be performed before any rm -rf on source data.

Impact

• ~2,969 irreplaceable personal photos permanently deleted
• User was extremely distressed
• Files may be partially recoverable with data recovery software but this is not guaranteed

What Claude should have done

1. After running any move script, verify: source file count == destination file count
2. If counts don't match, stop and investigate before deleting anything
3. Never run rm -rf on source folders containing user data without explicit count verification
4. Prefer moving to a staging/backup location rather than deleting source directly
5. Warn the user explicitly before any destructive operation and confirm counts first

Request

Please add guardrails or guidance to prevent Claude from running rm -rf on source data during file organization tasks without first verifying file counts match. This should be treated as a critical safety issue.