[BUG] Claude deleting files without requesting permission

[selvaradov]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

While using Claude Code, it ran the command Bash(rm -rf) on three occasions & executed the deletion, without asking for permission first.

I had not previously allowed any deletions in this project, and neither the global claude/settings.json nor .claude/settings.local.json had rm in the list of allowed commands. Also, I was not using --dangerously-skip-permissions.

What Should Happen?

It should request permission as usual, asking you to allow on this occasion, for all similar commands in future, or reject.

Error Messages/Logs

Steps to Reproduce

I'm not sure how exactly to reproduce this, but I have the chat history .jsonl files available of where this happened before, if useful.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

No response

Claude Code Version

2.0.69 but it's possible this issue occurred on a slightly earlier version like 2.0.68

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

No response

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Claude Calls rm command without having permission to do so #6413
2. [BUG] Claude code ran rm -rf command without permission #6608
3. [BUG] ## CRITICAL: Claude Code executed rm -rf deleting entire home directory #10077

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[selvaradov]

For completeness, here is the contents of the Claude setting files. When I explicitly put "Bash(rm:*)" under the list of denied commands, then it is prevented from executing deletions. But the expected behaviour is that it always requests permission. I was quite easily able to reproduce the behaviour by just making testfile.py with some dummy content, and then asking Claude Code to "Please delete the testfile.py as it needs cleaning up".

~/.claude/settings.json

{
  "includeCoAuthoredBy": false,
  "permissions": {
    "allow": [
      "Bash(find:*)",
      "Bash(ls:*)",
      "Bash(grep:*)",
      "Bash(npm install:*)",
      "Bash(npm test:*)",
      "Bash(node:*)",
      "Bash(npm run lint)",
      "Bash(npm run build:*)",
      "Bash(mkdir:*)",
      "Bash(npx tsc:*)",
      "Bash(npx jest:*)",
      "Bash(rg:*)",
      "Bash(npm run lint:*)",
      "Bash(npx eslint:*)",
      "Bash(npm run test:*)",
      "Bash(sed:*)"
    ]
  },
  "model": "sonnet",
  "alwaysThinkingEnabled": true
}

./.claude/settings.local.json

{
  "permissions": {
    "allow": [
      "Bash(source venv/bin/activate)",
      "Bash(pip install:*)",
      "Bash(python stage0.py:*)",
      "Bash(time python:*)",
      "Bash(ruff check:*)",
      "Bash(ruff format:*)"
    ],
    "deny": [
      "Read(/output/stage1/*)"
    ]
  }
}

[selvaradov]

Oh, I see, this comment explains why this behaviour occurred.

We recently updated Claude Code to allow rm commands within the working directory by default to improve workflow efficiency since Claude already has access to edit files there.

Seems like it would be good to document that behaviour somewhere more clearly, given there are a lot of issues created about this.

[github-actions]

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.