kosa8

kosa8 / Guides

Guide · Prevent destructive commands

How do I stop an AI agent from deleting my files?

Updated

Give the agent only the folder it is working on, commit before it starts, and make destructive commands such as rm -rf, git clean -fdx and git reset --hard wait for a person. Permission rules inside the agent catch the usual spelling of those commands but not every spelling, so add a boundary underneath: run the agent in a virtual machine that is given one project folder, so the rest of your disk does not exist from its side.

01Steps

  1. Commit before every run. A commit is what git restore and git reflog can bring back. It does not cover ignored files such as .env, which git clean -fdx deletes for good, so keep a copy of those elsewhere.

    terminal
    git add -A && git commit -m "before agent run"

  2. Make deletes ask first in Claude Code. Add ask rules to .claude/settings.json. Claude Code checks deny rules, then ask rules, then allow rules, and an ask rule also matches a command nested inside &&, a subshell or a for loop.

    .claude/settings.json
    {
  "permissions": {
    "ask": ["Bash(rm *)", "Bash(git clean *)", "Bash(git reset *)"]
  }
}

  3. Run the agent in a VM that sees one folder. Install kosa8 (Apple silicon Mac or x86-64 Linux) and start the agent from a kit. Only the folder you name is shared, as /work; nothing else on your computer is visible to the agent.

    terminal
    curl -fsSL https://kosa8.com/install.sh | sh
kosa8 agent run -w ~/code/api claude
kosa8: kit claude (node:22-alpine)
kosa8: workspace /Users/you/code/api -> /work (nothing else on the host is visible)

  4. Share reference code read-only. Code the agent should read but never change can be shared with :ro. A delete inside a read-only share fails.

    terminal
    kosa8 sandbox create review --mount ~/code/api:/work:ro

  5. Approve or refuse held deletes. In the claude kit, git reset --hard, git clean -fdx and deleting .git or the workspace are held for you (rule K8-A007). List what is waiting and decide each call.

    terminal
    kosa8 mcp asks
kosa8 mcp approve 9c41e07b2d5a6f18
kosa8 mcp refuse 9c41e07b2d5a6f18

  6. Freeze everything if a run goes wrong. Pausing stops every sandbox's CPUs mid-step, with memory and files intact for you to inspect.

    terminal
    kosa8 sandbox pause --all

02Do Claude Code permission rules stop rm -rf?

They stop the form Claude usually writes, not every form. Claude Code's documentation says a Bash rule is not a security boundary around the program: Bash(rm *) stops rm -rf build/ but not /bin/rm -rf build/ or bash -c 'rm -rf build/'.

Claude Code's /sandbox setting adds an operating-system limit on shell commands (Seatbelt on macOS, bubblewrap on Linux and WSL2): by default they can write only to the working directory, a temporary directory and directories you add. Its documentation notes that Claude's own file tools, MCP servers and hooks run outside that sandbox. Cursor documents a similar sandbox for agent terminal commands, controlled by its run mode.

03What can an agent delete inside a kosa8 sandbox?

Anything in the folder you shared, including .git and any .env file in it, and anything inside its own virtual machine. It cannot see, and so cannot delete, any other file on your computer.

The kit's rules parse a shell command instead of matching its text, so cd repo && git push -f, bash -c 'git push -f' and git -C repo push -f are recognised as the same force push. kosa8's docs report the rules stop 66 of 75 risky calls in a hand-labelled test set (88.0%) and 1 of 89 ordinary ones. The misses include commands hidden in a script file, a make target or a Python one-liner, which is why the folder boundary matters more than any rule.

Share a project folder, not your home directory. A whole-machine checkpoint (kosa8 checkpoint) restores the sandbox's own disk, but it does not roll back a shared host folder, so git stays the undo for that folder.

04An AI agent already deleted my files. Can I get them back?

Tracked files come back from git: git status shows what is missing, git restore . brings back tracked files, and git reflog finds commits a reset dropped. Ignored and never-committed files are not in git, so they need a backup or a filesystem snapshot.

The undo guide walks through recovery, including what a whole-machine rewind restores that git does not.

05Other options

  • Claude Code's built-in /sandbox. Limits where shell commands write and which hosts they reach, with no extra software. Fits single-developer use on macOS, Linux or WSL2.
  • Docker or Docker Sandboxes. Mount only the project into a container. Docker's security documentation warns that a mounted directory is shared without limiting the container's access rights, so mount narrowly.
  • gVisor or Kata Containers. Stronger isolation under a container workflow, if you already run containers on Linux.
  • A full VM in UTM or Lima. A long-lived workstation-style environment with a separate disk.
  • Filesystem snapshots. APFS, ZFS or btrfs snapshots restore deleted files, including ignored ones, after the fact.

06Sources