Claude Code Without Permissions: A Risk to Your Data

What is confirmed in this story

The alleged deletion of ~/Library itself has not been confirmed, but the danger of the selected mode is documented officially. As of November 8, 2026, there is no reliable primary report, postmortem, or discussion establishing the claimed sequence of events.

In the retold version, Claude Code running on Opus 5.5 in xHigh mode allegedly executed rm -rf against the macOS user library. The command supposedly ran for nearly two minutes and affected application data, saved passwords, and system settings. These details must not be presented as established fact: available materials do not independently verify them.

What Anthropic does explicitly document in its Claude Code permissions-mode documentation is the core risk mechanism. The --dangerously-skip-permissions flag maps to bypassPermissions mode: approval prompts and safety checks are disabled, so tool calls, including potentially destructive shell commands, execute immediately.

This is neither a sandbox nor a restriction to the project scope. If the process can access the host, the agent has the same file reach as the user account. For a command such as rm -rf ~/Library, the shell expands the home directory and recursive deletion begins traversing the user library.

In the normal mode, a manual gate still exists before a dangerous action. When permissions are bypassed, a model error, an incorrect variable, or prompt injection becomes a system action immediately. Anthropic specifically warns about data loss, system damage, and information disclosure.

Why command approval alone is not enough

The main lesson is simple: approval and isolation solve different problems. The first may stop a suspicious command; the second limits the damage if that command is launched automatically anyway.

For autonomous runs with permissions bypassed, Anthropic recommends an isolated container, virtual machine, or sandbox with no internet access. In such a setup, I would first inspect visible directories, write permissions, network access, and file recovery options—not the model's intelligence level.

The ~/Library story may prove to be an inaccurate retelling, but that does not remove the architectural flaw. An autonomous agent with full shell access, broad file-system permissions, and no approvals already constitutes an incident scenario. The only uncertainty is when a likely error becomes irreversible.

We have already examined where Claude, as a development tool, can make mistakes and create risks in system administration and DevOps work. This rm -rf case shows why such actions must not be trusted without explicit restrictions and review.